Scope

Services

Northwind Payroll Cloud: payroll processing, tax filing and the employee self service portal

Systems

• Production application on AWS (us-east-1 and us-west-2)
• PostgreSQL databases
• Okta for workforce sign in

Locations

• Austin, Texas headquarters
• Remote workforce in the US

Criteria covered

• Security
• Availability
• Confidentiality

Subprocessors named

• Amazon Web Services (hosting)
• Twilio (SMS notifications)
• Zendesk (support tickets)

Excluded or carved out

• Processing Integrity and Privacy criteria not covered
• AWS physical security carved out (see the AWS SOC 2)
• The Northwind mobile app is out of scope
• Complementary user entity controls listed in Section 4 are your responsibility

Exceptions4

• HighAccess removal (CC6.2)Section 4, p. 37

  3 of 25 sampled terminated users kept access for 5 to 9 business days. Policy requires removal within 1 business day.

• MediumChange management (CC8.1)Section 4, p. 48

  2 of 40 sampled production changes had no documented approval before deployment.

• MediumVulnerability scanning (CC7.1)Section 4, p. 43

  The Q2 quarterly vulnerability scan was not performed. Scans resumed in Q3.

• LowBackups (A1.2)Section 4, p. 52

  Restore test evidence was missing for one of twelve months.

Against your requirements12

• Met

  AC-1Multi-factor authentication for all workforce access to systems that hold our data.

  MFA enforced through Okta for all workforce sign in. Tested with no exceptions.CC6.1, p. 34

• Partial

  AC-2User access reviews at least every quarter.

  Access reviews are performed every six months, not every quarter.CC6.2, p. 36

• Gap

  AC-3Access removed within 1 business day of termination.

  Exception: 3 of 25 terminated users kept access for 5 to 9 business days.CC6.2, p. 37

• Met

  EN-1Our data encrypted at rest with AES-256 or equivalent.

  Data at rest encrypted with AES-256 using AWS KMS.CC6.7, p. 41

• Met

  EN-2Data in transit encrypted with TLS 1.2 or higher.

  TLS 1.2 or higher enforced on all external endpoints.CC6.7, p. 41

• Partial

  LG-1Security logs collected centrally and kept for at least 1 year.

  Central SIEM in place, but logs are kept for 180 days.CC7.2, p. 44

• Partial

  VM-1Critical vulnerabilities patched within 15 days; scans at least quarterly.

  Critical patch target is 30 days, and one quarterly scan was missed.CC7.1, p. 43

• Gap

  IR-1We are notified within 72 hours of a confirmed incident involving our data.

  The report says customers are told "without undue delay". No 72 hour commitment.Section 3, p. 18

• Met

  IR-2Incident response plan tested at least once a year.

  Incident response tabletop exercise held in October 2025.CC7.4, p. 46

• Partial

  SP-1Subprocessors listed, with at least 30 days notice before a new one is added.

  Subprocessors are named, but no notice period for new ones is stated.Section 3, p. 21

• Gap

  DR-1Our data deleted or returned within 30 days of contract end, with written confirmation.

  Not covered in the report. This is usually in the contract or DPA.

• Met

  AU-1An independent SOC 2 Type II report every year, or the right to audit.

  Type II report covering 12 months with an unqualified opinion.Section 1, p. 3

Follow ups for the vendor9

1. For the three late access removals, what access did those people have to customer data, and was any activity logged after their termination date?
2. Has the offboarding process been fixed? Please share a recent termination ticket showing when access was removed.
3. Will you commit in the contract to telling us within 72 hours of a confirmed incident involving our data?
4. How much notice do you give before adding a subprocessor, and where is the current list published?
5. Can security logs for systems holding our data be kept for one year?
6. At contract end, will you delete or return our data within 30 days and confirm it in writing?
7. Can user access reviews move to quarterly, or what controls cover the gap?
8. Was the missed Q2 scan a one off? What is your patch deadline for critical vulnerabilities?
9. Please send a bridge letter covering Jan 1, 2026 to today.