---
title: Rhythm 2.0 Control Catalogue
revision: 1
status: draft
product_intent: proposed
implementation_evidence: not-investigated
source_sha:
  rhythm-v2-docs: aeae146fee5c978c3294dd04130c1eca4c0aac24
provenance: documented
source: 'user-provided:controls-catalogue-1#Forge source'
intent_sources:
  - 'rhythm-v2-docs:specs/CONVENTIONS.md#12 (Andrew, 2026-10-23)'
evidence:
  - 'user-provided:Forge:SOC2_CONTROL_CATALOG.md'
  - 'user-provided:Forge:CONTROL_APPLICABILITY_RULES.md'
  - 'user-provided:Forge:AI_CONTROL_STANDARD.md'
  - 'user-provided:Forge:ORGANIZATIONAL_CONTROL_REGISTER.md'
  - 'rhythm-v2-docs:specs/CONVENTIONS.md#4, 6, 12'
  - 'rhythm-v2-docs:specs/templates/'
  - 'rhythm-v2-docs:specs/platform/security/MODULE.md'
  - 'rhythm-v2-docs:specs/platform/llm/MODULE.md'
  - 'rhythm-v2-docs:specs/platform/operations/MODULE.md'
  - 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-017-let-rhythm-staff-into-a-customer-s-workspace-only-by-consent.md'
  - 'rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-001-make-every-ai-request-through-one-metered-path.md'
  - 'rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-020-change-a-query-or-a-directory-s-filters-by-asking-jazz.md'
  - 'rhythm-v2-docs:specs/platform/operations/planning/capabilities/CAP-PFM-OPS-002-settle-jobs-whose-work-stopped-timed-out-or-never-started.md'
controls:
  - id: TC-IAM-001
    title: "Attributable Identity for Every Actor"
    family: "IAM"
    class: ["preventive", "automated"]
    applies_when: "Every actor accessing Rhythm"
    verification: "Refuse unidentified callers and verify that configuration offers no shared accounts"
    evidence_source: "Identity provider inventory; audit events with actor identity"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-IAM-001"
  - id: TC-IAM-002
    title: "Central Authentication for Human Access"
    family: "IAM"
    class: ["preventive", "automated"]
    applies_when: "Any application or environment a person can access"
    verification: "Refuse unauthenticated requests and forged or foreign-issuer credentials"
    evidence_source: "Identity provider configuration; authentication failure logs"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-IAM-002"
  - id: TC-IAM-003
    title: "Multiple Factors for Privileged Access"
    family: "IAM"
    class: ["preventive", "manual", "automated"]
    applies_when: "Staff, platform administration, cloud or deployment access"
    verification: "Verify provider policy and refuse staff sign-in without a second factor; repeat evidence collection quarterly and after changes"
    evidence_source: "MFA policy exports; sign-in records identifying factors"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-IAM-003"
  - id: TC-IAM-004
    title: "Bounded Sessions and Effective Revocation"
    family: "IAM"
    class: ["preventive", "automated"]
    applies_when: "Any authenticated application"
    verification: "Reject expired sessions and prove revoked sessions stop acting within the documented interval"
    evidence_source: "Session settings; refusal audit events"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-IAM-004"
  - id: TC-IAM-005
    title: "Credential Validation at Every Boundary"
    family: "IAM"
    class: ["preventive", "automated"]
    applies_when: "Any component receiving a token or signed assertion"
    verification: "Reject expired, unsigned, tampered, wrong-issuer and wrong-audience credentials"
    evidence_source: "Test results; credential rejection logs"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-IAM-005"
  - id: TC-IAM-006
    title: "Separate Machine Identities"
    family: "IAM"
    class: ["preventive", "automated"]
    applies_when: "Scheduled, queued or workflow-driven execution"
    verification: "Assert distinct execution roles during infrastructure synthesis and distinguish machine from human audit actors"
    evidence_source: "Infrastructure definitions; audit events with actor type"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-IAM-006"
  - id: TC-AZ-001
    title: "Declared Permissions for Operations"
    family: "AZ"
    class: ["preventive", "automated"]
    applies_when: "Every API operation, command and job entry point"
    verification: "Check that every operation declares its required permission and fail the build for omissions"
    evidence_source: "Operation specifications; build check results"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-AZ-001"
  - id: TC-AZ-002
    title: "Server Enforcement at Each Operation"
    family: "AZ"
    class: ["preventive", "automated"]
    applies_when: "Every operation with a required permission"
    verification: "Call every operation directly with insufficient authority and assert refusal in integration tests"
    evidence_source: "Integration test results per build"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-AZ-002"
  - id: TC-AZ-003
    title: "Denied Access on Missing Grants or Errors"
    family: "AZ"
    class: ["preventive", "automated"]
    applies_when: "Every authorization decision"
    verification: "Inject authorization dependency failures and prove requests remain denied"
    evidence_source: "Failure-path test results; refusal events"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-AZ-003"
  - id: TC-AZ-004
    title: "Least Privilege in Roles and Policies"
    family: "AZ"
    class: ["preventive", "manual", "automated"]
    applies_when: "Any product role, permission set or infrastructure policy"
    verification: "Test all allowed and denied permission combinations and inspect synthesized policies for wildcards"
    evidence_source: "Permission matrix results; infrastructure definitions; policy scans"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-AZ-004"
  - id: TC-AZ-005
    title: "Separate Platform Authority and Evidence"
    family: "AZ"
    class: ["preventive", "automated"]
    applies_when: "Platform administration or actions crossing workspace boundaries"
    verification: "Refuse every platform operation to workspace-only administrators and assert each privileged audit event"
    evidence_source: "Permission test results; audit event store"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-AZ-005"
  - id: TC-AZ-006
    title: "Access Changes Within a Tested Bound"
    family: "AZ"
    class: ["preventive", "automated"]
    applies_when: "Cached, replicated or token-embedded authorization state"
    verification: "Remove a grant or change a role and prove subsequent decisions reflect it within the stated bound"
    evidence_source: "Revocation tests; access-change audit events"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-AZ-006"
  - id: TC-TEN-001
    title: "Workspace Ownership on Records and Queries"
    family: "TEN"
    class: ["preventive", "automated"]
    applies_when: "Any store containing workspace-owned data"
    verification: "Assert required workspace references and prove unscoped queries return no workspace data"
    evidence_source: "Schema definitions; constraint and isolation tests"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-TEN-001"
  - id: TC-TEN-002
    title: "Authorized Workspace Context"
    family: "TEN"
    class: ["preventive", "automated"]
    applies_when: "Any workspace-scoped operation"
    verification: "Supply another workspace's identifier through a valid session and prove access is refused"
    evidence_source: "Isolation test results; refusal events"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-TEN-002"
  - id: TC-TEN-003
    title: "No Disclosure Across Workspace Boundaries"
    family: "TEN"
    class: ["preventive", "automated"]
    applies_when: "Any operation locating a resource by identifier"
    verification: "Compare existing foreign resources with absent resources and assert identical observable responses"
    evidence_source: "Paired isolation test results"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-TEN-003"
  - id: TC-TEN-004
    title: "Isolation Within a Workspace"
    family: "TEN"
    class: ["preventive", "automated"]
    applies_when: "Operations restricted to a narrower scope within a workspace"
    verification: "Test every scoped operation against resources in other organizational units, records or applicable project scopes"
    evidence_source: "Scope refusal test results"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-TEN-004"
  - id: TC-SEC-001
    title: "Secrets Excluded from Published Material"
    family: "SEC"
    class: ["preventive", "automated"]
    applies_when: "All work"
    verification: "Run secret scans before commit and in CI, failing on detection"
    evidence_source: "Scanner output; CI run records"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-SEC-001"
  - id: TC-SEC-002
    title: "Managed Secret Storage and Audited Reads"
    family: "SEC"
    class: ["preventive", "automated"]
    applies_when: "Any component needing a credential"
    verification: "Verify runtime secret references and reading roles in infrastructure; reject committed plaintext secret definitions"
    evidence_source: "Infrastructure definitions; cloud audit records of secret access"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-SEC-002"
  - id: TC-SEC-003
    title: "Rotation and Revocation Without Source Changes"
    family: "SEC"
    class: ["preventive", "manual", "automated"]
    applies_when: "Any long-lived credential"
    verification: "Review both procedures and exercise rotation at least annually and on suspected exposure"
    evidence_source: "Rotation exercise records; secret version history"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-SEC-003"
  - id: TC-SEC-004
    title: "Secret Scans Block Merge"
    family: "SEC"
    class: ["detective", "automated"]
    applies_when: "All work"
    verification: "Verify secret scanning is required by default-branch protection"
    evidence_source: "CI configuration; protection exports; scan run history"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-SEC-004"
  - id: TC-CRY-001
    title: "Encrypted Transport"
    family: "CRY"
    class: ["preventive", "automated"]
    applies_when: "All connections carrying customer data or credentials"
    verification: "Verify TLS enforcement on listeners and store connections; reject plaintext attempts"
    evidence_source: "Infrastructure definitions; endpoint TLS settings"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-CRY-001"
  - id: TC-CRY-002
    title: "Encryption of Durable Data"
    family: "CRY"
    class: ["preventive", "automated"]
    applies_when: "Any durable store"
    verification: "Assert encryption during synthesis for every declared store"
    evidence_source: "Infrastructure definitions; synthesis results; deployed encryption settings"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-CRY-002"
  - id: TC-CRY-003
    title: "Controlled Key Management"
    family: "CRY"
    class: ["preventive", "manual", "automated"]
    applies_when: "Encrypted stores or signing operations"
    verification: "Inspect key policies and assert enabled rotation or a documented rotation schedule"
    evidence_source: "Managed key settings; cloud audit records of key use"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-CRY-003"
  - id: TC-CRY-004
    title: "Vetted Cryptography"
    family: "CRY"
    class: ["preventive", "manual", "automated"]
    applies_when: "Any cryptographic operation"
    verification: "Scan for weak algorithms and custom primitives; review approved library use"
    evidence_source: "Static analysis findings; peer review records"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-CRY-004"
  - id: TC-DAT-001
    title: "Classification of Stored Information"
    family: "DAT"
    class: ["preventive", "manual", "automated"]
    applies_when: "New or changed persisted structures"
    verification: "Check classification coverage for every stored element in the owning specification"
    evidence_source: "Classification declarations; coverage reports"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-DAT-001"
  - id: TC-DAT-002
    title: "Minimum Collection and Transfer"
    family: "DAT"
    class: ["preventive", "manual", "automated"]
    applies_when: "Collection, export or outbound transfer"
    verification: "Review the purpose of each outbound field and test that excluded fields are absent"
    evidence_source: "Security review records; payload exclusion tests"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-DAT-002"
  - id: TC-DAT-003
    title: "Enforced Retention Periods"
    family: "DAT"
    class: ["preventive", "manual", "automated"]
    applies_when: "Stores containing confidential or personal data"
    verification: "Review stated periods and test enforcing jobs or lifecycle policies"
    evidence_source: "Retention declarations; lifecycle settings; job execution history"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-DAT-003"
  - id: TC-DAT-004
    title: "Complete and Evidenced Deletion"
    family: "DAT"
    class: ["preventive", "automated"]
    applies_when: "Deletion, deactivation or offboarding"
    verification: "Delete a resource and assert absence across every declared store; reconcile store coverage with the schema"
    evidence_source: "Deletion tests; job records; completion audit events"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-DAT-004"
  - id: TC-DAT-005
    title: "Authorized Customer Export"
    family: "DAT"
    class: ["preventive", "automated"]
    applies_when: "An export or portability commitment"
    verification: "Test workspace scope and refusal to unauthorized callers"
    evidence_source: "Export tests; export audit records"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-DAT-005"
  - id: TC-DAT-006
    title: "Safe Data in Non-Production Environments"
    family: "DAT"
    class: ["preventive", "manual", "automated"]
    applies_when: "Development, test or demonstration environments"
    verification: "Inspect synthetic fixture sources and prove production connections are inaccessible"
    evidence_source: "Fixture sources; environment settings; approved exceptions"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-DAT-006"
  - id: TC-DAT-007
    title: "Equivalent Protection for Backups"
    family: "DAT"
    class: ["preventive", "automated"]
    applies_when: "Backups of classified stores"
    verification: "Assert backup protection and document the retention window during synthesis review"
    evidence_source: "Backup configuration; backup run history"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-DAT-007"
  - id: TC-LOG-001
    title: "Audit Events for Sensitive Actions"
    family: "LOG"
    class: ["detective", "automated"]
    applies_when: "Privileged, platform-wide, access-changing or exporting actions"
    verification: "Enumerate every qualifying operation and assert durable events and required fields"
    evidence_source: "Durable audit event store"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-LOG-001"
  - id: TC-LOG-002
    title: "Complete Audit Context"
    family: "LOG"
    class: ["detective", "automated"]
    applies_when: "Every audit event"
    verification: "Require event fields through schema constraints and assert values for successes and refusals"
    evidence_source: "Audit schema; audit event store"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-LOG-002"
  - id: TC-LOG-003
    title: "Protected Audit History"
    family: "LOG"
    class: ["preventive", "automated"]
    applies_when: "Any audit store"
    verification: "Attempt application updates and deletion and prove refusal; inspect grants for those permissions"
    evidence_source: "Mutation refusal tests; database grants; infrastructure definitions"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-LOG-003"
  - id: TC-LOG-004
    title: "Security Events for Access Refusals"
    family: "LOG"
    class: ["detective", "automated"]
    applies_when: "Authentication or authorization boundaries"
    verification: "Assert security events in every negative authentication and authorization test"
    evidence_source: "Security event logs"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-LOG-004"
  - id: TC-LOG-005
    title: "Redaction in Logs and Errors"
    family: "LOG"
    class: ["preventive", "automated"]
    applies_when: "Logging or error paths handling classified information"
    verification: "Exercise each sensitive field through logs and error responses and assert redaction"
    evidence_source: "Redaction tests; reviewed log samples"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-LOG-005"
  - id: TC-CHG-001
    title: "Versioned Production Changes"
    family: "CHG"
    class: ["preventive", "manual", "automated"]
    applies_when: "All work"
    verification: "Trace deployments to commits and detect infrastructure drift at synthesis or deployment"
    evidence_source: "Commit history; deployment records; drift reports"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-CHG-001"
  - id: TC-CHG-002
    title: "Independent Review Before Merge"
    family: "CHG"
    class: ["preventive", "manual", "automated"]
    applies_when: "Every default-branch change"
    verification: "Externally verify branch protection requires approval by a reviewer other than the author"
    evidence_source: "Pull request reviews; branch protection settings"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-CHG-002"
  - id: TC-CHG-003
    title: "Protected Default Branch"
    family: "CHG"
    class: ["preventive", "automated"]
    applies_when: "All work"
    verification: "Export and inspect repository protection settings quarterly; external verification required"
    evidence_source: "Default-branch protection exports"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-CHG-003"
  - id: TC-CHG-004
    title: "Passing Required Checks"
    family: "CHG"
    class: ["preventive", "automated"]
    applies_when: "Every change"
    verification: "Compare CI check definitions with required branch protection checks"
    evidence_source: "CI definitions; run history for each commit; protection settings"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-CHG-004"
  - id: TC-CHG-005
    title: "Authorized and Recorded Automation for Deployment"
    family: "CHG"
    class: ["preventive", "automated"]
    applies_when: "Any deployment"
    verification: "Verify only the authorized deployment workflow holds production credentials"
    evidence_source: "Workflow run history; AWS deployment records"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-CHG-005"
  - id: TC-CHG-006
    title: "Separate Environments and Credentials"
    family: "CHG"
    class: ["preventive", "manual", "automated"]
    applies_when: "All environments"
    verification: "Inspect isolated configuration and credential scope; externally verify AWS account boundaries"
    evidence_source: "Infrastructure definitions; cloud account and role inventories"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-CHG-006"
  - id: TC-CHG-007
    title: "Reviewed Migrations and Rollback Position"
    family: "CHG"
    class: ["preventive", "manual", "automated"]
    applies_when: "Schema or data migrations"
    verification: "Review destructive effects and verify the release states what rollback means after migration"
    evidence_source: "Migration records; approving reviews; release records"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-CHG-007"
  - id: TC-VUL-001
    title: "Dependency Scanning and Remediation Windows"
    family: "VUL"
    class: ["detective", "automated"]
    applies_when: "All work"
    verification: "Verify required scans on changes and weekly scans of the default branch"
    evidence_source: "Dependency scan runs; exception records"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-VUL-001"
  - id: TC-VUL-002
    title: "Required Static Analysis"
    family: "VUL"
    class: ["detective", "automated"]
    applies_when: "All work"
    verification: "Verify required lint and type checks enable security-relevant rules"
    evidence_source: "CI run history; analysis settings"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-VUL-002"
  - id: TC-VUL-003
    title: "Infrastructure Security Scanning"
    family: "VUL"
    class: ["detective", "automated"]
    applies_when: "Infrastructure changes"
    verification: "Run synthesis assertions and configuration scans before deployment"
    evidence_source: "Synthesis test results; infrastructure scan output"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-VUL-003"
  - id: TC-VUL-004
    title: "Tracked Vulnerability Resolution"
    family: "VUL"
    class: ["corrective", "manual", "automated"]
    applies_when: "All vulnerability findings"
    verification: "Review the unified tracked list monthly for owners, severity and target dates"
    evidence_source: "Issue records; exception records; monthly reviews"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-VUL-004"
  - id: TC-AVL-001
    title: "Defined Availability and Recovery Commitments"
    family: "AVL"
    class: ["preventive", "manual"]
    applies_when: "An availability, durability or recovery commitment exists"
    verification: "Compare customer-verifiable objectives with the documented recovery design"
    evidence_source: "Requirements; recovery design records"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-AVL-001"
  - id: TC-AVL-002
    title: "Automatic Backups of Authoritative Information"
    family: "AVL"
    class: ["preventive", "automated"]
    applies_when: "Any authoritative durable store"
    verification: "Assert backup frequency, retention and failure alarms in infrastructure synthesis"
    evidence_source: "Backup settings; execution history; alarm configuration"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-AVL-002"
  - id: TC-AVL-003
    title: "Exercised Restoration"
    family: "AVL"
    class: ["detective", "manual"]
    applies_when: "Any backed-up store"
    verification: "Perform and externally verify an isolated restore at least annually"
    evidence_source: "Restoration exercise records and outcomes"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-AVL-003"
  - id: TC-AVL-004
    title: "Resumable Durable Work"
    family: "AVL"
    class: ["preventive", "automated"]
    applies_when: "Asynchronous or multi-step durable operations"
    verification: "Prove recovery after execution failure and absence of an unadvanceable customer-visible state"
    evidence_source: "Workflow histories; resume and failure tests"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-AVL-004"
  - id: TC-AVL-005
    title: "Abuse Resistance on Exposed Operations"
    family: "AVL"
    class: ["preventive", "automated"]
    applies_when: "Publicly reachable or unauthenticated operations"
    verification: "Exceed each enforced limit and assert refusal and a security event"
    evidence_source: "Abuse-control settings; refusal logs"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-AVL-005"
  - id: TC-MON-001
    title: "Monitoring of Deployed Components"
    family: "MON"
    class: ["detective", "automated"]
    applies_when: "Any deployed component"
    verification: "Declare monitoring per resource and assert it during synthesis"
    evidence_source: "Metric settings; log and metric retention; infrastructure definitions"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-MON-001"
  - id: TC-MON-002
    title: "Addressed Failure Alerts"
    family: "MON"
    class: ["detective", "automated"]
    applies_when: "Failure conditions requiring human action"
    verification: "Assert the condition, threshold and destination of every alarm"
    evidence_source: "Alarm definitions; alert delivery history"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-MON-002"
  - id: TC-MON-003
    title: "Distinct Security Detection and Alerts"
    family: "MON"
    class: ["detective", "automated"]
    applies_when: "Systems with privileged actions or workspace boundaries"
    verification: "Assert detection rules and trigger them in tests"
    evidence_source: "Detection settings; security alert history"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-MON-003"
  - id: TC-MON-004
    title: "Defined and Recorded Incident Response"
    family: "MON"
    class: ["corrective", "manual"]
    applies_when: "All operations"
    verification: "Externally verify a current procedure and completed exercises"
    evidence_source: "Incident records; incident response plan; exercise records"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-MON-004"
  - id: TC-MON-005
    title: "Review of Significant Incidents"
    family: "MON"
    class: ["corrective", "manual"]
    applies_when: "Any significant incident"
    verification: "Verify a completed review for every qualifying incident"
    evidence_source: "Post-incident review records"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-MON-005"
  - id: TC-PI-001
    title: "Validation Before Domain Processing"
    family: "PI"
    class: ["preventive", "automated"]
    applies_when: "Externally reachable operations"
    verification: "Test missing, malformed, out-of-range and hostile input at every operation boundary"
    evidence_source: "Boundary test results"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-PI-001"
  - id: TC-PI-002
    title: "One Effect Under Repeated Delivery"
    family: "PI"
    class: ["preventive", "automated"]
    applies_when: "Operations delivered through retries, queues or workflows"
    verification: "Deliver the same request twice and assert one outcome and the original result"
    evidence_source: "Duplicate-delivery test results"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-PI-002"
  - id: TC-PI-003
    title: "Visible Concurrent Write Conflicts"
    family: "PI"
    class: ["preventive", "automated"]
    applies_when: "Objects modifiable by more than one actor"
    verification: "Perform a stale write and assert a distinguishable refusal"
    evidence_source: "Concurrency test results"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-PI-003"
  - id: TC-PI-004
    title: "Reconciliation of Asynchronous Work"
    family: "PI"
    class: ["detective", "automated"]
    applies_when: "Queued, scheduled or workflow-driven operations"
    verification: "Exercise reconciliation and assert dead-letter destinations and alarms"
    evidence_source: "Reconciliation history; dead-letter queue metrics; alarms"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-PI-004"
  - id: TC-PI-005
    title: "Authorized and Attributed State Changes"
    family: "PI"
    class: ["preventive", "automated"]
    applies_when: "Objects with a lifecycle"
    verification: "Test every allowed and refused transition and verify authority and attribution"
    evidence_source: "Transition matrix tests; transition history"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-PI-005"
  - id: TC-AI-001
    title: "Application Authority Over Stored State"
    family: "AI"
    class: ["preventive", "automated"]
    applies_when: "Model output influencing stored product state"
    verification: "Supply invalid and hostile output and prove no authoritative write occurs"
    evidence_source: "Model boundary test results"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-AI-001"
  - id: TC-AI-002
    title: "Schema Validation of Model Responses"
    family: "AI"
    class: ["preventive", "automated"]
    applies_when: "Structured model output"
    verification: "Reject malformed, incomplete and unexpected-field responses in tests"
    evidence_source: "Validation tests; model validation failure metrics"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-AI-002"
  - id: TC-AI-003
    title: "Business Validation After Model Output"
    family: "AI"
    class: ["preventive", "automated"]
    applies_when: "Model output entering domain logic"
    verification: "Reject schema-valid output violating references, vocabulary, lifecycle or workspace ownership"
    evidence_source: "Business-rule and cross-workspace output tests"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-AI-003"
  - id: TC-AI-004
    title: "Visible Provenance for Derived Content"
    family: "AI"
    class: ["detective", "automated"]
    applies_when: "Model-derived knowledge shown to a person"
    verification: "Assert recorded derivation, model, prompt version and time and verify their presentation"
    evidence_source: "Derivation and provenance records; presentation tests"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-AI-004"
  - id: TC-AI-005
    title: "Recorded Human Approval Where Required"
    family: "AI"
    class: ["preventive", "automated"]
    applies_when: "A product requirement requires human approval"
    verification: "Attempt application without approval and prove refusal; bind approval to actor and version"
    evidence_source: "Approval audit events; approval gate tests"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-AI-005"
  - id: TC-AI-006
    title: "Versioned Inference Inputs and Provider Choices"
    family: "AI"
    class: ["detective", "automated"]
    applies_when: "Any model invocation"
    verification: "Verify prompts are version controlled and each inference records model, provider and prompt version"
    evidence_source: "Prompt history; inference records; change reviews"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-AI-006"
  - id: TC-AI-007
    title: "Controlled Transfers to Model Providers"
    family: "AI"
    class: ["preventive", "manual", "automated"]
    applies_when: "Outbound model calls carrying customer information"
    verification: "Review classified payloads and provider terms; test exclusions and redaction"
    evidence_source: "Security review; provider settings and agreements; payload tests"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-AI-007"
  - id: TC-VEN-001
    title: "Reviewed Subprocessors Before Use"
    family: "VEN"
    class: ["preventive", "manual"]
    applies_when: "Introducing or changing a third party handling customer information"
    verification: "Verify review and registration predate production data access"
    evidence_source: "Subprocessor register; vendor assessment records"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-VEN-001"
  - id: TC-VEN-002
    title: "Controlled Integration Credentials"
    family: "VEN"
    class: ["preventive", "manual", "automated"]
    applies_when: "Any third-party integration"
    verification: "Review credential scope, managed storage and a source-independent revocation procedure"
    evidence_source: "Integration specifications; secret store records"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-VEN-002"
  - id: TC-VEN-003
    title: "Vendor Support for Customer Commitments"
    family: "VEN"
    class: ["detective", "manual"]
    applies_when: "Customer commitments depending on third parties"
    verification: "Compare commitments with vendor terms annually and whenever either changes"
    evidence_source: "Vendor agreements; comparison reviews"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-VEN-003"
  - id: TC-PRV-001
    title: "Inventory of Personal Information"
    family: "PRV"
    class: ["preventive", "manual", "automated"]
    applies_when: "Personal information stored or transmitted"
    verification: "Check that every personal classification has purpose, location, retention and recipients"
    evidence_source: "Personal information inventory; coverage reports"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-PRV-001"
  - id: TC-PRV-002
    title: "Use Within the Recorded Purpose"
    family: "PRV"
    class: ["preventive", "manual"]
    applies_when: "Collection or use of personal information"
    verification: "Compare each new use with the recorded purpose during security review"
    evidence_source: "Purpose requirements; review records"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-PRV-002"
  - id: TC-PRV-003
    title: "Exercised Data Subject Requests"
    family: "PRV"
    class: ["corrective", "manual", "automated"]
    applies_when: "A privacy commitment or applicable regulation"
    verification: "Exercise authorized access, correction and deletion procedures and inspect request records"
    evidence_source: "Request records; procedure tests"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-PRV-003"
  - id: TC-PRV-004
    title: "Enforced Notice and Preferences"
    family: "PRV"
    class: ["preventive", "automated"]
    applies_when: "Notice or consent governs a use of personal information"
    verification: "Set a prohibiting preference and prove the governed use is refused"
    evidence_source: "Preference records; enforcement tests"
    provenance: "documented"
    source: "user-provided:Forge:SOC2_CONTROL_CATALOG.md#TC-PRV-004"
  - id: TC-ORG-001
    title: "Assigned Security Responsibilities"
    family: "ORG"
    class: ["preventive", "manual"]
    applies_when: "Organization-wide security governance"
    verification: "Externally review assigned roles and responsibilities annually"
    evidence_source: "Organization chart; security role definitions"
    provenance: "documented"
    source: "user-provided:Forge:ORGANIZATIONAL_CONTROL_REGISTER.md#TC-ORG-001"
  - id: TC-ORG-002
    title: "Approved and Acknowledged Security Policies"
    family: "ORG"
    class: ["preventive", "manual"]
    applies_when: "Organization-wide policy governance"
    verification: "Externally verify approved policies and acknowledgements annually"
    evidence_source: "Approved policies; acknowledgement records"
    provenance: "documented"
    source: "user-provided:Forge:ORGANIZATIONAL_CONTROL_REGISTER.md#TC-ORG-002"
  - id: TC-ORG-003
    title: "Checks Before Access on Hiring"
    family: "ORG"
    class: ["preventive", "manual"]
    applies_when: "Hiring where background checks are legally permitted"
    verification: "Externally verify permitted checks precede access grants for each hire"
    evidence_source: "Background check records; access grant dates"
    provenance: "documented"
    source: "user-provided:Forge:ORGANIZATIONAL_CONTROL_REGISTER.md#TC-ORG-003"
  - id: TC-ORG-004
    title: "Recorded Least-Privilege Onboarding"
    family: "ORG"
    class: ["preventive", "manual"]
    applies_when: "Each hire and access onboarding"
    verification: "Externally compare role needs with recorded provisioning decisions"
    evidence_source: "Onboarding and provisioning records"
    provenance: "documented"
    source: "user-provided:Forge:ORGANIZATIONAL_CONTROL_REGISTER.md#TC-ORG-004"
  - id: TC-ORG-005
    title: "Timely and Recorded Offboarding"
    family: "ORG"
    class: ["corrective", "manual"]
    applies_when: "Each departure"
    verification: "Externally compare departure times with revocation timestamps against the stated interval"
    evidence_source: "Departure records; timestamped revocation records"
    provenance: "documented"
    source: "user-provided:Forge:ORGANIZATIONAL_CONTROL_REGISTER.md#TC-ORG-005"
  - id: TC-ORG-006
    title: "Periodic Review of Production and Customer Access"
    family: "ORG"
    class: ["detective", "manual"]
    applies_when: "Production systems and customer information access"
    verification: "Externally inspect a quarterly review naming every account and its access decision"
    evidence_source: "Quarterly access review records"
    provenance: "documented"
    source: "user-provided:Forge:ORGANIZATIONAL_CONTROL_REGISTER.md#TC-ORG-006"
  - id: TC-ORG-007
    title: "Governed Production Access"
    family: "ORG"
    class: ["preventive", "manual"]
    applies_when: "Continuous production access governance"
    verification: "Externally inspect access justification and logging continuously and review quarterly"
    evidence_source: "Authorized access list; AWS audit records; quarterly reviews"
    provenance: "documented"
    source: "user-provided:Forge:ORGANIZATIONAL_CONTROL_REGISTER.md#TC-ORG-007"
  - id: TC-ORG-008
    title: "Managed Company Devices"
    family: "ORG"
    class: ["preventive", "manual", "automated"]
    applies_when: "Company devices with organizational access"
    verification: "Externally verify continuous device management coverage and required settings"
    evidence_source: "Device management inventory; compliance reports"
    provenance: "documented"
    source: "user-provided:Forge:ORGANIZATIONAL_CONTROL_REGISTER.md#TC-ORG-008"
  - id: TC-ORG-009
    title: "Security Awareness Training"
    family: "ORG"
    class: ["preventive", "manual"]
    applies_when: "Hiring and annual staff training"
    verification: "Externally verify completion on hire and annually"
    evidence_source: "Training completion records"
    provenance: "documented"
    source: "user-provided:Forge:ORGANIZATIONAL_CONTROL_REGISTER.md#TC-ORG-009"
  - id: TC-ORG-010
    title: "Annual Security Risk Assessment"
    family: "ORG"
    class: ["detective", "manual"]
    applies_when: "Organization-wide risk assessment"
    verification: "Externally review the annual assessment and ratings"
    evidence_source: "Risk register; assessment records"
    provenance: "documented"
    source: "user-provided:Forge:ORGANIZATIONAL_CONTROL_REGISTER.md#TC-ORG-010"
  - id: TC-ORG-011
    title: "Tracked Risk Treatment"
    family: "ORG"
    class: ["corrective", "manual"]
    applies_when: "Identified organizational risks"
    verification: "Externally review treatment progress and resulting control changes quarterly"
    evidence_source: "Risk treatment plan; control change records"
    provenance: "documented"
    source: "user-provided:Forge:ORGANIZATIONAL_CONTROL_REGISTER.md#TC-ORG-011"
  - id: TC-ORG-012
    title: "Initial and Recurring Vendor Assessment"
    family: "ORG"
    class: ["preventive", "manual"]
    applies_when: "New vendors and subprocessors and continued use"
    verification: "Externally verify assessments before introduction and annually"
    evidence_source: "Vendor assessments; subprocessor register"
    provenance: "documented"
    source: "user-provided:Forge:ORGANIZATIONAL_CONTROL_REGISTER.md#TC-ORG-012"
  - id: TC-ORG-013
    title: "Exercised Continuity and Recovery Plans"
    family: "ORG"
    class: ["corrective", "manual"]
    applies_when: "Business continuity and disaster recovery"
    verification: "Externally inspect current plans and annual exercise results"
    evidence_source: "Continuity and recovery plans; exercise records"
    provenance: "documented"
    source: "user-provided:Forge:ORGANIZATIONAL_CONTROL_REGISTER.md#TC-ORG-013"
  - id: TC-ORG-014
    title: "Assigned and Exercised Incident Response"
    family: "ORG"
    class: ["corrective", "manual"]
    applies_when: "Incident readiness and each incident"
    verification: "Externally inspect assigned response roles, annual exercises and incident records"
    evidence_source: "Incident response plan; exercise results; incident records"
    provenance: "documented"
    source: "user-provided:Forge:ORGANIZATIONAL_CONTROL_REGISTER.md#TC-ORG-014"
  - id: TC-ORG-015
    title: "Monitored Control Effectiveness"
    family: "ORG"
    class: ["detective", "manual"]
    applies_when: "Organization-wide control assurance"
    verification: "Externally inspect quarterly monitoring and remediation progress"
    evidence_source: "Control monitoring records; remediation tracker"
    provenance: "documented"
    source: "user-provided:Forge:ORGANIZATIONAL_CONTROL_REGISTER.md#TC-ORG-015"
  - id: TC-ORG-016
    title: "Agreed Confidentiality Obligations"
    family: "ORG"
    class: ["preventive", "manual"]
    applies_when: "Hiring staff and engaging contractors"
    verification: "Externally verify signed obligations when each engagement begins"
    evidence_source: "Signed confidentiality agreements"
    provenance: "documented"
    source: "user-provided:Forge:ORGANIZATIONAL_CONTROL_REGISTER.md#TC-ORG-016"
  - id: TC-ORG-017
    title: "Recorded and Communicated Customer Commitments"
    family: "ORG"
    class: ["preventive", "manual"]
    applies_when: "Customer commitments and their changes"
    verification: "Externally compare agreements and communications whenever commitments change"
    evidence_source: "Customer agreements; published commitments; communications"
    provenance: "documented"
    source: "user-provided:Forge:ORGANIZATIONAL_CONTROL_REGISTER.md#TC-ORG-017"
  - id: TC-ORG-018
    title: "Policy for Emergency Changes"
    family: "ORG"
    class: ["preventive", "manual"]
    applies_when: "Change management, including emergency and exceptional changes"
    verification: "Externally review the policy annually and inspect exceptional change records"
    evidence_source: "Change management policy; emergency exception records"
    provenance: "documented"
    source: "user-provided:Forge:ORGANIZATIONAL_CONTROL_REGISTER.md#TC-ORG-018"
  - id: TC-ORG-019
    title: "Cloud Management Activity Audit"
    family: "ORG"
    class: ["detective", "automated"]
    applies_when: "The AWS cloud estate"
    verification: "Externally verify continuous management activity and configuration recording, retention and quarterly review"
    evidence_source: "CloudTrail and AWS Config settings; retention configuration; quarterly review records"
    provenance: "documented"
    source: "user-provided:Forge:ORGANIZATIONAL_CONTROL_REGISTER.md#TC-ORG-019"
---

# Rhythm 2.0 Control Catalogue

This catalogue defines the security, confidentiality, privacy, availability, processing integrity and AI obligations for Rhythm's association customers. Specifications cite the applicable control ids; each control's definition has one home here. The statements describe required outcomes, not a claim that implementation or organizational practice already satisfies them. Approval and evidence of operation remain separate from the catalogue.

Applicability follows what the work touches. A relevant control applies; an irrelevant control is omitted. A scanner's vocabulary match prompts human review, and a false match receives an explicit explanation. An applicable control that remains unsatisfied becomes a control-gap finding with an owner, any compensating protection and an expiry. Silence never represents an exception.

The change-management, secret-scanning and vulnerability-management controls that govern every change form the baseline: TC-CHG-001, TC-CHG-002, TC-CHG-003, TC-CHG-004, TC-SEC-001, TC-SEC-004, TC-VUL-001, TC-VUL-002 and TC-VUL-004. Their evidence is collected for the change process rather than repeated in every artifact's applicability list. Other controls apply according to their stated conditions, with privacy applicability determined by personal information, privacy commitments and the specific condition each privacy control names.

Unless a control states otherwise, the Engineering team responsible for the affected area owns it, verification runs whenever the protected behavior changes, and operating evidence is retained for twelve months. A control combining manual and automated activities lists both execution classes. Verification establishes that the control is implemented as designed; the evidence source supplies retrievable proof of its recurring operation. Periodic exercises and checks of externally managed settings retain their own cadence.

## TC-IAM — Identity and Authentication

#### TC-IAM-001 · Attributable Identity for Every Actor

Each person, machine principal, background job and deployment pipeline acts through an identity attributable to one subject. Shared accounts are prohibited, and recorded activity identifies the responsible actor.

#### TC-IAM-002 · Central Authentication for Human Access

People authenticate through the designated identity provider when they use the staff console, member portal or another Rhythm environment. Applications maintain no independent password store and accept only credentials issued by that provider.

#### TC-IAM-003 · Multiple Factors for Privileged Access

Rhythm staff and identities with authority beyond one workspace authenticate with a second factor, including cloud and deployment access. MFA for customer users whose authority stays within their workspace remains a product decision. Enforcement is checked after changes and evidenced quarterly because provider settings can change independently of application code.

#### TC-IAM-004 · Bounded Sessions and Effective Revocation

Authenticated sessions expire within a defined lifetime. Removing an identity or its access stops existing sessions from acting within a documented and tested interval, as well as preventing new sign-ins.

#### TC-IAM-005 · Credential Validation at Every Boundary

Each receiving trust boundary checks a credential's signature, issuer, audience, expiry and subject before using it for authorization. A caller's claims about itself supply no authority; reliance on validation at an earlier boundary requires an explicit, enforced trust relationship.

#### TC-IAM-006 · Separate Machine Identities

Lambda jobs, Step Functions workflows and deployment automation use their own machine identities, limited to the work they perform. Automation never borrows a person's credentials, and people never use a job's identity.

## TC-AZ — Authorization and Least Privilege

#### TC-AZ-001 · Declared Permissions for Operations

Every operation that reads, changes or discloses data declares the permission its caller requires in both its specification and implementation. The declaration makes access review and refusal tests possible for every entry point.

#### TC-AZ-002 · Server Enforcement at Each Operation

The server enforces the operation's required permission on every route to its handler. Hiding an action in the console or portal improves usability but supplies no authorization; direct calls face the same permission check.

#### TC-AZ-003 · Denied Access on Missing Grants or Errors

A request without a matching grant is refused. Unavailable authorization storage, unreadable claims and unexpected authorization errors also refuse the request, with no permissive fallthrough.

#### TC-AZ-004 · Least Privilege in Roles and Policies

Product roles and AWS policies name the operations and resources they permit and the reason each grant is needed. Wildcard actions or resources require a recorded justification in the owning specification.

#### TC-AZ-005 · Separate Platform Authority and Evidence

Cross-workspace actions, platform administration, workspace provisioning or destruction, and access grants require platform authority distinct from workspace authority and produce audit events. Administration of an association's workspace gives no implied authority to administer the platform.

#### TC-AZ-006 · Access Changes Within a Tested Bound

Grant removal and role changes reach subsequent authorization decisions within a specified, tested interval. Cached decisions and token claims have an explicit maximum age and a revocation path, so stale authority has a bounded lifetime.

## TC-TEN — Workspace and Scope Isolation

#### TC-TEN-001 · Workspace Ownership on Records and Queries

Every workspace-owned record carries its workspace reference, and every read applies that scope below the API. Required ownership constraints and query isolation prevent access from depending on each caller remembering a filter.

#### TC-TEN-002 · Authorized Workspace Context

The verified principal and the server's access records establish the workspace in which a request may act. A caller-supplied workspace identifier serves only as a lookup key until the server authorizes its use.

#### TC-TEN-003 · No Disclosure Across Workspace Boundaries

A request for an inaccessible workspace resource returns the same observable answer whether that resource exists or is absent. Messages, status codes, response counts and other observable distinctions reveal no existence information across the boundary.

#### TC-TEN-004 · Isolation Within a Workspace

Access within a workspace respects narrower grants for organizational units, records and other defined scopes. Membership in the association's workspace alone supplies no authority over all records inside it; the server enforces each applicable boundary.

## TC-SEC — Secrets and Credentials

#### TC-SEC-001 · Secrets Excluded from Published Material

Passwords, API keys, tokens, private keys and credential-bearing connection strings stay out of source, committed configuration, specifications, logs and error responses. Prompts sent to external providers also exclude secrets.

#### TC-SEC-002 · Managed Secret Storage and Audited Reads

Runtime credentials reside in a managed secret store and enter the application at runtime. Only identities that need a secret can read it, and each access is authorized and logged.

#### TC-SEC-003 · Rotation and Revocation Without Source Changes

Each long-lived credential has documented rotation and revocation procedures that require no source edit. Rotation is exercised at least annually and whenever exposure is suspected, with the outcome retained as evidence.

#### TC-SEC-004 · Secret Scans Block Merge

Secret scanning is a required merge check. A detected secret blocks the change from merging instead of leaving an advisory finding that the merge can bypass.

## TC-CRY — Encryption and Key Management

#### TC-CRY-001 · Encrypted Transport

Browser, service, datastore and third-party connections carrying customer information or credentials use current TLS. Endpoints refuse plaintext transport and prevent downgrade to an unencrypted connection.

#### TC-CRY-002 · Encryption of Durable Data

Aurora Postgres databases, object storage, SQS queues, log groups, backups and snapshots holding customer or confidential information use encryption at rest with managed keys. Each durable store has verifiable encryption settings.

#### TC-CRY-003 · Controlled Key Management

Encryption and signing keys reside in a managed key service with restricted, policy-authorized use. Rotation is enabled or scheduled, and key administration is separated from permission to read the protected data.

#### TC-CRY-004 · Vetted Cryptography

Hashing, signing, encryption and random generation use vetted platform libraries and current algorithms. Rhythm defines no cryptographic primitives of its own.

## TC-DAT — Data Classification, Retention and Deletion

#### TC-DAT-001 · Classification of Stored Information

Every table, object prefix, queue payload, log stream and export declares its highest data classification: public, internal, confidential or personal. Confidential information includes association records, uploaded documents and AI request content; personal information identifies an individual. Classification determines the applicable handling obligations.

#### TC-DAT-002 · Minimum Collection and Transfer

Each collected field serves a stated requirement. Exports and transfers to third parties, including Bedrock model calls, include only the information the operation needs, with the selection and reduction documented in the specification.

#### TC-DAT-003 · Enforced Retention Periods

Confidential and personal information has a stated retention period enforced by a lifecycle policy or scheduled process. Retention has a defined endpoint independent of whether someone remembers to delete the information.

#### TC-DAT-004 · Complete and Evidenced Deletion

Customer requests and lifecycle rules remove information through a defined sequence covering primary records, derived data, caches, indexes and object storage. Backup copies are addressed within their stated window. Completion is recorded, and the specification identifies any remaining copies and how long they persist.

#### TC-DAT-005 · Authorized Customer Export

Where Rhythm commits to export or portability, an authorized association administrator obtains the organization's data in a documented format. Export access is checked, limited to the authorized scope, audited and bounded in time.

#### TC-DAT-006 · Safe Data in Non-Production Environments

Development, test and demonstration environments use synthetic or anonymized information. Copying confidential production data into these environments requires a recorded exception, and their ordinary credentials provide no production data access.

#### TC-DAT-007 · Equivalent Protection for Backups

Backups inherit the source information's classification, encryption, access restrictions, retention and deletion obligations. Any difference between backup expiry and a customer deletion commitment is stated explicitly.

## TC-LOG — Audit and Security Logging

#### TC-LOG-001 · Audit Events for Sensitive Actions

Workspace creation, suspension and deletion, permission changes, staff entry into customer workspaces, exports and security-setting changes produce durable audit events as part of the action. Every other platform-level or sensitive action meets the same obligation; audit recording is never best effort.

#### TC-LOG-002 · Complete Audit Context

Each audit event records the actor, action, affected subject or resource, workspace or applicable scope, outcome and time. Refused attempts are recorded alongside successful actions so the history explains both attempted and completed activity.

#### TC-LOG-003 · Protected Audit History

Audit history is append-only and tamper-evident. Application paths cannot alter or delete an existing event, and application grants exclude those permissions even when the underlying store technically supports them.

#### TC-LOG-004 · Security Events for Access Refusals

Refused sign-ins, denied permissions, cross-workspace attempts and malformed credentials produce security events with enough context to detect repeated activity. These events remain distinguishable from ordinary application errors.

#### TC-LOG-005 · Redaction in Logs and Errors

Application logs, exception traces and caller-visible errors exclude credentials, tokens, personal information and confidential customer content. Errors reveal only information the caller is authorized to receive.

## TC-CHG — Secure Change Management

#### TC-CHG-001 · Versioned Production Changes

Application code, infrastructure, configuration and migrations reach production through version control and deployment. Emergency changes made through the AWS console are incident-response exceptions and are recorded accordingly.

#### TC-CHG-002 · Independent Review Before Merge

A person other than the author approves each change before it reaches the default branch. Review covers the change's security and control consequences as well as its functional correctness; enforcement settings require verification outside the checkout.

#### TC-CHG-003 · Protected Default Branch

Repository protection prevents direct pushes, force pushes and merges that bypass required checks on the default branch. Protection settings are evidenced quarterly through external verification.

#### TC-CHG-004 · Passing Required Checks

Type checking, linting, unit tests, integration tests, secret scanning and dependency scanning pass as required checks before merge. A failing check blocks merge, and an unexecuted check supplies no passing evidence.

#### TC-CHG-005 · Authorized and Recorded Automation for Deployment

Deployments run through authorized automation and record the commit, target environment, time, initiating identity and outcome. Production deployment authority belongs only to a named set of identities.

#### TC-CHG-006 · Separate Environments and Credentials

Development, test and production use separate AWS accounts or equally strong isolation boundaries, with separate data, credentials and network paths. Non-production identities have no production access. Cloud account boundaries require external verification.

#### TC-CHG-007 · Reviewed Migrations and Rollback Position

Every migration receives review as a change to durable customer information. The review states whether it destroys data, and the release explains what happens if application code is rolled back after the migration executes.

## TC-VUL — Vulnerability and Dependency Management

#### TC-VUL-001 · Dependency Scanning and Remediation Windows

Dependency scans detect known vulnerabilities on every change and weekly on the default branch. Critical and high findings have explicit remediation windows; overdue findings become recorded exceptions with accountable owners.

#### TC-VUL-002 · Required Static Analysis

Each change passes lint and type checks with security-relevant rules enabled. Required checks prevent findings from being bypassed during merge.

#### TC-VUL-003 · Infrastructure Security Scanning

Infrastructure checks detect unintended public exposure, missing encryption, excessive permissions and missing logging before deployment. Insecure definitions fail checks while the change remains reviewable.

#### TC-VUL-004 · Tracked Vulnerability Resolution

Vulnerabilities from scans, external reports, incidents and audits enter one tracked list with severity, owner and target date. Monthly review follows each finding through remediation or an explicit exception to closure.

## TC-AVL — Availability, Backup and Recovery

#### TC-AVL-001 · Defined Availability and Recovery Commitments

Rhythm records each availability, durability and recovery commitment in terms an association can validate. The design names the recovery time and recovery point objectives and explains how it meets them.

#### TC-AVL-002 · Automatic Backups of Authoritative Information

Stores holding information Rhythm cannot reconstruct have automated backups with stated frequency and retention. Backup failure alerts a responder.

#### TC-AVL-003 · Exercised Restoration

Backup restoration into an isolated environment is exercised at least annually, with the outcome recorded. A successful backup alone supplies no proof of recovery; restoration evidence requires external verification.

#### TC-AVL-004 · Resumable Durable Work

Long-running work survives process failure through durable checkpoints and resumes from its last committed progress. Step Functions workflows and queued jobs retain a path to advance, recover or settle every customer-visible object after interruption.

#### TC-AVL-005 · Abuse Resistance on Exposed Operations

Public operations, including sign-in, invitation acceptance, portal registration, upload and export, enforce rate limits or equivalent abuse protection. Exceeding the permitted activity is refused and logged.

## TC-MON — Monitoring, Alerting and Incident Response

#### TC-MON-001 · Monitoring of Deployed Components

Each deployed service, Lambda function, Step Functions workflow and SQS queue has monitoring for availability, errors and latency. Metrics and logs remain available long enough to investigate operational problems.

#### TC-MON-002 · Addressed Failure Alerts

Each failure alarm states the condition and threshold that trigger it and names its recipient. The destination makes the alert actionable by the person responsible for responding.

#### TC-MON-003 · Distinct Security Detection and Alerts

Repeated access denials, cross-workspace attempts, unusual privileged actions, credential failures and audit-pipeline failures produce security alerts. These conditions remain distinguishable from routine operational alerts.

#### TC-MON-004 · Defined and Recorded Incident Response

Incidents follow a documented procedure for detection, triage, containment, communication and closure. Every incident has a record, and the procedure is kept current and exercised. Operational readiness requires verification outside the repository.

#### TC-MON-005 · Review of Significant Incidents

Each significant incident receives a review recording its cause, impact, timeline and corrective actions. Changes to controls prompted by the incident are included so the response improves subsequent protection.

## TC-PI — Processing Integrity

#### TC-PI-001 · Validation Before Domain Processing

Externally supplied values pass type, range, format and allowed-value checks before domain processing. Invalid input is refused with an explanation that exposes no sensitive information.

#### TC-PI-002 · One Effect Under Repeated Delivery

Repeated delivery of the same operation produces one effect. A duplicate request or SQS delivery returns the recorded result rather than creating a second record or repeating a customer-visible change.

#### TC-PI-003 · Visible Concurrent Write Conflicts

Concurrent writers cannot silently overwrite one another's changes. A stale write is refused with an outcome that tells the writer the object has changed.

#### TC-PI-004 · Reconciliation of Asynchronous Work

Every asynchronous operation completes, fails visibly or enters reconciliation. Scheduled reconciliation detects interrupted jobs, and dead-letter queues retain undeliverable work with alarms, so abandoned execution never resembles success.

#### TC-PI-005 · Authorized and Attributed State Changes

Objects change state only through permitted lifecycle transitions made by authorized actors. Each change records its actor and any required reason; invalid transitions are refused.

## TC-AI — AI Behavior Controls

These controls apply ordinary security, confidentiality, processing integrity and privacy obligations to model boundaries. SOC 2 supplies no AI correctness criterion, and successful validation does not establish the truth of a model response. Every AI feature identifies what the model proposes and what the application decides; provider failure or degradation never lowers validation or required approval.

#### TC-AI-001 · Application Authority Over Stored State

A model proposes output; the application controls authoritative state and decides what is written after validation. Every resulting change has an application enforcement path that rejects unacceptable values, and output acquires no authority merely by arriving from a model.

#### TC-AI-002 · Schema Validation of Model Responses

The product parses every structured model response against a declared schema before consuming it. Invalid responses are rejected and handled through a defined failure or fallback path, without coercion or partial authoritative writes.

#### TC-AI-003 · Business Validation After Model Output

Schema-valid model output still passes the application's business checks for valid references, allowed vocabulary, lifecycle rules and workspace membership. Prompt instructions supply no enforcement, and the model never replaces the application check for a product rule.

#### TC-AI-004 · Visible Provenance for Derived Content

Model-derived summaries, query suggestions and other presented knowledge record their source material, model, prompt version and creation time. Customers can see that provenance and distinguish derived content from asserted fact.

#### TC-AI-005 · Recorded Human Approval Where Required

A model-proposed change that requires human approval remains blocked until an identified person approves the relevant version. Approval is recorded, and simply displaying the proposal to a person never satisfies the gate.

#### TC-AI-006 · Versioned Inference Inputs and Provider Choices

Each inference records its model identifier, provider and prompt or instruction version. Prompts are reviewed source assets. Changing a model or provider receives change review and vendor assessment because downstream behavior depends on that choice.

#### TC-AI-007 · Controlled Transfers to Model Providers

The specification names the classified information each model provider may receive, the reductions and redactions applied first, and the provider's retention and training terms. Bedrock calls follow those handling rules; a provider processing confidential association information is treated as a subprocessor.

## TC-VEN — Vendors, Subprocessors and Integrations

#### TC-VEN-001 · Reviewed Subprocessors Before Use

A third party that stores, processes or transmits customer information receives security and data-handling review before production use and appears in the subprocessor register. Rhythm discloses that relationship wherever its customer commitments require disclosure.

#### TC-VEN-002 · Controlled Integration Credentials

Credentials Rhythm holds for integrations, and credentials integrations hold for Rhythm, grant only required access. They reside in managed, restricted storage and can be revoked without changing source code.

#### TC-VEN-003 · Vendor Support for Customer Commitments

Rhythm's commitments for retention, deletion, confidentiality, residency and breach notification remain within what its subprocessors support. Terms and commitments are compared annually and whenever either side changes.

## TC-PRV — Privacy

#### TC-PRV-001 · Inventory of Personal Information

Each element classified as personal appears in an inventory with its collection purpose, storage location, retention period and recipient parties. The inventory accounts for both stored information and outbound transfers.

#### TC-PRV-002 · Use Within the Recorded Purpose

Personal information is collected for a purpose stated in a requirement and used within that purpose. A new purpose requires a product decision before engineering introduces the new use.

#### TC-PRV-003 · Exercised Data Subject Requests

People have a defined, authorized path for access, correction and deletion requests where privacy commitments or regulation require it. Requests are recorded, and the procedure is exercised to prove it can deliver the required outcome.

#### TC-PRV-004 · Enforced Notice and Preferences

Where notice or consent governs personal information use, the person's preference is stored and checked at the point of use. The person can change that preference, and a prohibited use is refused.

## TC-ORG — Organizational Controls

Organizational controls operate outside product code. Their accountable roles maintain the activities and evidence named below, and every control requires external verification. Inclusion here establishes neither implementation nor operating effectiveness; accountable owners establish those facts from evidence. Engineering specifications cite organizational controls wherever their behavior depends on these processes.

#### TC-ORG-001 · Assigned Security Responsibilities

Executive leadership assigns and documents security responsibilities and reviews them annually. Named roles make accountability for protecting Rhythm and association information explicit.

#### TC-ORG-002 · Approved and Acknowledged Security Policies

Executive leadership maintains and approves the information security policy set. Staff acknowledge the policies, and policy content and acknowledgement evidence receive annual review.

#### TC-ORG-003 · Checks Before Access on Hiring

The People function completes background checks where law permits them before a new hire receives access. The completed check and its timing are recorded.

#### TC-ORG-004 · Recorded Least-Privilege Onboarding

People and Engineering grant a new colleague only the access the role requires. Onboarding records identify the access granted and its basis.

#### TC-ORG-005 · Timely and Recorded Offboarding

People and Engineering revoke all departing colleagues' access within a stated interval. Timestamped revocation records establish that offboarding reaches every relevant system on time.

#### TC-ORG-006 · Periodic Review of Production and Customer Access

The Engineering lead reviews access to production systems and customer information quarterly. The record names every account and the decision to retain, change or remove its access.

#### TC-ORG-007 · Governed Production Access

The Engineering lead defines who may receive production access, the justification required and the activity that is logged. Governance applies continuously, and the access list and logging receive quarterly review.

#### TC-ORG-008 · Managed Company Devices

IT manages company devices with disk encryption, screen locking, patching and remote wipe. Continuous management records establish coverage and the required protection settings.

#### TC-ORG-009 · Security Awareness Training

The People function provides security awareness training when colleagues join and annually thereafter. Completion records identify who meets the training requirement.

#### TC-ORG-010 · Annual Security Risk Assessment

Executive leadership assesses risks to security, confidentiality and availability annually. The assessment identifies each risk and records its rating.

#### TC-ORG-011 · Tracked Risk Treatment

Executive leadership tracks treatment of identified risks and reviews progress quarterly. Treatment outcomes lead to documented changes in controls where needed.

#### TC-ORG-012 · Initial and Recurring Vendor Assessment

The Engineering lead assesses vendors and subprocessors before use and annually thereafter. The assessment records their security and data-handling suitability and maintains the subprocessor register.

#### TC-ORG-013 · Exercised Continuity and Recovery Plans

The Engineering lead maintains business continuity and disaster recovery plans and exercises them annually. Recorded results demonstrate the response to disruption and identify needed improvements.

#### TC-ORG-014 · Assigned and Exercised Incident Response

The Engineering lead maintains an incident response plan with named roles and exercises it annually. Each incident follows the plan and produces its own response record.

#### TC-ORG-015 · Monitored Control Effectiveness

Executive leadership monitors control effectiveness quarterly and tracks deficiencies through remediation. Evidence records both identified weaknesses and the actions that address them.

#### TC-ORG-016 · Agreed Confidentiality Obligations

The People function obtains agreed confidentiality obligations from staff and contractors when their engagement begins. Signed agreements record each person's responsibility to protect confidential information.

#### TC-ORG-017 · Recorded and Communicated Customer Commitments

Executive leadership documents and communicates commitments for availability, confidentiality, privacy and notification. Changes update the relevant agreements and customer communications.

#### TC-ORG-018 · Policy for Emergency Changes

The Engineering lead maintains a change management policy covering emergency changes and changes outside the ordinary deployment path. The policy receives annual review, and exceptions retain evidence of the change and its authorization.

#### TC-ORG-019 · Cloud Management Activity Audit

The Engineering lead ensures cloud management activity and configuration changes are recorded across the AWS estate through CloudTrail and AWS Config or equivalent mechanisms. The records are retained and available for review, with continuous recording and quarterly review of coverage and settings.