Important Notice

This document is a SOC 2 Type 1 Readiness Assessment — Self-Assessment. It is produced internally by AegisGate to evaluate control readiness against the AICPA Trust Services Criteria prior to engaging a Certified Public Accountant (CPA) firm for a formal SOC 2 Type 1 examination.

This is not a SOC 2 audit report, and it does not constitute a certification or attestation. No CPA firm has opined on the design or operating effectiveness of the controls described herein. The readiness statuses reflect AegisGate’s internal evaluation and are intended solely to guide remediation priorities and audit preparation.

Upon engagement of a qualified CPA firm, this assessment will serve as the basis for formal examination of control design suitability as of a specified date.

Executive Summary

AegisGate has conducted a comprehensive self-assessment of its security and availability controls against the AICPA Trust Services Criteria. This assessment evaluates the design and implementation readiness of controls that would be examined during a formal SOC 2 Type 1 audit.

Readiness Summary

Key Findings:

• AegisGate’s self-hosted architecture inherently satisfies significant portions of the Trust Services Criteria, as infrastructure control resides with the customer organization.
• Logical access controls (CC6) demonstrate strong readiness with RBAC, MFA, OIDC/SAML SSO, and automated CheckFuncs already implemented in the compliance engine.
• Monitoring controls (CC7) are substantively addressed through hash-chained audit logging, 153+ threat detection patterns, and real-time alerting.
• All Priority 1 and Priority 2 remediation items addressed. Remaining: continuous improvement items (REM-007, REM-008) scheduled for Q1 2027.

Scope and Methodology

Scope

This readiness assessment covers the AegisGate Security Platform — a self-hosted, on-premises security gateway for AI infrastructure — and the organizational controls operated by AegisGate to develop, deliver, and support the platform.

In-Scope System: AegisGate Security Platform (Docker container deployment, customer-managed infrastructure)

Out of Scope: Customer-managed infrastructure, customer data processing environments, and any third-party systems not acting as a subprocessor to AegisGate.

Trust Services Categories in Scope: Security, Availability, Confidentiality, Processing Integrity

Privacy is assessed as not applicable to the primary platform offering at this time, as AegisGate does not collect or process personal information on behalf of customers. Privacy criteria will be evaluated in a subsequent assessment cycle when applicable.

Methodology

1. Criteria Mapping: Each applicable Trust Services Criterion was mapped to one or more AegisGate controls, including technical implementations, policies, and procedures.
2. Control Walkthrough: Internal review of control design against criteria requirements to confirm implementation completeness.
3. Evidence Review: Examination of available evidence including source code, configuration files, audit logs, policy documents, and infrastructure manifests.
4. Gap Analysis: Identification of criteria where controls are not yet fully implemented or documented, with classification as In Progress or Planned.
5. Readiness Scoring: Controls classified as Ready (✅), In Progress (⚠️), or Planned (🔲) based on implementation and documentation completeness.

System Architecture Overview

AegisGate is deployed as a self-hosted Docker container on customer-managed infrastructure with zero external dependencies. The architecture places infrastructure control — including network topology, data residency, encryption key management, and physical security — under customer purview. AegisGate’s responsibility boundary encompasses the application-layer security controls, the compliance engine, threat detection, and the software supply chain.

Subprocessors:

Trust Services Criteria Mapping

Common Criteria — CC1: Control Environment

CC1.1 — Tone at the Top and Control Consciousness

Criteria: Management demonstrates a commitment to integrity and ethical values through directives, actions, and behavior that establish the tone for the organization.

CC1.2 — Accountability

Criteria: The entity holds individuals accountable for their internal control responsibilities.

CC1.3 — Human Resources Policies

Criteria: The entity hires, develops, and retains individuals with the competence to fulfill their responsibilities.

CC1.4 — Board of Directors / Oversight

Criteria: The entity defines lines of responsibility and authority for the design, implementation, and operation of controls.

Common Criteria — CC2: Communication and Information

CC2.1 — Internal Communication

Criteria: The entity internally communicates information, including objectives and responsibilities, necessary to support the functioning of internal control.

CC2.2 — External Communication

Criteria: The entity communicates with external parties regarding matters affecting the functioning of internal control.

CC2.3 — Communication of Objectives and Changes

Criteria: The entity communicates with external parties and enables them to communicate information about the functioning of internal control.

Common Criteria — CC3: Risk Assessment

CC3.1 — Risk Identification

Criteria: The entity identifies and assesses risk that could affect the achievement of its objectives.

CC3.2 — Fraud Risk

Criteria: The entity identifies and assesses risk of fraud that could affect the achievement of its objectives.

CC3.3 — Risk of Management Override

Criteria: The entity considers the potential for management override of controls.

CC3.4 — Changes in Risk Profile

Criteria: The entity assesses changes that could significantly affect internal control.

Common Criteria — CC4: Monitoring

CC4.1 — Ongoing and Separate Evaluations

Criteria: The entity performs ongoing and separate evaluations to ascertain whether each of the components of internal control is present and functioning.

CC4.2 — Communication of Deficiencies

Criteria: The entity communicates internal control deficiencies to those responsible for taking corrective action.

Common Criteria — CC5: Control Activities

CC5.1 — Logical and Physical Security Controls

Criteria: The entity selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.

CC5.2 — Technology Infrastructure Controls

Criteria: The entity selects and develops control activities over technology that contribute to the mitigation of risks to the achievement of objectives.

CC5.3 — Policies and Procedures

Criteria: The entity deploys control activities through policies and procedures.

Common Criteria — CC6: Logical and Physical Access

CC6.1 — Logical Access Security

Criteria: The entity implements logical access security over information assets to protect them from unauthorized access.

CC6.2 — User Registration and Provisioning

Criteria: The entity registers and authorizes new internal and external users to the information assets.

CC6.3 — Role-Based Access and Least Privilege

Criteria: The entity authorizes, modifies, or removes access to information assets based on roles and responsibilities.

CC6.4 — Physical Access

Criteria: The entity restricts physical access to information assets to authorized personnel.

CC6.5 — Access Removal

Criteria: The entity removes access to information assets when no longer needed.

CC6.6 — Data Encryption and Protection

Criteria: The entity implements controls to protect data from unauthorized access during transmission and storage.

CC6.7 — Data Classification and Handling

Criteria: The entity classifies and protects information assets based on their sensitivity.

Common Criteria — CC7: System Operations

CC7.1 — Detection and Monitoring

Criteria: The entity detects and monitors system events that could affect the achievement of objectives.

CC7.2 — Incident Response

Criteria: The entity responds to identified security incidents by implementing incident response procedures.

CC7.3 — Incident Evaluation and Escalation

Criteria: The entity evaluates security events to determine whether they constitute security incidents.

CC7.4 — Incident Communication

Criteria: The entity communicates security incidents to affected parties.

Common Criteria — CC8: Change Management

CC8.1 — Change Management Process

Criteria: The entity authorizes, designs, tests, approves, implements, and documents changes to infrastructure, data, software, and procedures.

CC8.2 — Configuration Management

Criteria: The entity configures information assets to minimize vulnerabilities and protect them from unauthorized access.

Common Criteria — CC9: Risk Mitigation

CC9.1 — Business Continuity and Risk Mitigation

Criteria: The entity identifies and selects risks that may affect the achievement of objectives and mitigates those risks.

CC9.2 — Vendor and Third-Party Risk Management

Criteria: The entity evaluates and oversees third-party service providers to mitigate risks.

Security — Additional Criteria

C1.1 — Confidential Information Protection

Criteria: The entity protects confidential information during its transmission, storage, and disposal.

C2.1 — Confidentiality Commitments

Criteria: The entity identifies and meets its confidentiality commitments.

Availability — Additional Criteria

A1.1 — System Availability

Criteria: The entity maintains system availability to meet its objectives.

A1.2 — Recovery and Continuity

Criteria: The entity recovers system operations to meet availability objectives.

Confidentiality — Additional Criteria

C1.1 — Confidential Information Identification

(Addressed above under Security C1.1)

C2.1 — Confidentiality Commitments

(Addressed above under Security C2.1)

C3.1 — Confidential Information Disposal

Criteria: The entity disposes of confidential information when no longer needed.

Processing Integrity — Additional Criteria

PI1.1 — Processing Accuracy and Completeness

Criteria: The entity processes data accurately and completely to meet its objectives.

PI1.2 — Processing Integrity Controls

Criteria: The entity implements controls to prevent, detect, and correct processing errors.

AI-Specific Controls

SOC2-AI-001 — AI System Governance

Criteria: The entity implements governance controls over AI system operations to ensure safe and compliant use.

Remediation Roadmap

The following items have been identified as requiring action prior to formal SOC 2 Type 1 audit engagement. Items are prioritized by impact on audit readiness.

Priority 1 — Critical (✅ Addressed)

Priority 2 — Important (✅ Addressed)

Priority 3 — Enhancement (Continuous Improvement)

Attestation

This SOC 2 Type 1 Readiness Assessment — Self-Assessment has been prepared by the AegisGate Compliance & Security Engineering team. The readiness statuses, implementation descriptions, and remediation items represent our good-faith evaluation of control design and implementation against the AICPA Trust Services Criteria.

Prepared By:

Compliance & Security Engineering, AegisGate

Date: July 29, 2026

Review and Approval:

This document is classified as Confidential — Internal Use. Distribution is limited to authorized personnel involved in SOC 2 audit preparation. This self-assessment does not constitute a SOC 2 audit report or certification.