Use a secrets manager and 90-day rotation policy

Related rules

From the same buckets as this rule.

• Critical

  Encrypt sensitive data at rest with KMS and rotate keys

  Use envelope encryption (AES-256-GCM) with cloud KMS-managed CMKs for databases, object storage, and backups. Rotate CMKs at least annually and rotate DEKs per object/file.

  compliance-soc2-essentialssecrets-credentials+1
• Critical

  Enforce TLS 1.2+ and HSTS on all external endpoints

  Public services must require TLSv1.2 or higher and set HSTS (max-age ≥ 15552000, includeSubDomains). Reject plaintext HTTP and weak ciphers; cookies must be Secure and HttpOnly with SameSite set.

  compliance-soc2-essentialssecurity-hardening+1
• High

  Add TLS and JSON audit middleware

  Serve via rustls with TLS1.2+ and add middleware to log JSON audit events with user_id and request_id; never log raw tokens.

  compliance-soc2-essentialssecurity-hardening+1