Preparing Compliance Documentation

Guides the preparation of compliance documentation for CockroachDB Cloud deployments by identifying available certifications, mapping security features to compliance controls, and providing a configuration checklist for compliance readiness. Covers SOC 2 Type II, PCI DSS, ISO 27001, HIPAA, and GDPR.

When to Use This Skill

• Responding to customer security questionnaires about CockroachDB Cloud
• Preparing for SOC 2, PCI DSS, or HIPAA compliance audits
• Locating CockroachDB Cloud certification documents (SOC 2 reports, PCI AOC, ISO certificates)
• Assessing whether a cluster's configuration meets a specific compliance framework
• Understanding which compliance features are available on each CockroachDB Cloud plan

Prerequisites

• CockroachDB Cloud account — Any plan
• Cloud Console access — For downloading compliance documents
• Understanding of your compliance requirements — Which frameworks apply to your organization

Steps

1. Identify Available Certifications

CockroachDB Cloud maintains the following certifications and attestations:

CockroachDB Cloud Trust Center: The Trust Center is the primary location for downloading compliance documents. Access it via the Cloud Console or request documents through a support ticket.

2. Map Compliance Controls to CockroachDB Features

See compliance matrix reference for a detailed mapping of compliance controls to CockroachDB features.

SOC 2 — Key Controls

PCI DSS — Key Requirements

HIPAA — Key Safeguards

HIPAA requirement: A Business Associate Agreement (BAA) must be executed with Cockroach Labs before storing PHI. Contact your account team to execute a BAA.

3. Assess Cluster Configuration for Compliance

Use this checklist to evaluate whether a cluster meets common compliance requirements:

Baseline (All Frameworks)

-- Check password policy
SHOW CLUSTER SETTING server.user_login.min_password_length;
-- Should be >= 12

-- Check admin user count
SELECT COUNT(*) AS admin_count FROM [SHOW GRANTS ON ROLE admin];
-- Should be minimized (1-3)

-- Check audit logging
SHOW CLUSTER SETTING sql.log.admin_audit.enabled;
SHOW CLUSTER SETTING sql.log.user_audit;
-- Should be enabled

-- Check PUBLIC role privileges
SELECT database_name, privilege_type
FROM [SHOW GRANTS FOR public]
WHERE privilege_type NOT IN ('USAGE')
  AND schema_name = 'public';
-- Should return no rows for application databases

# Check network security
ccloud cluster networking allowlist list <cluster-id> -o json
# Should NOT contain 0.0.0.0/0

# Check SSO configuration (Cloud Console)
# Verify in Cloud Console > Organization Settings > Authentication

# Check CMEK (Advanced plan)
ccloud cluster info <cluster-name> -o json
# Check for cmek_config

# Check log export (Advanced plan)
# Look for log_export_config in cluster info output

Advanced Compliance (SOC 2 + PCI DSS + HIPAA)

4. Respond to Security Questionnaires

When responding to customer or auditor questionnaires, reference these standard answers:

Encryption at rest:

• CockroachDB Cloud encrypts all data at rest using AES-256
• CMEK is available on Advanced plan with Advanced Security Add-on for customer-controlled keys
• Key management follows cloud provider best practices (AWS KMS, GCP Cloud KMS, Azure Key Vault)

Encryption in transit:

• TLS 1.2+ is enforced on all connections — cannot be disabled
• Client certificate authentication (mTLS) is supported

Data residency:

• Clusters can be deployed in specific regions to meet data residency requirements
• Multi-region clusters keep data within specified regions

Backup and recovery:

• Managed backups are automatic on all plans
• RPO and RTO depend on plan type and configuration
• Backups are encrypted and stored in the same cloud provider

Incident response:

• Cockroach Labs maintains a documented incident response plan
• Details are available in the SOC 2 Type II report

5. Prepare for Compliance Audits

Before the audit:

1. Run the auditing-cloud-cluster-security skill to identify gaps
2. Remediate any FAIL findings using the linked remediation skills
3. Download current compliance documents from the Trust Center
4. Document your CockroachDB Cloud configuration with screenshots or Terraform state

During the audit:

1. Provide the SOC 2 Type II report to demonstrate CockroachDB Cloud's controls
2. Show your cluster configuration (security audit report) to demonstrate your controls
3. Demonstrate audit log export and review capability
4. Show RBAC configuration and access control policies

Compliance documents to have ready:

• SOC 2 Type II report (from Trust Center)
• PCI AOC (if processing payment data)
• ISO 27001 certificate (if required)
• BAA (if storing PHI — executed with Cockroach Labs)
• DPA (if processing EU personal data)
• Your security audit report (from auditing-cloud-cluster-security skill)

Safety Considerations

• This skill is read-only. No cluster configuration is modified.
• Compliance documents may be confidential. Handle SOC 2 reports and PCI AOCs according to your organization's information classification policy.
• Compliance is shared responsibility. CockroachDB Cloud provides the platform controls; your organization is responsible for configuring and using them correctly.

References

Skill references:

• Compliance control matrix

Related skills:

• auditing-cloud-cluster-security — Automated security posture assessment
• configuring-audit-logging — Enable audit logging for compliance
• enabling-cmek-encryption — Enable customer-managed encryption keys
• configuring-sso-and-scim — Enable SSO and automated provisioning
• hardening-user-privileges — Implement least-privilege access
• enforcing-password-policies — Configure password requirements
• configuring-ip-allowlists — Network access control
• configuring-private-connectivity — Private network endpoints
• configuring-log-export — Export logs for compliance retention

Official CockroachDB Documentation:

• CockroachDB Cloud Security Overview
• Compliance
• SOC 2 Compliance