Proposed Out-of-Scope / N-A Monitoring Tests

Owner	[Security Owner]
Status	Proposal for owner + auditor sign-off
Version	0.1 — DRAFT

Three failing Drata monitoring tests are likely not applicable to Ordermatic today. SOC 2 permits scoping a control out with a written rationale rather than manufacturing evidence for a control that has no real operating instance. Mark these out-of-scope only with owner approval, and confirm with the auditor that they accept the rationale.

1. Independent Board of Directors

Rationale: Ordermatic is an early-stage, founder-controlled company with no independent board. SOC 2 CC1 expects governance oversight, not specifically an independent board. Oversight is performed by management (the Security Owner / founder) via the quarterly security review documented in the Information Security Policy §3.

Proposal: Map CC1 board-oversight to management oversight (documented, minuted quarterly review) and mark the literal “independent board” test out-of-scope until/unless a board is formed. Most auditors accept founder-led governance for a company this size.

2. Infrastructure Accounts Properly Removed

3. Terminated Version Control Accounts Removed

Rationale: These are offboarding tests — they evidence that a terminated person’s accounts were removed. No terminations have occurred, so there is no operating instance to evidence. The control exists (offboarding procedure in the Access Control Policy §4: revoke access same business day across Clerk/GitHub/GCP/Neon/Infisical/1P/Cloudflare).

Proposal: Mark N/A until the first termination, at which point running the offboarding checklist produces the evidence and these flip to PASSED. Document that the control is defined and ready, just unexercised.

---

Not out-of-scope (pending, not N/A)

• Employee Background Checks / Contractor Background Checks — these are in scope. They’re blocked on approving a background-check vendor (Drata brokers Certn/KarmaCheck — spec §6 decision). Once approved and run, they flip. Do not mark N/A.
• Security Awareness Training Completed — in scope; assign Drata’s training to all personnel. Not N/A.