Only the checks assigned to Basel, split between Moe and Yahia in the order that unblocks the most. Checks assigned to anyone else are out of scope for this plan. Basel's governance-only items are listed at the end so nobody waits on us.
Found while reading the admin views on 20 Oct. Each one reorders the work below.
The only connected infra system is panbio-prod (project 183358987402). It has no VMs, no Cloud SQL, no buckets and no Cloud Run; just a default VPC. The real production projects, infrastructure-385413 (US and Qatar) and dammam-437317 (KSA), are not connected. The 44 GCP monitors therefore evaluate nothing, "Infra providers should be configured" fails, and every gap from the internal audit is invisible to Sprinto and to the auditor. Connecting the real projects is the first engineering action, and it will produce a wave of new failing checks on purpose.
Only Google Workspace is in audit scope. For SOC 2 the production cloud and the code repositories are critical systems. Basel decides, but the expected answer is yes, and it turns the "non-mandatory out-of-scope" checks (16 unidentified GitHub users, GitHub org MFA, GCP user MFA, offboarding access removal) into mandatory ones. Better now than when the auditor asks.
rana@pan.bio and saad@pan.bio. Saad is Owner on both production GCP projects and a GitHub organisation admin. Fix today.
Evidence already exists for most of these. Uploads go through Tasks → Fix issues → View monitor → Check details → External evidences.
| Sprinto check | Status | What to do | Who | Effort |
|---|---|---|---|---|
| Google Workspace user should have MFA enabled | 2 failing | Rana and Saad enable 2-Step Verification. Then Basel turns on domain-wide 2SV enforcement in the Workspace admin console. | Moe nudges | 10 min |
| Periodic review of deny-by-default firewall ruleset | failing | Upload evidence folder 01: README, rule dumps for both projects, console screenshots. | Moe | 10 min |
| Periodic review of Disaster Recovery | failing | Upload the dated DR tabletop notes (folder 02). | Moe | 5 min |
| Periodic review of Data backup restoration | failing | Upload the restore notes, log and row counts (folder 03). | Moe | 5 min |
| Internal Audit (workflow check) | failing | Upload the internal-audit workbook (folder 04). "Internal audit is reviewed by management" then needs Basel or the CEO to sign off in Sprinto. | Moe Basel signs | 10 min |
| Code repo should be classified | 33 due | Classify all 46 repos under Change management → GithubApp → Repos monitored. Production: bionl, bionl-runtime, sentinel-service, ims-service-nest, vaic-ingest, vaic-vep, BioMind-Prep, accounting-service, data-cohorts-frontend and data-cohorts-server. Archive dead repos in GitHub first; the rest are non-production. | Yahia | 1 h |
| User should be identified (GitHub) | 16 due | Map GitHub logins to staff. "Auto map all" handles 12; do the rest by hand. jadidbourbaki is an outside collaborator: mark external or remove. | Yahia | 30 min |
| Infra entity should be classified | 2 due | Only the default VPC and BigQuery project in panbio-prod. Moot once the real projects are connected; classify as non-production or drop panbio-prod. | Moe | 5 min |
| GCP service account should not have admin privilege | 1 due | In panbio-prod it is the default compute service account with Editor. The same pattern exists on the real projects (default compute SA holds Owner); fix there once connected. | Moe | 30 min |
Needs one decision from Basel (audit scope) and organisation-owner rights on GitHub.
| Item | What to do | Who |
|---|---|---|
| Infra providers should be configured; connect real GCP | Settings → Integrations → GCP: add infrastructure-385413 and dammam-437317 as infra systems using a Sprinto service account with Viewer and Security Reviewer. Set infra owner to Moe. Classify entities production or non-production (dev-vpc hosts production VMs; the dev services are not). Then remove panbio-prod from Sprinto or mark it out of scope, and consider deleting the project. | Moe |
| Put GCP and GitHub in audit scope | Basel confirms, Moe flips the scope under Access control. New failing checks will appear; that is the point. | Basel Moe |
| Rules for who can access critical systems | Currently failing for Google Workspace. Define the access-control model per critical system (who may hold which access level), then repeat for GCP and GitHub once in scope. | Moe Yahia (GitHub) |
| Periodic review of access to critical systems | Run "Start review" for Google Workspace, then GitHub and GCP. Use the internal-audit IAM findings: remove Owner from service accounts, confirm saad@ and yousef@ still need Owner, delete the leftover Drata account. Basel approves each review. | Moe Yahia Basel signs |
| GitHub org-level MFA should be enforced | An org owner (basel-panbio, bionl-cto, Saad-bionl, yahia-bionl, ahamdjadallah) turns on "Require two-factor authentication". GitHub removes members without 2FA, so confirm every member has it first. | Yahia |
| Dependabot scan enabled; add a vulnerability monitoring source | Enable Dependabot alerts and security updates on every private repo, then connect the "Github Dependabot" scanner integration so the remediation-SLA check becomes monitored. | Yahia |
| Google Security Center should be enabled | Enable Security Command Center Standard on both real projects. | Moe |
| Login protection for AI-related critical systems | Upload screenshots showing MFA or SSO on the OpenAI, Anthropic and any other AI provider consoles BioMind uses, and who holds those accounts. | Yahia |
| Periodic review of system architecture diagram | Refresh the diagram (last updated 22 Jun 2025) to include prod-database, IMS, the Dammam and Qatar satellites and the recovery infrastructure; upload it. | Moe draws Yahia reviews |
| Periodic VAPT report needs to be uploaded | Commission an external penetration test of lab.pan.bio, the API, IMS and the KSA satellite. Vendor and budget are Basel's; engineering writes the scope and fixes the findings. | Basel buys Moe scopes |
The GCP monitors will start failing on real gaps. All of these are already known from the internal audit, so they can be scheduled now.
Basel's remaining checks that need governance work rather than engineering. Listed so the split is explicit.
Source: Sprinto admin views (Tasks, Monitoring, Data Library, Integrations, Frameworks) read on 20 Oct 2026. Evidence folders 01 to 04 and the full task inventory are in the sprinto-evidence package. Framework readiness per Sprinto: SOC 2 Security 84%, Availability 71%, Confidentiality 98%; ISO 27001:2022 82%; GDPR 78%; HIPAA 96 of 103 controls set up.