System Configuration Guidelines
| Field | Value |
|---|---|
| Version | 1.0 |
| Effective Date | April 2026 |
| Review Cycle | Annual |
| Document Owner | Chief Information Security Officer (CISO) |
| Classification | CONFIDENTIAL — Internal Use Only |
| Applicable Standard | SOC 2 Type II — Security, Availability, Confidentiality |
1. Purpose and Scope
This document defines system configuration standards, processing rules, and operational settings implemented within QA Touch to ensure proper performance and achievement of the entity’s security, availability, processing integrity, and confidentiality objectives. Supports SOC 2 TSC CC6, CC7, CC8, A1, and PI1.
ASSUMPTION: All values marked [VERIFY] are assumptions based on common SaaS best practices. Confirm actual values with QA Touch infrastructure and engineering teams before presenting to auditors.
2. Configuration Management Principles
- All infrastructure and application configuration is managed as code (IaC: Terraform / Pulumi / CloudFormation [VERIFY]).
- Configuration changes are subject to the same PR-based review and CI/CD pipeline process as application code changes.
- Production configuration is maintained separately from staging and development; promotion is controlled through CI/CD gates.
- Sensitive values (credentials, API keys, secrets) are never stored in source control; managed exclusively via the secrets management service.
- Configuration drift detection is automated; deviations from baseline trigger alerts to the engineering team.
3. Application Configuration Standards
| Area | Configuration Setting | Value / Standard |
|---|---|---|
| Session Management | Session token entropy | Minimum 256-bit cryptographically random |
| Session Management | Absolute session TTL | 24 hours [VERIFY] |
| Session Management | Idle session timeout | 30 minutes [VERIFY] |
| Session Management | Cookie attributes | HttpOnly; Secure; SameSite=Strict; no JavaScript access |
| Authentication | Password hashing algorithm | Argon2id with parameters per OWASP recommendation [VERIFY]; bcrypt cost ≥ 12 as fallback |
| Authentication | MFA type(s) supported | TOTP (RFC 6238); push notification [VERIFY] |
| Authentication | Failed login lockout threshold | 5 consecutive failures → 15-minute lockout [VERIFY] |
| Authentication | Password reset token TTL | 60 minutes [VERIFY] |
| API | Rate limit — standard tier | 100 requests / minute per API key [VERIFY] |
| API | Maximum request body size | 10 MB [VERIFY] |
| API | API key minimum length | 32 characters; cryptographically random |
| File Uploads | Max attachment size | 20 MB per file [VERIFY] |
| File Uploads | Max import file size | 10 MB per file [VERIFY] |
| File Uploads | Allowed attachment MIME types | image/jpeg, image/png, image/gif, application/pdf, .xlsx, text/csv, application/zip |
| Import | Max import rows per file | 5,000 rows [VERIFY] |
| Import | Error rate abort threshold | > 20% invalid rows aborts import [VERIFY] |
| AI Feature | Prompt max length | ~4,096 tokens / ~16,000 characters [VERIFY] |
| AI Feature | Allowed AI input file types | image/jpeg, image/png, application/pdf |
| AI Feature | AI input file max size | 10 MB [VERIFY] |
4. Infrastructure Configuration Standards
| Layer | Setting | Standard / Value |
|---|---|---|
| Network / TLS | Minimum TLS version | TLS 1.2; TLS 1.3 preferred; SSLv3, TLS 1.0, 1.1 disabled |
| Network / TLS | Cipher suites | Forward-secrecy suites only (ECDHE); RC4, DES, 3DES, NULL disabled |
| Network | HSTS | max-age=31536000; includeSubDomains; preload |
| Network | Content Security Policy | Strict CSP header enforced; inline scripts disallowed [VERIFY] |
| Network | WAF | OWASP Core Rule Set applied; managed DDoS protection |
| Compute | OS patch SLA | Critical: 7 days; High: 30 days [VERIFY] |
| Compute | Service account permissions | Principle of least privilege; no shared credentials |
| Database | Encryption at rest | AES-256; cloud KMS-managed keys |
| Database | Connection encryption | TLS enforced for all application-to-DB connections |
| Database | Automated backups | Daily full; point-in-time recovery (PITR) enabled; 30-day retention [VERIFY] |
| Object Storage | Encryption | AES-256 SSE; versioning enabled; public access blocked at bucket and account level |
| Object Storage | Export file TTL | 24–72 hours; auto-deleted after TTL [VERIFY] |
| Logging | Active SIEM retention | 12 months |
| Logging | Archive retention | 24 months additional (36 months total) |
| Monitoring | P1 alert response SLA | 15 minutes to acknowledge; 4 hours to resolve |
| Secrets | Secrets manager | HashiCorp Vault / AWS Secrets Manager [VERIFY] |
| Secrets | Encryption key rotation | Annual; immediate on suspected compromise |
| Secrets | Integration credential rotation | Every 90 days [VERIFY] |
5. Environment Separation
| Environment | Purpose | Customer Data Permitted | Access Controls |
|---|---|---|---|
| Production | Live customer-facing platform | Yes — real customer data | Engineering/DevOps + VPN + MFA; minimal access list; every session logged |
| Staging | Pre-release validation | Anonymised / synthetic data only [VERIFY] | Engineering and QA teams; VPN required |
| Development | Active feature development | Synthetic data only; no real customer data | Development team; isolated from production network |
6. Configuration Review Cadence
- Configuration baselines documented in version control; drift detection alerts run continuously.
- Configuration reviews conducted quarterly by the Engineering Lead and Security Engineer.
- All configuration changes require PR approval and CI/CD pipeline validation before applying to production.
- Configuration audit trail maintained and available for SOC 2 auditor review.