iron-edge 1.0.0

package/squads/squad-cybersecurity/knowledge-base/cloud-security-reference.md

@@ -0,0 +1,363 @@
+# Cloud Security Reference
+
+## Purpose
+
+Reference for cloud security across AWS, Azure, and GCP — shared responsibility model, IAM security, CSPM, container security, and Cloudflare-specific controls. Used by Nimbus (cloud-security-engineer).
+
+---
+
+## Shared Responsibility Model
+
+The fundamental principle of cloud security. Understanding the boundary between provider and customer responsibility prevents the most common cloud security failures.
+
+### AWS Shared Responsibility
+
+| Layer | AWS Responsibility | Customer Responsibility |
+|-------|-------------------|------------------------|
+| Physical infrastructure | Data centers, hardware, networking | Nothing |
+| Hypervisor | Virtualization layer | Nothing |
+| Compute (EC2) | Physical host, hypervisor | OS, applications, data, networking within VPC |
+| Managed Services (RDS, S3) | Service availability, underlying infra | Configuration, access controls, encryption settings |
+| Serverless (Lambda) | Runtime, infrastructure | Function code, IAM permissions, data |
+| SaaS (WorkMail) | Everything | Data, user management |
+
+**The most common mistake:** Customers assume "it's in AWS so it's secure." Wrong — misconfigured S3 buckets, open security groups, and over-privileged IAM roles are all customer responsibility.
+
+### Azure and GCP
+
+Same model applies. Google Cloud's shared responsibility documentation explicitly states that security misconfiguration is the #1 cause of cloud incidents, and it falls under customer responsibility.
+
+---
+
+## IAM Security — The Highest-ROI Control
+
+### Core IAM Principles
+
+**Least Privilege:** Every identity (user, role, service account) should have only the minimum permissions required to perform its function.
+
+**No wildcards in production:**
+```json
+// FORBIDDEN: wildcard permissions
+{
+  "Effect": "Allow",
+  "Action": "*",
+  "Resource": "*"
+}
+
+// REQUIRED: specific permissions
+{
+  "Effect": "Allow",
+  "Action": [
+    "s3:GetObject",
+    "s3:PutObject"
+  ],
+  "Resource": "arn:aws:s3:::my-bucket/*"
+}
+```
+
+### AWS IAM Best Practices
+
+```bash
+# Identify overprivileged IAM entities
+# Use AWS IAM Access Analyzer
+aws accessanalyzer create-analyzer --analyzer-name org-analyzer --type ORGANIZATION
+
+# Generate least privilege policy from access logs
+aws iam generate-service-last-accessed-details --arn arn:aws:iam::123456789012:role/my-role
+
+# Check for admin policies attached to users (should use roles, not users)
+aws iam list-users --query 'Users[*].UserName' --output text | \
+  xargs -I{} aws iam list-attached-user-policies --user-name {}
+
+# Ensure MFA is enabled for root account
+aws iam get-account-summary --query 'SummaryMap.AccountMFAEnabled'
+
+# Check for access keys older than 90 days (rotation policy)
+aws iam list-users --query 'Users[*].UserName' --output text | \
+  xargs -I{} aws iam list-access-keys --user-name {} \
+  --query 'AccessKeyMetadata[?CreateDate<=`2025-01-01`]'
+```
+
+### Service-to-Service Authentication
+
+**Never use static credentials for service-to-service auth:**
+
+```javascript
+// WRONG: Static credentials in code or environment
+const awsConfig = {
+  accessKeyId: 'AKIA...',  // Never hardcode or store in env as permanent credentials
+  secretAccessKey: '...'   // Use IAM roles instead
+}
+
+// RIGHT: IAM role attached to EC2/Lambda/ECS task
+// No credentials needed -- SDK discovers them automatically via instance metadata
+const { S3Client } = require('@aws-sdk/client-s3')
+const client = new S3Client({ region: 'us-east-1' })
+// SDK automatically uses IAM role credentials
+```
+
+**GitHub Actions to AWS (OIDC federation -- no static keys):**
+```yaml
+# .github/workflows/deploy.yml
+permissions:
+  id-token: write  # Required for OIDC
+  contents: read
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Configure AWS credentials via OIDC
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::123456789012:role/github-actions-role
+          aws-region: us-east-1
+          # No access keys needed -- OIDC token exchanges for temporary credentials
+```
+
+---
+
+## Cloud Security Posture Management (CSPM)
+
+### What CSPM Does
+
+CSPM tools continuously scan cloud environments for misconfigurations against security benchmarks (CIS, NIST, PCI DSS, HIPAA, LGPD-aligned).
+
+### Open Source CSPM Tools
+
+| Tool | Clouds | Focus |
+|------|--------|-------|
+| **Prowler** | AWS, Azure, GCP, Kubernetes | 300+ checks, CIS benchmarks, compliance |
+| **ScoutSuite** | AWS, Azure, GCP | GUI report, baseline audit |
+| **Checkov** | IaC (Terraform, CloudFormation, ARM) | Shift-left — scan before deploy |
+| **tfsec** | Terraform | Security analysis of Terraform code |
+| **KICS** | Multi-IaC | Queries for misconfig in code |
+
+```bash
+# Prowler AWS assessment
+prowler aws --profile myprofile --compliance cis_level2_aws_1.4
+
+# Checkov on Terraform code
+checkov -d ./terraform --framework terraform --compact
+
+# Scout Suite
+python scout.py aws --profile myprofile --services iam s3 ec2 rds
+```
+
+### CIS Benchmark Critical Checks
+
+**AWS (CIS Level 1):**
+```
+IAM
+[ ] Root account has no active access keys
+[ ] MFA enabled for root account
+[ ] MFA enabled for all IAM users with console access
+[ ] Password policy meets requirements (min 14 chars, complexity)
+[ ] Access keys rotated within 90 days
+[ ] No user with AdministratorAccess policy (use roles)
+
+Networking
+[ ] No security groups allow unrestricted inbound SSH (0.0.0.0/0:22)
+[ ] No security groups allow unrestricted inbound RDP (0.0.0.0/0:3389)
+[ ] VPC flow logs enabled on all VPCs
+[ ] Default VPC security group has no inbound/outbound rules
+
+Logging
+[ ] CloudTrail enabled in all regions
+[ ] CloudTrail log file validation enabled
+[ ] CloudTrail logs sent to S3 with MFA delete
+[ ] CloudWatch alarms on root account usage
+[ ] Config service enabled in all regions
+
+Storage
+[ ] S3 Block Public Access enabled at account level
+[ ] S3 bucket versioning enabled for critical buckets
+[ ] S3 server-side encryption enabled
+
+Database
+[ ] RDS instances not publicly accessible
+[ ] RDS snapshots not publicly accessible
+[ ] RDS encryption at rest enabled
+```
+
+---
+
+## Container Security
+
+### Image Security
+
+```bash
+# Scan container images for vulnerabilities before pushing
+# Trivy (recommended -- fast, accurate)
+trivy image --severity HIGH,CRITICAL myapp:latest
+
+# Exit non-zero if high/critical vulnerabilities found (for CI gate)
+trivy image --exit-code 1 --severity HIGH,CRITICAL myapp:latest
+
+# Grype (alternative)
+grype myapp:latest --fail-on high
+
+# In GitHub Actions
+- name: Container Security Scan
+  uses: aquasecurity/trivy-action@master
+  with:
+    image-ref: 'myapp:latest'
+    format: 'sarif'
+    exit-code: '1'
+    severity: 'HIGH,CRITICAL'
+```
+
+### Dockerfile Security
+
+```dockerfile
+# Use specific version tags -- never :latest in production
+FROM node:20.18-alpine3.20
+
+# Run as non-root user
+RUN addgroup -g 1001 -S nodejs && \
+    adduser -S nextjs -u 1001
+
+# Copy files as root, then switch
+COPY --chown=nextjs:nodejs . .
+
+# Switch to non-root
+USER nextjs
+
+# Read-only filesystem when possible
+# Run with: docker run --read-only --tmpfs /tmp myapp
+```
+
+### Kubernetes Security Context
+
+```yaml
+# Pod Security Context -- harden pods
+apiVersion: v1
+kind: Pod
+spec:
+  securityContext:
+    runAsNonRoot: true        # Prevent running as root
+    runAsUser: 1001           # Non-root UID
+    fsGroup: 1001             # File system group
+    seccompProfile:
+      type: RuntimeDefault    # Enable seccomp filtering
+  containers:
+  - name: myapp
+    securityContext:
+      allowPrivilegeEscalation: false   # Prevent sudo/setuid
+      readOnlyRootFilesystem: true      # Immutable filesystem
+      capabilities:
+        drop: [ALL]                     # Drop all Linux capabilities
+        add: [NET_BIND_SERVICE]         # Add only what's needed
+```
+
+### Kubernetes RBAC Audit
+
+```bash
+# Find service accounts with cluster-admin (over-privileged)
+kubectl get clusterrolebindings -o json | \
+  jq '.items[] | select(.roleRef.name=="cluster-admin") | .subjects'
+
+# Find pods with hostPath volumes (potential container escape)
+kubectl get pods -A -o json | \
+  jq '.items[] | select(.spec.volumes[]?.hostPath != null) | {name:.metadata.name, ns:.metadata.namespace}'
+
+# Find privileged containers
+kubectl get pods -A -o json | \
+  jq '.items[] | select(.spec.containers[].securityContext.privileged == true) | .metadata'
+
+# Network policies coverage
+kubectl get networkpolicies -A
+# Any namespace without NetworkPolicy = no network isolation
+```
+
+---
+
+## AWS Security Services Reference
+
+| Service | Purpose | When to Use |
+|---------|---------|-------------|
+| **IAM Access Analyzer** | Detect external access and unused permissions | Continuous — enable organization-wide |
+| **AWS GuardDuty** | Threat detection (ML-based, CloudTrail/VPC flow/DNS analysis) | Always-on in production |
+| **AWS Security Hub** | Centralized security findings + compliance checks | Enable CIS/PCI/NIST benchmarks |
+| **AWS Config** | Track configuration changes, compliance rules | Audit trail, compliance |
+| **AWS Inspector** | Vulnerability assessment for EC2, Lambda, ECR | Continuous scanning |
+| **AWS Macie** | PII discovery in S3 | LGPD/privacy compliance |
+| **AWS WAF** | Web application firewall | All public-facing applications |
+| **AWS Shield** | DDoS protection | Standard: free; Advanced: $3K/month |
+| **AWS KMS** | Key management | Encrypt all data at rest |
+| **AWS Secrets Manager** | Secrets rotation | All credentials, API keys, database passwords |
+
+---
+
+## Cloudflare Security Controls
+
+Cloudflare provides security controls that protect at the edge before traffic reaches origin servers:
+
+### WAF (Web Application Firewall)
+
+```
+Managed Rules:
+- OWASP Core Rule Set: blocks SQLi, XSS, path traversal
+- Cloudflare Managed: updated automatically for emerging threats
+- Custom Rules: write your own for application-specific patterns
+
+Custom Rule Examples:
+- Block requests from specific countries
+- Block requests with suspicious User-Agent strings
+- Rate limit specific endpoints (e.g., /api/auth/login → 5/min per IP)
+- Block requests without valid origin header
+```
+
+### DDoS Protection
+
+```
+Layer 3/4 (Network DDoS): Always-on, included in all plans
+Layer 7 (Application DDoS): Configurable thresholds
+- HTTP Flood protection
+- Slowloris protection
+- Cache-busting attack protection
+
+Enable via Dashboard: Security → DDoS → HTTP DDoS attack protection
+```
+
+### Zero Trust (Cloudflare Access)
+
+```
+Replace VPN with identity-aware access:
+- Protect internal tools (Kibana, Grafana, Metabase, etc.)
+- Require corporate SSO before reaching origin
+- No open port on origin server needed
+- Audit log of every access request
+```
+
+---
+
+## LGPD Cloud Compliance
+
+For Brazilian personal data, cloud configuration must support LGPD requirements:
+
+| LGPD Requirement | Cloud Control |
+|----------------|--------------|
+| Data residency preference | Use Brazilian regions: AWS sa-east-1, Azure Brazil South, GCP southamerica-east1 |
+| International transfers (SCCs since Aug 2025) | Standard Contractual Clauses with cloud provider |
+| Encryption (Art. 46) | Enable encryption at rest (KMS/CMEK) and enforce TLS in transit |
+| Audit logging (Art. 46) | CloudTrail/Activity Log/Cloud Audit Logs enabled and retained |
+| Data subject rights (Art. 18) | Implement deletion capability for personal data in cloud storage |
+| Breach notification (Art. 48) | GuardDuty/Security Center alerts → incident response → ANPD notification |
+
+**Brazilian region availability:**
+- AWS: sa-east-1 (Sao Paulo, 3 AZs) — since 2011
+- Azure: Brazil South (Campinas, 3 AZs) — since 2014
+- GCP: southamerica-east1 (Osasco, 3 AZs) — since 2017
+- Cloudflare: POPs in Sao Paulo, Rio de Janeiro, Fortaleza, Porto Alegre, Brasilia
+
+---
+
+## Sources
+
+- AWS Well-Architected Security Pillar: https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/
+- CIS AWS Benchmark: https://www.cisecurity.org/benchmark/amazon_web_services
+- NIST SP 800-207 Zero Trust: https://csrc.nist.gov/pubs/sp/800/207/final
+- Prowler: https://github.com/prowler-cloud/prowler
+- Trivy: https://github.com/aquasecurity/trivy
+- Cloudflare Zero Trust: https://developers.cloudflare.com/cloudflare-one/

package/squads/squad-cybersecurity/knowledge-base/compliance-frameworks.md

@@ -0,0 +1,273 @@
+# Compliance Frameworks Reference
+
+## Purpose
+
+Deep reference for LGPD, ISO 27001, SOC 2, and PCI DSS — requirements, implementation guidance, and decision-making support. Used by Govern (compliance-officer) for gap assessments, policy work, and remediation planning.
+
+---
+
+## LGPD — Lei Geral de Proteção de Dados
+
+### Overview
+
+- **Law:** Lei 13.709/2018
+- **Effective:** August 2020
+- **Enforced by:** ANPD (Autoridade Nacional de Proteção de Dados)
+- **Scope:** Applies to any processing of personal data of individuals in Brazil, regardless of where the processor is located
+- **Model:** Based heavily on EU GDPR but with Brazilian context
+
+**Critical 2025 Update:** The ANPD became an **independent regulatory agency** in 2025 via Medida Provisória 1.317/2025, giving it full autonomy. This significantly increases enforcement capacity and risk of penalties.
+
+### LGPD vs. GDPR — Key Differences
+
+| Aspect | LGPD | GDPR |
+|--------|------|------|
+| Data residency | Not explicitly required | Not explicitly required |
+| International transfers | SCCs required (from Aug 2025) | SCCs or adequacy decision |
+| DPO mandatory? | Yes (Encarregado) | Yes for certain controllers |
+| Right to explanation (AI) | Article 20 | Article 22 |
+| Penalties | Up to 2% of revenue in Brazil, max R$ 50M | Up to 4% of global revenue |
+| Children's data | Article 14 — special protection | Article 8 GDPR |
+| Legal age for consent | 18 (children need parental consent) | 16 (member state variation) |
+
+### Key Articles — Technical Implementation
+
+| Article | Requirement | Technical Implementation |
+|---------|-------------|------------------------|
+| **Art. 7-8** | Lawful basis for processing — consent must be explicit | Opt-in forms (never pre-checked), granular consent per purpose |
+| **Art. 9** | Transparency — inform data subjects | Privacy policy, accessible and plain language |
+| **Art. 11** | Sensitive data special protection | Extra security controls for health, biometric, political, religious data |
+| **Art. 14** | Children's data | Parental consent mechanism, age verification |
+| **Art. 18** | Data subject rights | Portal: access, correction, deletion, portability, revoke consent |
+| **Art. 20** | Automated decision-making | Ability to request human review of algorithmic decisions |
+| **Art. 33** | International data transfers | SCCs required (grace period ended Aug 23, 2025) |
+| **Art. 38** | RIPD (DPIA) | Data Protection Impact Assessment for high-risk processing |
+| **Art. 41** | DPO (Encarregado) | Designate and publish contact; ANPD registration if required |
+| **Art. 46** | Security measures | Encryption, access control, RLS, incident procedures |
+| **Art. 48** | Breach notification | 3 business days to ANPD + data subjects |
+
+### LGPD Technical Checklist
+
+```
+Consent Management
+[ ] Opt-in forms with explicit, specific consent (not pre-checked)
+[ ] Separate consent per processing purpose
+[ ] Consent withdrawal mechanism as easy as giving consent
+[ ] Consent records stored with timestamp and mechanism
+
+Data Subject Rights Portal
+[ ] Data export endpoint (download my data)
+[ ] Data correction form or interface
+[ ] Account/data deletion mechanism
+[ ] Consent revocation mechanism
+[ ] Response within 15 days (LGPD Art. 19)
+
+DPO (Encarregado)
+[ ] Designated DPO with name and contact published on website
+[ ] DPO contactable for data subject requests
+[ ] ANPD registration if organization qualifies
+
+Technical Security (Art. 46)
+[ ] TLS 1.2+ on all data transmission
+[ ] Encryption at rest for personal data
+[ ] Access control with least privilege
+[ ] Audit logging for personal data access
+[ ] RLS policies in database
+
+Breach Response (Art. 48)
+[ ] Incident detection capability
+[ ] Breach notification procedure documented
+[ ] ANPD contact and form known
+[ ] Data subjects notification template ready
+[ ] 3 business day timeline enforced
+
+International Transfers (Art. 33, since Aug 2025)
+[ ] Standard Contractual Clauses (SCCs) executed with all vendors
+[ ] Data processing agreements with international processors
+[ ] Transfer impact assessments for high-risk destinations
+```
+
+### ANPD Enforcement Priorities 2025-2026
+
+Based on ANPD public statements:
+1. **Children's data** — apps used by minors, parental consent, age verification
+2. **AI and biometric data** — facial recognition, automated profiling
+3. **Data scraping** — web scraping of personal data without consent
+4. **Health data** — medical records, health apps
+
+Organizations in these sectors should expect active inspections.
+
+---
+
+## ISO/IEC 27001:2022
+
+### Overview
+
+- **Standard:** ISO/IEC 27001:2022 (latest revision — 93 controls vs. 114 in 2013 version)
+- **Result:** Certification (audited by accredited certification body)
+- **Scope:** Information Security Management System (ISMS)
+- **Approach:** Risk-based — implement controls proportional to identified risks
+- **Timeline:** 6-18 months for initial certification
+- **Cost:** $30,000–$200,000+ depending on organization size
+
+### The 4 Control Themes (Annex A, 2022 revision)
+
+| Theme | Controls | Coverage |
+|-------|----------|---------|
+| **Organizational** | 37 controls | Policies, risk management, supplier relationships, incident management |
+| **People** | 8 controls | Screening, training, responsibilities, disciplinary process |
+| **Physical** | 14 controls | Physical security, physical media, clean desk |
+| **Technological** | 34 controls | Access control, cryptography, logging, vulnerability management |
+
+### ISO 27001 Clauses (Mandatory)
+
+| Clause | Requirement |
+|--------|-------------|
+| **4** | Understanding the organization — context, interested parties, ISMS scope |
+| **5** | Leadership — top management commitment, policies |
+| **6** | Planning — risk assessment, risk treatment, objectives |
+| **7** | Support — resources, competence, awareness, communication, documentation |
+| **8** | Operation — risk treatment implementation, supplier assessment |
+| **9** | Performance evaluation — monitoring, internal audit, management review |
+| **10** | Improvement — nonconformities, corrective action, continual improvement |
+
+### New Controls in 2022 (not in 2013)
+
+These 11 new controls reflect modern threats:
+- Threat intelligence
+- Information security for use of cloud services
+- ICT readiness for business continuity
+- Physical security monitoring
+- Configuration management
+- Information deletion
+- Data masking
+- Data leakage prevention
+- Monitoring activities
+- Web filtering
+- Secure coding
+
+---
+
+## SOC 2 (Service Organization Controls 2)
+
+### Overview
+
+- **Standard:** AICPA Trust Services Criteria
+- **Result:** Attestation report (not certification)
+- **Scope:** Controls relevant to security, availability, processing integrity, confidentiality, privacy of service organizations
+- **Timeline:** Type I: 2-3 months | Type II: 6-12 months (observation period)
+- **Cost:** $20,000–$100,000+
+
+### Type I vs. Type II
+
+| Aspect | Type I | Type II |
+|--------|--------|---------|
+| What it says | Controls are suitably designed at a point in time | Controls operated effectively over a period (usually 6+ months) |
+| Timeline | 2-3 months | 6-12 months (observation period required) |
+| Value | Faster to achieve, good starting point | Higher assurance, preferred by enterprise buyers |
+| When to get | Startup needing to close first enterprise deals | Established product with running controls |
+
+### The 5 Trust Service Criteria
+
+| Criterion | Abbreviation | Scope |
+|-----------|-------------|-------|
+| **Security** | CC (Common Criteria) | The baseline — every SOC 2 includes this |
+| **Availability** | A | System available for operation as committed |
+| **Processing Integrity** | PI | System processing is complete, accurate, timely |
+| **Confidentiality** | C | Information designated as confidential is protected |
+| **Privacy** | P | Personal information collected in accordance with privacy commitments |
+
+Most SaaS startups pursue Security + Availability + Confidentiality initially.
+
+### SOC 2 Common Criteria — Technical Controls
+
+Key CC categories with technical implementation:
+
+| CC Category | Examples of Evidence Needed |
+|-------------|--------------------------|
+| **CC6 — Logical and Physical Access** | MFA, access reviews, offboarding procedures, privileged access management |
+| **CC7 — System Operations** | Monitoring, alert management, incident response, change management |
+| **CC8 — Change Management** | Code review process, deployment approvals, environment separation |
+| **CC9 — Risk Mitigation** | Vendor management, business continuity, encryption at rest and transit |
+
+---
+
+## PCI DSS v4.0
+
+### Overview
+
+- **Standard:** Payment Card Industry Data Security Standard v4.0
+- **Effective:** March 2024 (v3.2.1 retired March 2024)
+- **Scope:** Any organization that stores, processes, or transmits cardholder data
+- **Managed by:** PCI Security Standards Council
+- **Validation levels:** SAQ (Self-Assessment) for smaller merchants, QSA audit for larger
+
+### 12 Requirements in 6 Goals
+
+| Goal | Requirements |
+|------|-------------|
+| **Build and Maintain Secure Network** | R1: Firewalls; R2: No vendor defaults |
+| **Protect Cardholder Data** | R3: Store data securely; R4: Encrypt transmission |
+| **Vulnerability Management** | R5: Anti-malware; R6: Secure systems |
+| **Access Control** | R7: Restrict access; R8: Identify and authenticate; R9: Physical access |
+| **Monitor and Test** | R10: Log all access; R11: Test regularly |
+| **Information Security Policy** | R12: Maintain policy |
+
+### Scope Reduction Strategy
+
+**Use a tokenization/hosted payment page to minimize scope:**
+```
+In scope (if you collect card data directly):
+- All systems that process, store, or transmit card data
+- All systems in the same network segment
+- All administration systems for above
+
+Minimal scope (using hosted payment fields / tokenization):
+- Only your tokenization provider integration
+- SAQ A is sufficient (lowest level — just questionnaire)
+```
+
+**Recommended approach for most web apps:** Use Stripe, Braintree, or Adyen hosted payment fields. Card data never touches your servers. Scope reduces to SAQ A.
+
+---
+
+## Compliance Comparison Matrix
+
+| Aspect | LGPD | ISO 27001 | SOC 2 | PCI DSS |
+|--------|------|-----------|-------|---------|
+| **Focus** | Privacy | InfoSec management | Trust for service orgs | Payment card security |
+| **Result** | Compliance (legal) | Certification | Attestation report | Certificate/Report |
+| **Mandatory for** | Brazilian personal data | Voluntary (market-driven) | Enterprise B2B customers | Card processing |
+| **Geographic focus** | Brazil | Global | North America primary | Global |
+| **Timeline** | Ongoing | 6-18 months | 2-12 months | Variable |
+| **Overlap with others** | ~40% with GDPR | ~70% with SOC 2 | ~70% with ISO 27001 | — |
+
+### When to Pursue Which
+
+| Situation | Recommendation |
+|-----------|---------------|
+| Any Brazilian personal data | LGPD is mandatory — not optional |
+| Selling B2B SaaS to US companies | SOC 2 Type I first — reduces friction in deals |
+| Selling globally or to European enterprises | ISO 27001 — globally recognized |
+| Processing payments | PCI DSS scope reduction (tokenization), then SAQ A |
+| Early-stage startup | Start with LGPD + SOC 2 Type I |
+| Scaling to enterprise | Add ISO 27001, then SOC 2 Type II |
+
+### Overlap Efficiency
+
+ISO 27001 and SOC 2 have ~70% control overlap. Pursuing both simultaneously is ~30% more efficient than sequential implementation:
+- Same policies serve both
+- Same control evidence collected once
+- Same training program covers both
+- Auditors can often share work product
+
+---
+
+## Sources
+
+- LGPD full text: http://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm
+- ANPD official: https://www.gov.br/anpd/pt-br
+- ISO 27001:2022: https://www.iso.org/standard/27001
+- AICPA SOC 2: https://www.aicpa-cima.com/resources/article/soc-2-engagements
+- PCI DSS v4.0: https://www.pcisecuritystandards.org/
+- ICLG Brazil Data Protection 2025-2026: https://iclg.com/practice-areas/data-protection-laws-and-regulations/brazil