From cockroachdb
Guides preparation of compliance documentation for CockroachDB Cloud deployments, covering SOC 2, PCI DSS, ISO 27001, HIPAA, and GDPR certifications. Use when responding to compliance questionnaires, preparing for audits, locating certification documents, or assessing cluster configuration for compliance readiness.
npx claudepluginhub cockroachdb/claude-plugin --plugin cockroachdbThis skill uses the workspace's default tool permissions.
Guides the preparation of compliance documentation for CockroachDB Cloud deployments by identifying available certifications, mapping security features to compliance controls, and providing a configuration checklist for compliance readiness. Covers SOC 2 Type II, PCI DSS, ISO 27001, HIPAA, and GDPR.
Runs AWS CLI checks against CIS AWS Foundations, PCI-DSS, HIPAA, and SOC 2 benchmarks for IAM, logging, networking, and more. Use for audits and compliance monitoring.
Administers cloud databases on AWS (RDS, Aurora, DynamoDB), Azure (SQL, Cosmos), GCP (Cloud SQL, Spanner); automates IaC with Terraform/CloudFormation; optimizes HA/DR, performance, compliance, multi-cloud.
Provides deep expertise in CSA Cloud Controls Matrix (CCM v4.0): 197 controls across 17 domains, CAIQ questionnaire, cloud service models, shared responsibility, mappings to ISO 27001, SOC 2, PCI-DSS, NIST. For cloud security audits and compliance.
Share bugs, ideas, or general feedback.
Guides the preparation of compliance documentation for CockroachDB Cloud deployments by identifying available certifications, mapping security features to compliance controls, and providing a configuration checklist for compliance readiness. Covers SOC 2 Type II, PCI DSS, ISO 27001, HIPAA, and GDPR.
CockroachDB Cloud maintains the following certifications and attestations:
| Certification | Type | Scope | Where to Find |
|---|---|---|---|
| SOC 2 Type II | Attestation report | Cloud infrastructure and operations | Trust Center or request via support |
| PCI DSS | Certificate of Compliance (AOC) | Payment data processing | Trust Center or request via support |
| ISO 27001 | Certification | Information security management | Trust Center or request via support |
| HIPAA | BAA eligibility | Protected health information | Contact sales for BAA execution |
| GDPR | Compliance | EU personal data protection | DPA available on request |
CockroachDB Cloud Trust Center: The Trust Center is the primary location for downloading compliance documents. Access it via the Cloud Console or request documents through a support ticket.
See compliance matrix reference for a detailed mapping of compliance controls to CockroachDB features.
| Control Area | CockroachDB Feature | Configuration Required |
|---|---|---|
| Access Control | RBAC, SSO, SCIM | Configure roles, enable SSO |
| Encryption | TLS (always on), CMEK | Enable CMEK on Advanced plan |
| Audit Logging | SQL audit logging, log export | Enable audit logging + log export |
| Network Security | IP allowlists, private endpoints | Configure network restrictions |
| Availability | Multi-region, managed backups | Built-in on all plans |
| Change Management | Cluster versioning, Terraform | Use IaC for cluster management |
| Requirement | CockroachDB Feature | Notes |
|---|---|---|
| Req 1: Network Security | IP allowlists, private endpoints | Restrict access to cardholder data environment |
| Req 3: Protect Stored Data | Encryption at rest (default), CMEK | CMEK provides key control |
| Req 4: Encrypt Transmission | TLS (always on) | Enforced by default |
| Req 7: Restrict Access | RBAC, least privilege | Use hardening-user-privileges skill |
| Req 8: Identify Users | SQL users, SSO, MFA | Enable SSO with MFA at IdP |
| Req 10: Track Access | Audit logging, log export | Enable and export audit logs |
| Safeguard | CockroachDB Feature | Notes |
|---|---|---|
| Access Control | RBAC, SSO | Implement least privilege |
| Audit Controls | Audit logging, log export | Export to SIEM |
| Integrity | Checksums, replication | Built-in data integrity |
| Transmission Security | TLS (always on) | Enforced by default |
| Encryption | Encryption at rest, CMEK | CMEK for key control |
HIPAA requirement: A Business Associate Agreement (BAA) must be executed with Cockroach Labs before storing PHI. Contact your account team to execute a BAA.
Use this checklist to evaluate whether a cluster meets common compliance requirements:
-- Check password policy
SHOW CLUSTER SETTING server.user_login.min_password_length;
-- Should be >= 12
-- Check admin user count
SELECT COUNT(*) AS admin_count FROM [SHOW GRANTS ON ROLE admin];
-- Should be minimized (1-3)
-- Check audit logging
SHOW CLUSTER SETTING sql.log.admin_audit.enabled;
SHOW CLUSTER SETTING sql.log.user_audit;
-- Should be enabled
-- Check PUBLIC role privileges
SELECT database_name, privilege_type
FROM [SHOW GRANTS FOR public]
WHERE privilege_type NOT IN ('USAGE')
AND schema_name = 'public';
-- Should return no rows for application databases
# Check network security
ccloud cluster networking allowlist list <cluster-id> -o json
# Should NOT contain 0.0.0.0/0
# Check SSO configuration (Cloud Console)
# Verify in Cloud Console > Organization Settings > Authentication
# Check CMEK (Advanced plan)
ccloud cluster info <cluster-name> -o json
# Check for cmek_config
# Check log export (Advanced plan)
# Look for log_export_config in cluster info output
| Check | Command/Location | Expected State |
|---|---|---|
| SSO enabled | Cloud Console | Enabled and enforced |
| SCIM provisioning | Cloud Console | Enabled |
| CMEK enabled | ccloud cluster info | Enabled with valid key |
| Audit logging | SQL: SHOW CLUSTER SETTING sql.log.admin_audit.enabled | true |
| Log export | ccloud cluster info | Configured and ENABLED |
| IP allowlist | ccloud cluster networking allowlist list | No 0.0.0.0/0 |
| Private endpoints | Cloud Console: Networking > Private endpoint | Configured (recommended) |
| Password policy | SQL: min_password_length | >= 12 |
| Admin count | SQL: admin role grants | <= 3 |
| PUBLIC privileges | SQL: SHOW GRANTS FOR public | Minimal |
When responding to customer or auditor questionnaires, reference these standard answers:
Encryption at rest:
Encryption in transit:
Data residency:
Backup and recovery:
Incident response:
Before the audit:
During the audit:
Compliance documents to have ready:
Skill references:
Related skills:
Official CockroachDB Documentation: