Migration Security Reviews: A Field Guide for IT Governance

Scope of This Guide

This guide focuses on change management and monitoring controls that can identify network exposure changes before they lead to breaches. It maps these controls to SOC 2 (2017 Trust Services Criteria) and ISO/IEC 27001:2022.

Consider the case of DigiCert. In February 2025, an internal archive was moved from behind a VPN to a publicly accessible network zone without a security review. The intrusion was detected in June 2026, and a fix was implemented the following month. Exposed data included names, business contact details, and identity verification documents like passports and driver's licenses.

This isn't just about certificate authorities. Any team moving systems between network zones faces similar risks.

Key Concepts and Definitions

Attack Surface Analysis: This involves reviewing what becomes accessible, by whom, and through which functions after a change. The key question is, "What can an outsider now do?"

Network Zone Change: Any move that alters who can access a system, such as from a VPN to DMZ or private subnet to public. Treat these as security-relevant changes.

Dormant Functionality: Features that are harmless behind a boundary but dangerous outside it. At DigiCert, an account registration feature became accessible to outsiders, allowing account creation without multifactor authentication, leading to data exfiltration.

Dwell Time: The period between exposure and detection. In this case, it exceeded a year.

Requirements Breakdown

CC8.1 and Annex A 8.32 both assume a change process exists but don't guarantee it asks the right security questions. A change ticket can be fully authorized yet still miss an attack surface review.

Implementation Guidance

1. Make Network Exposure a Mandatory Change Classification: Add a field to your change request: "Does this alter network reachability?" A 'yes' should automatically route the change for a security review.

2. Require a Post-Change Exposure Inventory: Before approval, list every endpoint, function, and authentication path that becomes reachable. Focus on registration, password reset, API, and admin functions.

3. Enforce MFA by Default: Per Annex A 8.5 and CC6.1, authentication should not depend on the system's intended purpose. Design so that any account, however created, requires MFA.

4. Apply Least Privilege to Read Access: Ensure that read access to sensitive data is tightly controlled. Even read-only access can lead to significant data exfiltration.

5. Add Compensating Layers for Exposed Systems: Use DigiCert's post-incident fixes as a template: place the system behind a web application firewall, block external account creation, and add a SIEM alert for blocked access attempts.

6. Test Your Detection, Not Just Your Prevention: Annex A 8.16 requires monitoring for anomalous behavior. Ensure unexpected accounts on internet-facing systems trigger alerts.

7. Document the Review as Audit Evidence: For SOC 2 Type II, auditors sample changes. Attach a completed attack surface review to each network-affecting change as evidence of CC8.1 compliance.

Common Pitfalls

Treating Migrations as Infrastructure Work: If the platform team owns and approves the change entirely, security might miss it. The review should be a mandatory step.

Concluding Too Early During Triage: DigiCert initially concluded that an unauthorized account couldn't access data, but later found it could. Validate "no impact" conclusions with a second reviewer.

Assuming the Original Risk Assessment Still Holds: A risk assessment done while a system was behind a VPN is outdated once it isn't. Clause 6.1.2 requires reassessment when circumstances change.

Monitoring the Wrong Events: Alerting only on successful logins misses blocked or unexpected attempts, which can be early signals. DigiCert added alerts for blocked attempts to address this.

Ignoring Downstream Impact: Exposed identity documents can have consequences beyond the organization. Data classification and breach impact analysis should reflect this risk.

Quick Reference Table

Bookmark this table. If a migration can't answer every row before go-live, it's not ready.