SOC 2 compliance policy

​

Overview

The SOC 2 compliance policy evaluates a subset of SOC 2 Trust Services Criteria (TSC) controls that can be automatically validated through endpoint and system telemetry. The policy focuses on technical safeguards related to access control, system security, monitoring, availability, confidentiality, and data protection. While SOC 2 compliance also requires administrative, procedural, organizational, and audit-based controls that cannot be fully assessed through automated monitoring, this policy provides continuous visibility into key technical controls that support SOC 2 compliance objectives.

​

Controls

​

CC 6.1. Logical Access Security

Ensures that logical access controls protect information assets from unauthorized access and security threats through appropriate security technologies, configurations, and system safeguards.

​

CC 6.2. User Registration & Authorization

Verifies that user accounts are properly managed throughout their lifecycle, including account creation, authorization, and removal when access is no longer required.

​

CC 6.3. Access Authorization, Modification and Removal

Supports role-based access management and the principles of least privilege and segregation of duties by validating that access rights are appropriately assigned and maintained.

​

CC 6.5. Protection Discontinuation

Supports the secure retirement and disposal of systems and devices by ensuring that data protection mechanisms and asset management practices are maintained throughout the asset lifecycle.

​

CC 6.6. Boundary Protection

Verifies that systems implement controls designed to protect organizational resources from threats originating outside established security boundaries.

​

CC 6.7. Restriction of Information Transmission, Movement, and Removal

Ensures that information is transferred, stored, and removed only through authorized and protected mechanisms to reduce the risk of unauthorized disclosure or loss.

​

CC 6.8. Malicious Software Detection and Prevention

Validates the presence and operational status of malware prevention, detection, and response mechanisms designed to protect systems from malicious software.

​

CC 7.1. System Monitoring

Monitors systems for security weaknesses, configuration changes, vulnerabilities, and control failures that could affect organizational security objectives.

​

CC 7.2. Anomaly Detection

Identifies unusual system behavior, suspicious activities, and operational anomalies that may indicate security incidents or control deficiencies.

​

A 1.1. Capacity and Performance Monitoring

Evaluates whether system resources are operating within acceptable thresholds to support availability, reliability, and service continuity objectives.

​

A 1.2. Environmental Protection and Data Backup

Assesses controls that support data protection, backup, recovery readiness, and operational resilience.

​

C 1.3. Confidentiality of Data at Rest and in Transit

Verifies the use of encryption and related safeguards to protect confidential information during storage and transmission.

​

Risk Factors

The policy evaluates multiple technical risk indicators that collectively support SOC 2 control validation. Individual risk factors may contribute to one or more SOC 2 controls.

​

Access and Identity Management

Assesses the security of user accounts, authentication mechanisms, administrative privileges, dormant accounts, password configurations, and other access-related controls. Examples:

• Local account security

​

Device Security Configuration

Evaluates endpoint security features and operating system protections intended to prevent unauthorized access and compromise. Examples:

• Firewall protection
• Disk encryption via BitLocker
• Local Security Authority (LSA) protection
• Core Isolation and platform security features

​

Malware Protection

Assesses the presence and operational status of technologies designed to detect, prevent, and respond to malicious software and unsafe applications. Examples:

• Antivirus protection
• Reputation-based protection
• Detection of unsigned or suspicious processes

​

Vulnerability and Patch Management

Evaluates operating system update status and security maintenance practices to reduce exposure to known vulnerabilities. Examples:

• Missing security updates
• Outdated operating systems

​

Monitoring and Security Event Detection

Assesses system telemetry, event logs, and behavioral indicators that may reveal suspicious activity, security incidents, or control failures. Examples:

• Risky security events
• Suspicious operating system activity
• Security-related audit findings

​

Data Protection and Recovery

Evaluates controls that help protect organizational data and support recovery following an operational disruption or security event. Examples:

• OneDrive Backup status
• Endpoint recovery readiness
• Data protection mechanisms

​

Availability and Performance

Assesses whether system resources remain within acceptable operating thresholds to support continued service availability. Examples:

• CPU utilization
• Memory consumption
• Disk utilization

​

Geographic and Environmental Risk

Evaluates endpoint characteristics that may increase organizational risk based on geographic location or operating conditions. Examples:

• Endpoint geolocation
• Regional compliance considerations
• Location-based access risks

​

Important Notes

• This policy evaluates only those SOC 2 controls that can be assessed through automated technical validation.
• Certain SOC 2 requirements, including governance processes, personnel procedures, policy management, vendor oversight, management reviews, and audit evidence, cannot be fully verified through endpoint-based monitoring.
• Results from this policy should be considered a continuous compliance-monitoring aid and not a substitute for a formal SOC 2 assessment or independent audit.

​

Business Value

This policy provides continuous visibility into the technical controls that underpin SOC 2 compliance. By monitoring endpoint security, access controls, data protection, system availability, and security monitoring capabilities, organizations can identify gaps early, reduce operational risk, improve audit readiness, and strengthen alignment with SOC 2 Trust Services Criteria.

​

Related