What SOC 2 expects for specific security measures that cut across several criteria: multi-factor authentication, encryption, passwords, logging and monitoring, endpoints, secure development, production access and secrets, with the open-source tools that implement them.
Whether SOC 2 requires MFA and where auditors expect it: the CC6.6 point of focus on additional authentication, remote and administrative access, NIST AAL2 and CISA guidance on phishing-resistant MFA, and implementing it with Keycloak or authentik.
What SOC 2 expects for encryption: CC6.7 on protecting data in transmission and on endpoints, confidentiality commitments, the explicit encryption rules customers may bring from the FTC Safeguards Rule or state insurance laws, and key management with OpenBao and cert-manager.
What password rules SOC 2 auditors accept: the criteria set no length or rotation rules, so policies follow NIST SP 800-63B-4 (length, blocklists, no forced rotation or composition rules) and pair passwords with MFA.
What SOC 2 expects from logging and monitoring: anomaly detection under CC7.2, evaluating events under CC7.3, how long to keep logs when the criteria set no number, reference points from NIST, OMB and CISA, and running it on Wazuh or OpenSearch.
What SOC 2 expects for laptops and servers: protecting endpoint devices and removable media, anti-malware and detecting unauthorized software, disposal, and the device posture evidence that osquery, Fleet and Wazuh can produce.
How SOC 2 covers the software development lifecycle: CC8.1 change authorization and testing, technology development controls, NIST SSDF practices, and evidence from protected branches, code review, SAST and dependency scanning in self-hosted pipelines.
How to restrict and evidence engineer access to production for SOC 2: least privilege and segregation of duties, approval before access, session recording and per-session MFA, and what Teleport's community edition does and does not include.
How SOC 2 applies to application secrets, API keys and service credentials: protecting credentials under CC6.6, short-lived dynamic credentials and audit logs in OpenBao, and catching secrets committed to repositories.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.