Four questionsAnswer honestly

Who has admin access to production right now?

CC6.1SOC 2
02

The engineer who left in March. Is their access gone?

CC6.2SOC 2
03

Is customer data encrypted everywhere it moves?

CC6.7SOC 2
04

How long has that unpatched vulnerability been open?

CC7.2SOC 2

Most teams cannot answer all four. The enterprise customer asking for your SOC 2 report will expect you to.

Request access

Onboarding is capped each quarter so every organization gets a named compliance lead.

You find out the hard way

01

The deal stalls at security review

Procurement sends a questionnaire. You cannot answer it, so the contract sits while somebody guesses at the answers.

02

You get asked for a report you do not have

A SOC 2 takes months of evidence you should already have been collecting. Nobody tells you that until a customer asks.

03

The answer changes and nobody notices

Access was right in January. Someone added a contractor in April. There is no moment where anyone checks.

Someone tells you exactly what to do

That first question is a real control. This is what it looks like when it lands in your queue.

CC6.1SOC 2 Type II
Who has access
What it means

Restrict logical access to systems, data, and other protected resources to authorized users only.

How to actually do it

Use centralized identity (IdP) with SSO for all production systems. Enforce least privilege through role-based access. Disable shared/default accounts. Encrypt data in transit (TLS 1.2+) and at rest (AES-256 or equivalent). Document a logical access policy and reconcile actual access against approved access quarterly.

How you know it is done
  1. 01Centralized identity provider (IdP) is used for production system access.
  2. 02Single sign-on (SSO) is enabled for all SaaS and internal apps that support it.
  3. 03Role-based access (RBAC) is documented with role-to-permission mapping.
  4. 04No shared accounts in production (or shared accounts have documented compensating controls).

This is what the auditor tests

Whichever one they are asking you for

8 frameworks / 971 controls
SOC 2Enterprise
61controls
20 domains

AICPA TSC 2017 (updated 2022)

NIST 800-53Federal
304controls
20 domains

Rev 5 (Sep 2020)

ISO 27001International
93controls
4 domains

ISO/IEC 27001:2022

HIPAAHealthcare
52controls
5 domains

45 CFR Parts 160 & 164

PCI-DSSPayment
63controls
12 domains

v4.0 (Mar 2022)

CMMCDefense
110controls
14 domains

CMMC 2.0 (Dec 2021)

FedRAMPFederal
248controls
20 domains

Rev 5 Baselines (2023)

FISMAFederal
40controls
12 domains

FISMA 2014 / OMB A-130

And the proof holds up when it is checked

Collected01

Pulled straight from AWS, or uploaded against the control it satisfies. Never a folder of loose screenshots.

Attested02

Every upload, release and destruction is written to an append-only log, with the person who did it.

Disclosed03

Your auditor sees exactly what was released for the audit. Nothing else, and no standing seat in your systems.

Answer the four before someone else asks

Request access

Tell us which framework you are being asked for and we will tell you what it takes.