SOC 2 type 2 compliance exposes the identity control gap

At a glance

What this is: A guide to SOC 2 Type 2 compliance that frames access management as an operating-control problem, not a checkbox exercise.

Why it matters: It matters because IAM, IGA, and PAM teams must show that access controls work consistently over time, across human, NHI, and service-account governance.

By the numbers:

• The first quarter of 2023 alone saw over 6 million data records leaked in global breaches.
• Only 5.7% of organisations have full visibility into their service accounts.
• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.

👉 Read Zluri's guide to SOC 2 type 2 compliance and access management

Context

SOC 2 Type 2 is an operating-effectiveness audit, which means the real question is whether controls keep working after they are approved, documented, and rolled into production. For identity programmes, that shifts the focus from policy existence to access evidence, reviewer discipline, and remediation speed across human accounts and non-human identities.

Access management sits at the centre of that test because auditors look for repeatable control operation over months, not a one-time snapshot. That makes entitlement reviews, provisioning records, offboarding, and exception handling part of the compliance story, especially where service accounts and secrets are involved.

The article is written from a compliance and buyer-trust angle, but its practical lesson is broader: organisations fail audits when access governance is fragmented between teams, tools, and systems. That is typical in mid-market and enterprise environments where identity sprawl outpaces review discipline.

Key questions

Q: How should teams prove access controls are operating effectively for SOC 2 type 2?

A: They should produce evidence that approvals, revocations, reviews, and exceptions happened consistently across the audit period. The strongest programmes centralise entitlement history, reviewer sign-off, and remediation records so auditors can sample real activity rather than rely on policy documents alone.

Q: Why do service accounts complicate SOC 2 type 2 access reviews?

A: Service accounts often sit outside human review routines, yet they can hold powerful standing access. That makes them easy to omit from recertification, offboarding, and revocation workflows, which weakens the organisation’s ability to prove complete control over its access surface.

Q: What do organisations get wrong about SOC 2 type 2 compliance and identity governance?

A: They often confuse having a documented process with proving that the process worked over time. In identity governance, that mistake leaves stale access, incomplete offboarding, and weak exception handling hidden until the audit or an incident exposes them.

Q: Who should own access evidence when multiple teams manage IAM, IGA, and PAM?

A: Ownership should sit with a clearly named control owner, but evidence must flow across IAM, IGA, PAM, and security operations. If each team holds a separate fragment, the organisation cannot demonstrate a single operating model for access governance.

Technical breakdown

SOC 2 type 2 vs type 1: why operating effectiveness matters

SOC 2 Type 1 assesses whether controls are suitably designed at a point in time. SOC 2 Type 2 goes further and tests whether those controls actually operated over an extended period, usually months. In practice, that means access approvals, revocations, review sign-offs, and remediation evidence all have to be durable enough to withstand sampling. For IAM teams, the difference is decisive: design intent is not evidence of control performance.

Practical implication: build evidence capture into access workflows so reviewers, auditors, and operators can prove control operation later.

Access management evidence for audit readiness

Auditors do not just want to see that access is controlled. They want to see who had access, who approved it, when it changed, and whether the change aligned to policy. That makes joiner-mover-leaver records, entitlement histories, and revocation logs core audit artifacts. For NHI governance, the same logic applies to service accounts, API keys, and tokens because standing access without traceable change history weakens the control narrative.

Practical implication: centralise entitlement and revocation evidence so access histories can be sampled without manual reconstruction.

Why documentation alone is not enough for SOC 2 type 2

Documentation supports an audit, but documentation does not prove the control worked. Type 2 testing checks whether the documented process was followed consistently and whether exceptions were handled. That is why access reviews, control owners, and remediation timestamps matter. In identity programmes, weak follow-through after certification or recertification often reveals the real gap between written controls and operational governance.

Practical implication: test the operating rhythm of reviews and remediation, not just the existence of policies and procedures.

Threat narrative

Attacker objective: The attacker aims to turn weak identity governance into unauthorised access that can be exploited without early detection or timely revocation.

1. Entry begins when excess or stale access remains active across identities that were never fully reviewed or revoked.
2. Escalation occurs when those permissions are reused for unauthorised data access, privileged actions, or lateral movement across connected systems.
3. Impact follows when control failures become material, creating data exposure, audit findings, or breach conditions that SOC 2 Type 2 controls were meant to limit.

Breaches seen in the wild

• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.
• Schneider Electric credentials breach — exposed credentials gave attackers access to Schneider Electric Jira, exfiltrating 40GB.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

SOC 2 Type 2 turns identity governance into an evidence problem, not a policy problem. Organisations often treat compliance as documentation plus annual review, but Type 2 asks whether access controls kept functioning across the full audit window. That places joiner-mover-leaver discipline, entitlement traceability, and remediation speed inside the control objective rather than outside it. The implication is that identity teams must manage proof of operation as carefully as they manage access itself.

Access management is the compliance spine because it links human IAM and NHI governance in one testable chain. The article focuses on customer trust and auditability, but the same control expectations apply to employees, contractors, service accounts, API keys, and certificates. Where service-account visibility is weak, the organisation cannot demonstrate operating effectiveness for a large part of its real access surface. Practitioners should treat human and machine entitlements as one governance population.

Identity control drift is the failure mode SOC 2 Type 2 is designed to surface. Controls may exist at the start of the audit period, then degrade through exceptions, orphaned access, and incomplete offboarding. That degradation is especially visible when provisioning and review workflows live in different systems. The practical lesson is that audit readiness depends on continuous governance, not periodic clean-up.

Access review cadence is only useful if it captures meaningful change. Recertification that simply re-approves old entitlements can satisfy form but not substance. The article’s framing shows why reviewers need context on business role, privilege scope, and revocation history. Without that, organisations create an audit trail that looks complete while leaving excessive access in place.

Continuous compliance is the real operating model SOC 2 Type 2 rewards. The standard indirectly pressures identity programmes to move from reactive audit preparation to ongoing control monitoring. For security leaders, that means aligning IAM, IGA, PAM, and NHI oversight to one measurable operating model instead of separate compliance motions. The conclusion is straightforward: if access cannot be evidenced continuously, it is not yet governed continuously.

From our research:

• 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to the Ultimate Guide to NHIs.
• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
• That gap makes Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs the right next step for teams tightening access governance.

What this signals

Access governance will keep absorbing more compliance work. SOC 2 Type 2-style expectations push organisations toward continuous evidence collection, which means IAM, IGA, and PAM teams will be asked to prove control operation instead of just describe it. The programme signal is clear: if access change logs, reviewer artefacts, and offboarding evidence are fragmented, audit pressure will keep rising.

Identity sprawl makes audit discipline a board-level resilience issue. With 97% of NHIs carrying excessive privileges according to the Ultimate Guide to NHIs, control drift is not a side problem. For practitioners, the next step is to align compliance evidence with privilege reduction so audit readiness and attack-surface reduction pull in the same direction.

For practitioners

• Unify access evidence across systems Map approvals, entitlement changes, revocations, and reviewer sign-offs into one audit trail so control operation can be reconstructed without spreadsheet archaeology.
• Tie recertification to actual access change Require reviewers to confirm business need, privilege scope, and last-change history, then verify that stale or excessive access is removed after the review closes.
• Include service accounts in the audit population Bring API keys, tokens, certificates, and service accounts into the same access review and offboarding process used for human identities.
• Track remediation timing as a control metric Measure how long it takes to revoke or reduce risky access after a finding so operating effectiveness is visible over the whole audit period.

Key takeaways

• SOC 2 Type 2 is about proving that access controls worked over time, not merely that they were documented.
• Identity governance fails audits when human and non-human access evidence is fragmented across tools and teams.
• Continuous review, revocation, and remediation records are what turn access management into audit-ready control evidence.

Key terms

• SOC 2 Type 2: A SOC 2 Type 2 report evaluates whether an organisation’s controls were designed well and operated effectively over time. It is an operating-effectiveness attestation, so evidence, timing, and consistency matter as much as the control itself.
• Trust Service Criteria: The Trust Service Criteria are the control categories used in SOC 2 reporting: security, availability, processing integrity, confidentiality, and privacy. They define what the organisation must prove about its service environment and how it protects customer data.
• Operating effectiveness: Operating effectiveness means a control did what it was supposed to do during the audit period, not just on paper. For identity programmes, that includes approvals, recertifications, revocations, and exception handling actually happening when required.
• Access evidence: Access evidence is the documented record that shows who had access, who approved it, when it changed, and whether it was removed or remediated properly. In audit and governance work, it is the proof layer behind the policy layer.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.

This post draws on content published by Zluri: Access Management SOC 2 Type 2 Compliance: A Complete Guide. Read the original.