Notifications
Clear all
Topic starter
12/06/2026 9:46 pm
TL;DR: SOC 2 control mappings for non-human identities now need attestation, short-lived credentials, audit logs, and declarative change evidence, according to Teleport’s analysis of CC6, CC7, and CC8. The governance gap is no longer whether machines have access, but whether that access is provably authorised, reviewable, and revocable at machine speed.
NHIMG editorial — based on content published by Teleport: SOC 2 Controls for Non-Human Identities, CC6, CC7, and CC8
By the numbers:
- 66% say their current tooling is not adequate to manage the scale of machine identities they now have.
Questions worth separating out
Q: How should organisations prove SOC 2 control over non-human identities?
A: They should prove that machine access is authorised before issuance, monitored during use, and reviewable after change.
Q: Why do machine identities create more SOC 2 evidence pressure than human users?
A: Machine identities often outnumber humans, change faster, and rely more heavily on automated issuance and revocation.
Q: What breaks when static secrets are used for workload access?
A: Static secrets make it difficult to prove who or what received access, when the access should end, and whether the credential was still valid during the audit window.
Practitioner guidance
- Map every machine access path to a SOC 2 control owner Assign CC6, CC7, and CC8 ownership for bots, workloads, and AI agents so every issuance rule, denial event, and change record has a named reviewer.
- Replace static machine secrets with short-lived certificates Use time-bounded credentials for workload access and require transport protections such as TLS and certificate authority pinning where supported.
- Make machine identity issuance evidence auditable by default Log what was requested, what attributes were checked, what rule evaluated the request, and whether the credential was denied or issued.
What's in the full article
Teleport's full article covers the operational detail this post intentionally leaves for the source:
- Specific CC6.1, CC6.2, CC6.3, CC6.6, CC7.2, CC7.3, and CC8.1 mapping examples for auditors and control owners
- Implementation specifics for workload attestation, including tbot properties, join tokens, and bound keypair proof methods
- Evidence examples such as audit logs, Terraform records, and declarative resource definitions that support SOC 2 testing
- How Teleport structures denied issuance, revocation, and join-state lockouts for SIEM and compliance workflows
👉 Read Teleport's SOC 2 mapping for non-human identity controls →
SOC 2 and non-human identities: where machine evidence closes the gap?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
13/06/2026 12:04 am
Machine identities are now part of the SOC 2 evidence problem, not just the access problem. CC6, CC7, and CC8 were written for controlled access, monitoring, and change management, but the article shows that those requirements now apply to workloads, bots, and agentic identities as well as humans. The implication is that auditability must be designed into machine identity lifecycles from the start, not bolted on after a control failure.
A few things that frame the scale:
- 66% say their current tooling is not adequate to manage the scale of machine identities they now have, according to The Critical Gaps in Machine Identity Management report.
- Only 38% have automated certificate lifecycle management in place, according to The Critical Gaps in Machine Identity Management report.
A question worth separating out:
Q: Who should own machine identity change control in an IAM programme?
A: Identity and platform teams should share ownership, with security defining policy and operations managing the implementation. Machine identities behave like production infrastructure, so access rules, bot registrations, and signature checks need the same review discipline as application changes. That makes change control part of identity governance, not a separate engineering activity.
👉 Read our full editorial: SOC 2 controls for non-human identities need machine evidence
