SOC 2 Type 1 and access controls: what teams need to know

TL;DR: SOC 2 Type 1 assesses whether security controls are designed appropriately at a point in time, while Type 2 evaluates whether those controls operate effectively over six months, according to StrongDM’s guide. That distinction matters because audit readiness depends on documented scope, access control design, and evidence, not just policy intent.

NHIMG editorial — based on content published by StrongDM: SOC 2 Type 1 Compliance Guide: Everything You Need To Know

Questions worth separating out

Q: How should teams prepare access controls for a SOC 2 Type 1 audit?

A: Teams should prepare by proving that access controls are designed, documented, and mapped to scope before audit fieldwork starts.

Q: Why do onboarding and offboarding matter in SOC 2 evidence?

A: They matter because auditors look for repeatable identity lifecycle control, not just written intent.

Q: What breaks when scope is too broad for a SOC 2 programme?

A: A broad scope makes it harder to gather clean evidence, align owners, and show that every in-scope access path is controlled.

Practitioner guidance

• Map audit scope to real identity boundaries List the systems, user groups, service accounts, and privileged pathways that actually sit inside the SOC 2 boundary, then exclude anything you cannot evidence cleanly.
• Separate design evidence from operating evidence For each control, collect both the policy or workflow design and the records showing it was used.
• Document joiner-mover-leaver steps in the ticket trail Use onboarding, access changes, and offboarding tickets as the audit trail for identity lifecycle control.

What's in the full article

StrongDM's full blog covers the operational detail this post intentionally leaves for the source:

• A step-by-step breakdown of the three SOC 2 Type 1 preparation phases and how teams should sequence them.
• Policy template and scope-limiting guidance that shows how the source organiser expects teams to structure the audit work.
• Implementation notes on validating tickets, onboarding, and offboarding before the audit team begins testing.
• A plain-English explanation of how Type 1 differs from Type 2 in audit practice, not just in definition.

👉 Read StrongDM's SOC 2 Type 1 compliance guide →

SOC 2 Type 1 and access controls: what teams need to know?

Explore further

View Full Forum →  |  NHI Foundation Course →