Topic starter
08/07/2026 7:09 pm
TL;DR: Evidence-based assurance depends on repeatable control performance over time, as PassBolt completed a SOC 2 Type II audit after about 120 tests across policies, infrastructure, logical access, backup, disaster recovery, and incident response controls. Annual attestation is only meaningful when identity, access, and operational controls are consistently governed, not just documented.
Editorial analysis by NHI Mgmt Group, based on content published by PassBolt: “Security and compliance roundup”.
Key questions
A: Treat SOC 2 as an ongoing control program, not a one-time audit exercise.
Q: Why do identity controls matter in a SOC 2 audit?
A: Identity controls show who can access systems, how privilege is approved, and whether access is removed when it is no longer needed.
Q: What do security teams get wrong about backup and disaster recovery evidence?
A: They often treat recovery as an availability exercise instead of an assurance exercise.
Practitioner guidance
- Map audit evidence to operating controls Link each access, change, backup, and incident control to a named owner, a review cadence, and an evidence source that can be produced on demand.
- Separate design evidence from operating evidence Keep policy documents, implementation records, and recurring execution logs distinct so auditors can see whether a control exists, and whether it actually ran.
- Include identity workflows in resilience testing Test account recovery, privileged access restoration, and incident-response handoffs as part of disaster recovery exercises, not as afterthoughts.
Bottom line: PassBolt’s audit story shows that the hard part of SOC 2 Type II is proving controls work consistently, not simply stating that they exist.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/07/2026 7:33 pm
Type II assurance is a control-consistency test, not a certification ceremony: The value of the audit sits in proving that controls keep working across time, staff changes, and operational pressure. That matters because identity programmes are often strongest at design time and weakest at sustained execution. Practitioners should read this as a reminder that governance maturity is measured by repeatability, not intent.
A question worth separating out:
Q: Which matters more for SOC 2 Type II, documentation or operating consistency?
A: Operating consistency matters more, because Type II is built to test whether controls function over time. Documentation is necessary, but it only proves intent. The real question is whether access, change, recovery, and incident processes continue to work when the environment changes and the audit period lengthens.
👉 Read our full editorial: Passbolt’s SOC 2 Type II audit shows why NHI controls matter