Skip to main content

​
Before You Begin

The SOC 2 Compliance Policy helps assess technical controls that can be verified automatically through endpoint monitoring and telemetry. However, it does not guarantee full SOC 2 compliance. Some SOC 2 controls can be validated almost entirely through automated checks, while others require additional administrative, physical, procedural, or organizational reviews. For example, A 1.2 – Environmental Protection and Data Backup includes not only backup and recovery controls but also environmental protections such as:
  • Uninterruptible Power Supply (UPS) systems
  • Fire suppression mechanisms
  • Climate and humidity controls
These controls cannot be validated automatically and must be assessed separately as part of a broader SOC 2 compliance program.

​
Procedure

  1. Open the Policies page page.
  2. Select the SOC 2 Compliance policy.
  3. Click View details to open the Policy details page.
  4. Open the Endpoint Groups tab.
  5. Verify that the policy is assigned to the All Clients endpoint group. Assigning the policy to this group helps ensure that all managed endpoints are automatically evaluated against the SOC 2 controls included in the policy.
  6. Once the policy has been assigned, return to the Policies page.
  7. Review the Controls State section to identify controls with:
    • Low health scores
    • A high number of active risk factors
  8. Start with the controls having the lowest health score and the greatest number of active risks.
  9. Click the control to open its details.
  10. In the Risk Factors tab, review the risk factors that are currently active.
  11. For each active risk factor, click the Endpoints count to view the endpoints where the issue is present.
  12. Remediate the identified risk factors.
You may choose either of the following approaches:
  • Risk Factor-Based Remediation: Resolve a specific risk factor across all affected endpoints before moving to the next issue.
  • Endpoint-Based Remediation: Fully remediate one endpoint at a time until it becomes compliant. When using this approach, it is recommended to start with the most critical or sensitive endpoints.
  1. Continue the remediation process until:
  • The SOC 2 Policy health score reaches 100%, and
  • No active risk factors remain within any SOC 2 control.
  1. Regularly monitor the policy health score and active risk factors to ensure endpoints remain compliant over time.

​
Key Considerations

  • The SOC 2 compliance policy should be viewed as a continuous compliance-monitoring tool rather than a replacement for a formal SOC 2 assessment or audit.
  • A policy health score of 100% indicates that all automatable controls included in the policy are currently compliant.
  • Some SOC 2 requirements require manual verification, documentation review, process validation, management oversight, or physical inspections.
  • Controls with the lowest health scores typically provide the greatest opportunity for improving overall compliance posture.
  • Regular monitoring helps identify newly introduced risks before they impact compliance objectives.

SOC 2 compliance policy

Assess endpoint and system configurations against automatable SOC 2 security, availability, confidentiality, and access-control requirements to support ongoing compliance monitoring and risk reduction.

How to investigate risk factors

Investigate risk factors affecting an endpoint, review available technical details, and understand the underlying conditions or activities that caused a risk to be detected.