📋 SOC 2 Password Requirements: What Auditors Check for Type I and Type II

SOC 2 Password Requirements: What Auditors Check for Type I and Type II

SOC 2 Password Requirements: What Auditors Check for Type I and Type II

Unlike PCI-DSS or HIPAA, SOC 2 does not prescribe specific password composition rules. Instead, auditors evaluate whether your organisation has designed and operated password controls that meet the AICPA's five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.

Password Controls Under the Security Criterion

The Security criterion (CC6.1-CC6.8) is where most password-related controls fall. CC6.1 specifically addresses logical and physical access controls, requiring that password policies are documented, enforced, and periodically reviewed.

Auditors expect to see: a formal password policy document with minimum length (typically 12+ characters), complexity or length-based requirements, account lockout thresholds (5-10 attempts), session timeout settings, and multi-factor authentication for all privileged and remote access. The policy must apply to both human users and service accounts.

Type I vs Type II: What's Different for Passwords

Type I (Design) — The auditor examines whether your password controls exist on paper. They review your password policy document, system configuration records (e.g., Active Directory Group Policy Objects), and MFA configuration at a specific point in time.

Type II (Operating Effectiveness) — This is where most organisations struggle. The auditor tests whether controls operated consistently over the examination period (typically 6-12 months). They will request: access review meeting minutes, password reset logs, failed login reports, MFA adoption rates, and evidence of timely remediation for policy violations.

Common SOC 2 Password Deficiencies

• No formal password policy document — verbal policies don't count in Type I
• Service accounts without rotation — static credentials that haven't changed in years
• MFA gaps for administrative access — especially to cloud consoles and critical databases
• Missing access recertifications — no evidence that manager-reviewed access lists quarterly
• Insufficient password history enforcement — allowing reuse of recent passwords