SOC 2 Compliance for SSH, Kubernetes, Databases, Desktops, and Web Apps

Teleport is designed to meet SOC 2 requirements for the purposes of accessing infrastructure, change management, and system operations. This document outlines a high level overview of how Teleport can be used to help your company to become SOC 2 compliant.

Achieving SOC 2 Compliance with Teleport

SOC 2 or Service Organization Controls were developed by the American Institute of CPAs (AICPA). They are based on five trust services criteria: security, availability, processing integrity, confidentiality, and privacy.

What Key SOC 2 Controls does Teleport help achieve?

Teleport helps with 4 of the 9 control areas.

CC6 Control Activities

Teleport helps with separation of duties using RBAC and restricts access to authorized users

• Provide role-based access controls (RBAC) using short-lived certificates and your existing identity management service.

CC6 Physical and Logical Access controls

Teleport issues temporary security credentials according to the user's role.

CC7 System Operations

Teleport helps audit and monitor access.

• Audit events and session recordings are securely stored in a vault to prevent tampering.
• Convert logins, executed commands, deployments and other events into structured audit logs.
• Monitor, share and join interactive sessions in real-time from the CLI or browser.

CC8 Change Management

Teleport helps users elevate their permissions during incidents, RBAC helps limit the need for approvals. The Teleport Slack integration allows for managers to quickly approve temporary SSH Access Requests.

• Let engineers request elevated permissions on the fly without ever leaving the terminal
• Approve or deny permission requests with ChatOps workflow via Slack or other supported platforms.
• Extend and customize permission elevation workflow with a simple API and extendable plugin system.

What Specific Criteria does Teleport Help Satisfy?

Below is a table of principles and common points of focus listed by AICPA's official "Trust Services Criteria" reference document and how Teleport helps satisfy them.

Each principle has many "Points of Focus" which will apply differently to different products and organizations, talk to an auditor to understand exactly which points of focus apply to your organization.

Principle Criteria	Point of Focus	Teleport Features
CC6.1 - Restricts Logical Access	Logical access to information assets, including hardware, data (at-rest, during processing, or in transmission), software, administrative authorities, mobile devices, output, and offline system components is restricted through the use of access control software and rule sets.	Teleport Enterprise supports robust Role-based Access Controls (RBAC) to: Control which SSH nodes a user can or cannot access. Control cluster level configuration (session recording, configuration, etc.) Control which UNIX logins a user is allowed to use when logging into a server.
CC6.1 - Identifies and Authenticates Users	Persons, infrastructure, and software are identified and authenticated prior to accessing information assets, whether locally or remotely.	Provide role-based access controls (RBAC) using short-lived certificates and your existing identity management service. Connecting locally or remotely is just as easy.
CC6.1 - Considers Network Segmentation	Network segmentation permits unrelated portions of the entity's information system to be isolated from each other.	Teleport enables beyond corp network segmentation Connect to nodes behind Firewalls or create reverse tunnels to a proxy server
CC6.1 - Manages Points of Access	Points of access by outside entities and the types of data that flow through the points of access are identified, inventoried, and managed. The types of individuals and systems using each point of access are identified, documented, and managed.	Label Nodes to inventory and create rules Create Labels from AWS Tags Teleport maintains a live list of all nodes within a cluster. This node list can be queried by users (who see a subset they have access to) and administrators any time.
CC6.1 - Restricts Access to Information Assets	Combinations of data classification, separate data structures, port restrictions, access protocol restrictions, user identification, and digital certificates are used to establish access-control rules for information assets.	Teleport uses Certificates to grant access and create access control rules
CC6.1 - Manages Identification and Authentication	Identification and authentication requirements are established, documented, and managed for individuals and systems accessing entity information, infrastructure, and software.	Teleport makes setting policies for SSH requirements easy since it works in the cloud and on premise with the same authentication security standards.
CC6.1 - Manages Credentials for Infrastructure and Software	New internal and external infrastructure and software are registered, authorized, and documented prior to being granted access credentials and implemented on the network or access point. Credentials are removed and access is disabled when access is no longer required or the infrastructure and software are no longer in use.	Invite nodes to your cluster with short lived tokens
CC6.1 - Uses Encryption to Protect Data	The entity uses encryption to supplement other measures used to protect data at rest, when such protections are deemed appropriate based on assessed risk.	Teleport Audit logs can use DynamoDB encryption at rest.
CC6.1 - Protects Encryption Keys	Processes are in place to protect encryption keys during generation, storage, use, and destruction.	Teleport acts as a Certificate Authority to issue SSH and x509 user certificates that are signed by the CA and are (by default) short-lived. SSH host certificates are also signed by the CA and rotated automatically
CC6.2 - Controls Access Credentials to Protected Assets	Information asset access credentials are created based on an authorization from the system's asset owner or authorized custodian.	Request Approval from the command line Build Approval Workflows with Access Requests Use Plugins to send approvals to tools like Slack or Jira
CC6.2 - Removes Access to Protected Assets When Appropriate	Processes are in place to remove credential access when an individual no longer requires such access.	Teleport issues temporary credentials based on an employees role and are revoked upon job change, termination or end of a maintenance window
CC6.2 - Reviews Appropriateness of Access Credentials	The appropriateness of access credentials is reviewed on a periodic basis for unnecessary and inappropriate individuals with credentials.	Teleport maintains a live list of all nodes within a cluster. This node list can be queried by users (who see a subset they have access to) and administrators any time.
CC6.3 - Creates or Modifies Access to Protected Information Assets	Processes are in place to create or modify access to protected information assets based on authorization from the asset’s owner.	Build Approval Workflows with Access Requests to get authorization from asset owners.
CC6.3 - Removes Access to Protected Information Assets	Processes are in place to remove access to protected information assets when an individual no longer requires access.	Teleport uses temporary credentials and can be integrated with your version control system or even your HR system to revoke access with the Access requests API
CC6.3 - Uses Role-Based Access Controls	Role-based access control is utilized to support segregation of incompatible functions.	Role based access control ("RBAC") allows Teleport administrators to grant granular access permissions to users.
CC6.3 - Reviews Access Roles and Rules	The appropriateness of access roles and access rules is reviewed on a periodic basis for unnecessary and inappropriate individuals with access and access rules are modified as appropriate.	Teleport maintains a live list of all nodes within a cluster. This node list can be queried by users (who see a subset they have access to) and administrators any time.
CC6.6 - Restricts Access	The types of activities that can occur through a communication channel (for example, FTP site, router port) are restricted.	Teleport makes it easy to restrict access to common ports like 21, 22 and instead have users tunnel to the server using Teleport. Teleport uses the following default ports.
CC6.6 - Protects Identification and Authentication Credentials	Identification and authentication credentials are protected during transmission outside system boundaries.	Yes, Teleport protects credentials outside your network allowing for Zero Trust network architecture
CC6.6 - Requires Additional Authentication or Credentials	Additional authentication information or credentials are required when accessing the system from outside its boundaries.	Yes, Teleport can manage MFA with TOTP, WebAuthn or U2F Standards or connect to your Identity Provider using SAML, OAUTH or OIDC
CC6.6 - Implements Boundary Protection Systems	Boundary protection systems (for example, firewalls, demilitarized zones, and intrusion detection systems) are implemented to protect external access points from attempts and unauthorized access and are monitored to detect such attempts.	Trusted clusters
CC6.7 - Uses Encryption Technologies or Secure Communication Channels to Protect Data	Encryption technologies or secured communication channels are used to protect transmission of data and other communications beyond connectivity access points.	Teleport has strong encryption including a FedRAMP compliant FIPS mode
CC7.2 - Implements Detection Policies, Procedures, and Tools	Processes are in place to detect changes to software and configuration parameters that may be indicative of unauthorized or malicious software.	Teleport creates detailed SSH Audit Logs with Metadata Use BPF Session Recording to catch malicious program execution
CC7.2 - Designs Detection Measures	Detection measures are designed to identify anomalies that could result from actual or attempted (1) compromise of physical barriers; (2) unauthorized actions of authorized personnel; (3) use of compromised identification and authentication credentials; (4) unauthorized access from outside the system boundaries; (5) compromise of authorized external parties; and (6) implementation or connection of unauthorized hardware and software.	Use Enhanced Session Recording to catch malicious program execution, capture TCP connections and log programs accessing files on the system the should not be accessing.
CC7.3 - Communicates and Reviews Detected Security Events	Detected security events are communicated to and reviewed by the individuals responsible for the management of the security program and actions are taken, if necessary.	Use Session recording to replay and review suspicious sessions.
CC7.3 - Develops and Implements Procedures to Analyze Security Incidents	Procedures are in place to analyze security incidents and determine system impact.	Analyze detailed logs and replay recorded sessions to determine impact. See exactly what files were accessed during an incident.
CC7.4 - Contains Security Incidents	Procedures are in place to contain security incidents that actively threaten entity objectives.	Use Teleport to quickly revoke access and contain an active incident Use Shared Sessions so Multiple On-Call Engineers can collaborate and fight fires together.
CC7.4 - Ends Threats Posed by Security Incidents	Procedures are in place to mitigate the effects of ongoing security incidents.	Use Teleport to quickly revoke access and contain an active incident
CC7.4 - Obtains Understanding of Nature of Incident and Determines Containment Strategy	An understanding of the nature (for example, the method by which the incident occurred and the affected system resources) and severity of the security incident is obtained to determine the appropriate containment strategy, including (1) a determination of the appropriate response time frame, and (2) the determination and execution of the containment approach.	Use Teleport’s Session Recording and Replay along with logs to understand what actions led to an incident.
CC7.4 - Evaluates the Effectiveness of Incident Response	The design of incident-response activities is evaluated for effectiveness on a periodic basis.	Use audit logs and session recordings to find pain points in your incident response plan and improve effectiveness.
CC7.4 - Periodically Evaluates Incidents	Periodically, management reviews incidents related to security, availability, processing integrity, confidentiality, and privacy and identifies the need for system changes based on incident patterns and root causes.	Use Session recording and audit logs to find patterns that lead to incidents.
CC7.5 - Determines Root Cause of the Event	The root cause of the event is determined.	Use Session recording and audit logs to find root cause.
CC7.5 - Improves Response and Recovery Procedures	Lessons learned are analyzed and the incident-response plan and recovery procedures are improved.	Replay Session recordings at your 'after action review' or postmortem meetings