Desktop recorder, download
Screenata

Integrations / Identity & access

Screenata + JumpCloud

How do you prove SOC 2, ISO 27001, and HIPAA access controls in JumpCloud?

Quick answer

JumpCloud is where logical access control is proved. It is the first thing an auditor samples under SOC 2 CC6.1, and the directory is where quarterly access reviews get their source of truth. An access control policy existing on paper is not the control. The control is the enforced directory setting plus the record that it operated for every user and every managed system across the audit period. Screenata runs 11 native checks against that configuration on a schedule and turns each result into signed evidence mapped to the control it satisfies.

Screenata connects to JumpCloud read-only and runs 11 native checks against your directory: MFA enforcement, conditional access, and device trust posture. Each finding becomes a signed, timestamped evidence artifact mapped to SOC 2, HIPAA, and ISO 27001 controls through a shared control catalog.

See how Vera works

11 native checks · read-only · signed evidence

What it proves

JumpCloud evidence, mapped to controls.

Each area below is scanned on a schedule. A finding is not a green checkmark: it is a signed artifact an auditor can verify, mapped to the exact requirement it satisfies.
Evidence area
What the checks verify
Maps to
MFA enforcement

Whether MFA is enforced for directory users and how coverage is tracked.

Proof that workforce access requires strong authentication, the first thing an auditor samples.

SOC 2CC6.1HIPAA§164.312(d)ISO 27001A.8.5
Conditional access

Conditional access policies restricting where and how users can sign in.

Findings that access is limited to the conditions your access control policy describes.

SOC 2CC6.1ISO 27001A.5.15
Device trust

Device trust requirements for access to company resources.

Proof that company data is reachable only from devices meeting the posture your policies require.

SOC 2CC6.7HIPAA§164.310(d)

Control references are the requirements each evidence area supports, via the shared control catalog. Your auditor decides sufficiency; the artifacts are theirs to verify.

Compliance checks

What Screenata checks on JumpCloud, and why each matters.

Each row is a real native check, the framework control it produces evidence for, and the risk it closes. This is what continuous JumpCloud compliance actually looks like. Checks run on a schedule; a failing check opens a ticket and re-verifies after a human applies the fix.
Check & why it matters
Maps to

MFA Enforced

Without an enforcing authentication policy that requires MFA, directory access rests on a password alone. An auditor verifies at least one enabled, non-monitor-only policy requires a second factor.

SOC 2CC6.1

Password Policy

Weak or unset password rules let users pick easily guessed credentials. Auditors confirm the org enforces a recognized strong password preset or an adequate custom policy.

SOC 2CC6.1

Conditional Access

Access with no conditions on network, device, or location cannot limit where sign-ins are allowed. An auditor checks that an enforcing authentication policy carries conditional-access conditions.

SOC 2CC6.1

Device Trust

Allowing access from unmanaged or unencrypted devices lets company data reach endpoints outside the security baseline. Auditors verify a policy requires a managed or encrypted device.

SOC 2CC6.1

JumpCloud Managed-System Inventory

An incomplete device inventory lets unmanaged or stale endpoints escape hardening and audit scope. This check enumerates every enrolled system so auditors have a system-generated asset register.

SOC 2CC6.1ISO 27001A.5.9ISO 27001A.8.9HIPAA§164.308(a)(4)

JumpCloud Sudo/OS-Admin Users

An unbounded or stale sudo roster means OS-level administrative access on managed hosts is unaccounted for. An auditor reviews the roster and flags any suspended or inactive account that still holds sudo.

SOC 2CC6.1ISO 27001A.5.15ISO 27001A.8.2HIPAA§164.308(a)(4)(ii)(B)

JumpCloud Device OS Version Report

Devices that never report an OS version are invisible to patch-currency review and can run unsupported software undetected. Auditors confirm every managed endpoint reports its current OS version.

SOC 2CC6.8ISO 27001A.8.8ISO 27001A.8.19HIPAA§164.308(a)(1)

JumpCloud Patch Policies Configured

Without a centrally managed patch policy, updates depend on end-user action and critical patches go unapplied. An auditor verifies at least one active patch-management policy exists for the fleet.

SOC 2CC6.8ISO 27001A.8.8HIPAA§164.308(a)(1)

SSH Hardening

Root or password-based SSH to production hosts is a direct path to credential-stuffing and lateral movement. Auditors confirm managed systems disallow SSH root login and password authentication and require MFA.

SOC 2CC6.1SOC 2CC6.6ISO 27001A.8.5HIPAA§164.312(a)(1)

Full-Disk Encryption Enabled

An unencrypted laptop is a reportable breach the moment it is lost or stolen. An auditor verifies every managed system reports full-disk encryption enabled.

SOC 2CC6.1SOC 2CC6.7ISO 27001A.8.24HIPAA§164.312(a)(2)(iv)

Drawn from Screenata’s JumpCloud check library. Control refs are the requirements each check produces evidence for; your auditor decides sufficiency.

How it connects

Read-only, revocable, yours.

You create a read-scoped API key and Screenata uses it for scheduled scans. Vera never receives write access to your directory, and credentials never touch the Screenata database. Findings are hashed and stored as evidence the moment they land.

Read-only by construction

OAuth scopes and IAM roles are scoped to read. Vera never gets write access to your systems.

Signed findings

SHA-256 per artifact, RSA/ECDSA signatures, RFC 3161 timestamps. Verifiable without a Screenata account.

Mapped to controls

Each finding lands on the shared control catalog, so one scan satisfies SOC 2, HIPAA, and ISO 27001 at once.

JumpCloud FAQ

What teams ask before connecting.

Full provider list on the integrations page.
What access does Screenata need to JumpCloud?

A read-scoped API key that you create and control. Screenata uses it for scheduled scans and never receives write access to your directory. You can revoke the key at any time from the JumpCloud console.

Does the JumpCloud integration feed access reviews?

Yes. Directory state from JumpCloud feeds the quarterly access reviews Vera schedules and orchestrates, with every decision left to a human reviewer, and the completed review recorded as signed evidence.

What happens when a JumpCloud check fails?

Vera opens a ticket describing the failing configuration and re-verifies after a human applies the fix. Nothing in your directory is changed by Screenata; the connection is read-only by construction.

What are the steps to implement SOC 2 with JumpCloud?

Connect JumpCloud read-only with a scoped API key. Let the first scan establish a baseline so you can see which settings already pass and which do not. Fix what fails: enable an enforcing authentication policy that requires MFA rather than monitor-only, set a strong password policy, attach conditional access conditions, require managed or encrypted devices, confirm full-disk encryption across the fleet, harden SSH so root login and password authentication are disallowed, and review any suspended account that still holds sudo. Collect the passing results as signed evidence on a schedule, so you hold coverage across the whole audit period rather than one snapshot. Then hand the evidence package to an independent auditor. The audit is a separate engagement with a CPA firm; Screenata prepares the evidence and does not issue the report.

How do you automate user access reviews?

JumpCloud supplies the authoritative list of accounts and entitlements, including the sudo roster on managed systems. The HR roster supplies who should still have them. Screenata reconciles the two, schedules the review, routes each account to the right reviewer, and records the reviewer's decision as signed evidence. The access decision stays with the human reviewer. What the automation covers is gathering, routing, chasing, and recording.

Do auditors accept evidence Screenata collects from JumpCloud?

Yes. Every finding is exported as a signed, timestamped artifact, a SHA-256 hash with an RSA or ECDSA signature and an RFC 3161 timestamp, that an auditor verifies outside Screenata with a free CLI. A person reviews and approves the evidence before it reaches the auditor. Screenata collects and signs it; it does not decide the audit result.

Connect and see

Fifteen minutes after connecting JumpCloud, you know your real posture.

Pricing

Related: Okta · OneLogin · Google Workspace · Rippling