How do you continuously monitor Kubernetes for SOC 2 and ISO 27001?

Read access through a kubeconfig or a cluster service account that you create and control. Screenata uses it for scheduled scans and never receives write access. You can scope it yourself and revoke it at any time.

On a schedule, with weekly cloud scans as the default cadence. Each run produces fresh findings, and evidence freshness is tracked so anything approaching staleness gets flagged before an auditor sees it.

Vera opens a ticket describing the failing configuration and re-verifies after a human applies the fix. Nothing in your cluster is changed by Screenata; the connection is read-only by construction.

First, connect the cluster read-only with a kubeconfig or a scoped service account so the scan can see your configuration without any write path. Second, let the first scan run and establish a baseline of where the cluster stands against the SOC 2 control set, instead of guessing which controls are already met. Third, fix what fails, which in most clusters means paring cluster-admin bindings back to a named few, stopping privileged containers and forcing containers to run as non-root, adding network policies so namespaces do not talk freely, moving secrets out of environment variables into mounted files, and disabling service account token auto-mount where it is not needed. Fourth, let the scheduled scans collect the passing results as signed, timestamped evidence, so you build a history over the observation window rather than a single snapshot. Fifth, hand the evidence package to an independent auditor. The audit itself is a separate engagement you contract with a CPA firm; Screenata produces the evidence, it does not issue the report.

A cluster can be operated in a compliant way, but no software is HIPAA compliant on its own, and there is no vendor BAA for Kubernetes itself because you run it. If the cluster sits on a managed service, the cloud provider's BAA covers the infrastructure underneath, not your cluster configuration or your workloads. What makes the difference is encryption of data at rest and in transit, RBAC that follows least privilege, isolation between workloads, audit logging on the API server, and evidence that all of it actually held over time rather than on the one day you looked.

Yes. Every finding is exported as a signed, timestamped artifact, a SHA-256 hash with an RSA or ECDSA signature and an RFC 3161 timestamp, that an auditor verifies outside Screenata with a free CLI. A person reviews and approves the evidence before it reaches the auditor. Screenata collects and signs it; it does not decide the audit result.