How do I handle SOC 2 evidence for apps without SSO?
March 6, 20262 min readSOC 2 for Specific Tech Stacks
Is SSO Required for SOC 2?
No. SOC 2 requires that you control access to systems — SSO is one way to do that, but it's not the only way. Many startups pass SOC 2 without SSO by implementing other access controls that meet the same objectives.
What to Do Instead of SSO
| SSO Benefit | Alternative Control |
|---|---|
| Centralized access management | Documented access provisioning checklist per system |
| Single point of revocation | Offboarding checklist covering every system individually |
| Enforced MFA | MFA enforced per-system (Google, GitHub, AWS each separately) |
| Reduced password fatigue | Password manager requirement (1Password, Bitwarden) |
| Audit trail | Per-system audit logs + quarterly access review documentation |
Evidence to Provide
Access Provisioning
Document your process for granting access to new hires:
- List every system that needs individual account creation
- Who creates each account (CTO, team lead, IT)
- What role/permission level is assigned
- Keep a record (ticket, checklist, Notion page) for each onboarding
Access Revocation
Document your process for removing access when someone leaves:
- Checklist of every system to deactivate
- Who performs revocation and timeline (within 4 hours, within 24 hours)
- Keep a record showing the completed checklist with dates
Quarterly Access Reviews
Without SSO, access reviews are more manual but still straightforward:
- Export user lists from each system
- Verify each user is still an employee
- Verify their access level is appropriate
- Document the review
MFA Enforcement
Screenshot MFA settings in each system individually:
- Google Workspace: enforced for all users
- GitHub: organization-level 2FA requirement
- AWS: IAM policy requiring MFA for console access
- Application: if your app has MFA, show enforcement settings
Planning for SSO
If enterprise customers require SSO as part of their security reviews, plan to add it. But for your initial SOC 2 audit, compensating controls are sufficient. Many startups add SSO post-audit when they have budget and customer demand.