SOC 2 for Specific Tech Stacks
How do I prove endpoint security for SOC 2 as a remote-first startup?
November 23, 20251 min read
What Auditors Check for Endpoints
For remote-first companies, employee laptops are part of your SOC 2 scope. Auditors want proof that these devices are secured, even when they're connecting from home offices and coffee shops.
| Control | What Auditors Want |
|---|---|
| Disk encryption | FileVault (Mac) or BitLocker (Windows) enabled on all devices |
| OS updates | Automatic updates enabled, no devices running outdated OS |
| Screen lock | Auto-lock after inactivity (5-15 minutes) |
| Antivirus/malware | Endpoint protection active (Macs: built-in + MDM, Windows: Defender + MDM) |
| Password manager | Company-managed password manager deployed |
| MDM enrollment | All company devices enrolled in MDM |
MDM Options for Startups
Evidence to Collect
From MDM Dashboard
- Device list: Screenshot showing all enrolled devices with compliance status
- Encryption status: Report showing FileVault/BitLocker enabled on all devices
- OS version: Report showing all devices on supported OS versions
- Security settings: Screenshot of MDM profile enforcing screen lock, firewall, etc.
From Your Policy
- Endpoint security policy stating requirements
- BYOD policy (if applicable) defining minimum security standards
- Onboarding process including MDM enrollment step
Without MDM (Budget Alternative)
If MDM isn't in your budget yet:
- Require employees to enable FileVault/BitLocker and submit screenshots
- Require screen lock configuration (screenshot of settings)
- Document the requirement in your security policy
- Conduct quarterly checks via screenshare or screenshots
This is less robust than MDM but can satisfy an auditor if you document the process and follow it consistently.