How do I prove endpoint security for SOC 2 as a remote-first startup?
March 6, 20262 min readSOC 2 for Specific Tech Stacks
What Auditors Check for Endpoints
For remote-first companies, employee laptops are part of your SOC 2 scope. Auditors want proof that these devices are secured, even when they're connecting from home offices and coffee shops.
| Control | What Auditors Want |
|---|---|
| Disk encryption | FileVault (Mac) or BitLocker (Windows) enabled on all devices |
| OS updates | Automatic updates enabled, no devices running outdated OS |
| Screen lock | Auto-lock after inactivity (5-15 minutes) |
| Antivirus/malware | Endpoint protection active (Macs: built-in + MDM, Windows: Defender + MDM) |
| Password manager | Company-managed password manager deployed |
| MDM enrollment | All company devices enrolled in MDM |
MDM Options for Startups
| Tool | Platform | Starting Price | SOC 2 Fit |
|---|---|---|---|
| Kandji | Mac only | ~$500/month (25 devices) | Strong — compliance templates built in |
| Mosyle | Mac only | ~$1/device/month | Budget-friendly, good compliance dashboard |
| Jamf | Mac + iOS | ~$4/device/month | Enterprise-grade, most features |
| Microsoft Intune | Windows + Mac | Included with M365 Business | Best for Windows-heavy teams |
Evidence to Collect
From MDM Dashboard
- Device list: Screenshot showing all enrolled devices with compliance status
- Encryption status: Report showing FileVault/BitLocker enabled on all devices
- OS version: Report showing all devices on supported OS versions
- Security settings: Screenshot of MDM profile enforcing screen lock, firewall, etc.
From Your Policy
- Endpoint security policy stating requirements
- BYOD policy (if applicable) defining minimum security standards
- Onboarding process including MDM enrollment step
Without MDM (Budget Alternative)
If MDM isn't in your budget yet:
- Require employees to enable FileVault/BitLocker and submit screenshots
- Require screen lock configuration (screenshot of settings)
- Document the requirement in your security policy
- Conduct quarterly checks via screenshare or screenshots
This is less robust than MDM but can satisfy an auditor if you document the process and follow it consistently.