READINESS

每天都能应对审计，而不只是审计那一周

大多数合规工具让你先自我声明，再把这些声明当成分数还给你。猫头鹰测试能测的部分，对测不了的，则引用你自己制度里的那一条。审计签字之后它仍在继续核查。你的分数把"已证明"和"仅凭一份文件"分开列出。把两者混在一起的数字，对你的安全状况什么都没说。

阅读文档了解另外三个

控制视图。

一项控制是怎么得出结论的：智能体跑过的检查、与之关联的证据，以及判定所依据的东西。

PassedAgent tested

The entity implements logical access security software and infrastructure over protected information assets

SOC 2Logical and Physical Access ControlsCC6.1

What must be true

Access to production systems is granted through a managed identity, is removed when that identity is removed, and cannot be obtained by any route that bypasses it.

Access control policyIdentity provider configurationAccount inventory

Why this outcome

Access Control Policy v4, line 41: single sign-on is mandatory for all production systems and local accounts are prohibited. The agent then verified that claim against the identity provider — 5 of 5 production systems are federated and no local account exists on any of them. The policy states the obligation; the test is what passes the control.

Reason code

access.sso.enforced.verified

Basis

Agent tested

Freshness

Updated 21 Aug 2026

Control details

Framework

SOC 2

Theme

Logical and Physical Access Controls

Trust criteria

Security (Common Criteria)

Catalog ref

TSC-2017 · CC6.1