The short answer
Five of the key access control questions auditors and cyber insurers ask are: multifactor authentication, an enforced password policy, controlled credential sharing, onboarding and offboarding, and audit logs. Passing means having each control in place and being able to show proof. The table below lists what they look for and what evidence to export for each.
SOC 2 audits and insurance questionnaires ask for different things
- SOC 2 audit: An auditor tests whether your access controls are designed well and, for a Type II report, whether they operated over the review period. Expect requests for configuration screenshots, user lists and logs.
- Cyber insurance questionnaire: An insurer asks yes or no questions at application or renewal, such as "Is MFA enforced for all admin accounts?" Carriers may ask for proof, and a wrong "yes" can create problems at claim time.
Either way, the work is the same: turn the control on, then keep evidence you can hand over.
Access controls checklist: control to evidence
|
Control |
What auditors and insurers look for |
What to export as evidence |
|
Multifactor authentication |
MFA enforced on email, remote access and admin accounts. Phishing-resistant methods such as passkeys or FIDO2 are increasingly preferred. |
MFA policy settings, MFA enrollment report |
|
Password policy |
Enforced minimum length, no reuse, unique credentials per account |
Policy configuration, password health report |
|
Shared credentials |
No passwords shared in chat or spreadsheets. Access granted by role or group, and revocable. |
Shared folder and group membership report |
|
Onboarding and offboarding |
Access granted by role on day one and removed on the day someone leaves |
User and group list, offboarding log with dates |
|
Audit logs |
Admin and access activity recorded, reviewable and exportable |
Exported audit trail for the review period |
1. Multifactor authentication
MFA is the control most often named as a condition of coverage. Enforce it on email, remote access and every admin account first, then extend it to the rest. Where you can, choose phishing-resistant methods over SMS codes.
Evidence: screenshot or export of the MFA policy, plus a report showing which users are enrolled.
2. Password policy
Set and enforce minimum length and uniqueness rules instead of publishing guidance and hoping people follow it. Auditors want to see the setting, and an enforced setting is stronger evidence than a written policy.
Evidence: the policy configuration and a password health report showing weak or reused credentials being addressed.
3. Shared credentials
Shared logins are a common audit finding. Move them into shared folders with permissions assigned to groups or individuals, so you can show who has access and revoke it when roles change.
Evidence: a report of shared folders and who can access each.
4. Onboarding and offboarding
Access should follow the person's role. Connecting your password manager to your identity provider lets group membership drive access, which makes offboarding a single change instead of a checklist of apps.
Evidence: user and group lists, and a log showing access removed on the departure date.
5. Audit logs
Both auditors and insurers want to know you can see who accessed what, and that you can produce it on request. Look for logs that are exportable and can feed a SIEM.
Evidence: an exported audit trail covering the review period.
A 30-day plan
|
Week |
Focus |
|
Week 1 |
Turn on MFA for email, remote access and admin accounts. Inventory shared credentials. |
|
Week 2 |
Set and enforce the password policy. Move shared credentials into permissioned folders. |
|
Week 3 |
Connect your identity provider. Align groups to roles and test an offboarding. |
|
Week 4 |
Export the evidence for each control and store it with your audit or renewal documents. |
Does LastPass satisfy auditors and insurers?
This is the question most buyers have, so here is a direct answer. LastPass provides the controls in the table above, and the Admin Console gives you the reports to prove them. No password manager makes a business compliant on its own. It supports your answers on access controls, and your auditor or insurer decides whether the overall program meets their requirements.
|
Control |
How LastPass supports it |
|
MFA |
MFA and Advanced MFA, passkey support, and integrations with identity providers such as Microsoft Entra ID and Okta [VERIFY] |
|
Password policy |
Customizable policies in the Admin Console and password health reporting [VERIFY policy count] |
|
Shared credentials |
Shared folders with group-based or individual permissions, visibility into shared items, and revocable access |
|
Onboarding and offboarding |
Group management and automated provisioning through identity provider integration |
|
Audit logs |
Admin Console reports and audit trails that can be exported for compliance and cyber insurance needs, with SIEM integration |
For security program evidence, LastPass publishes to its Trust Center and Compliance Center. Certifications LastPass cites include ISO 27001 and SOC 2.
Which plan fits: Business Max suits teams under compliance or insurance pressure, because it adds SaaS Monitoring, SaaS Protect and Advanced MFA to credential management. Business is the option if you only need core credential and access management.
If you also need to control SaaS and AI app use
SaaS Monitoring helps admins discover which SaaS apps and AI tools employees use. SaaS Protect lets admins allow, warn or block them. This gives you a way to act on shadow IT, though it is one part of an access program and not a complete view of every app.
As AI tools are increasingly embedded into workflows, you may also need to govern who can share data with AI tools and what data can be shared. For a deeper look at AI-specific AI governance, see our guide to AI access security for SOC 2 audits.
For MSPs
If you manage IT for small businesses, use this checklist as a client readiness template. LastPass supports multi-client management for MSPs [VERIFY, link to MSP page]. Run the 30-day plan per client and keep each client's evidence export on file. For more on how password management helps MSP customers meet insurance requirements, see How Password Management Helps MSP Customers Meet Common Cyber Insurance Requirements, and for tool comparisons see 6 Best Password Managers for MSPs in 2026.
