--- title: SOC 2 Controls for Non-Human Identities: CC6, CC7, and CC8 description: A vendor guide from Teleport maps SOC 2 controls CC6.1, CC6.2, CC6.3, CC6.6, CC7.2, CC7.3, and CC8.1 to specific capabilities for securing non-human identities... canonical: https://daily.dev/posts/soc-2-controls-for-non-human-identities-cc6-cc7-and-cc8-yovugcnvs twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: SOC 2 Controls for Non-Human Identities: CC6, CC7, and CC8 | daily.dev og:description: A vendor guide from Teleport maps SOC 2 controls CC6.1, CC6.2, CC6.3, CC6.6, CC7.2, CC7.3, and CC8.1 to specific capabilities for securing non-human identities... og:url: https://daily.dev/posts/soc-2-controls-for-non-human-identities-cc6-cc7-and-cc8-yovugcnvs og:image: https://api.daily.dev/og/posts/YoVUgCnVS.png og:image:alt: SOC 2 Controls for Non-Human Identities: CC6, CC7, and CC8 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SOC 2 Controls for Non-Human Identities: CC6, CC7, and CC8 **[Teleport](https://daily.dev/sources/teleport)** · 10 min read · 0 upvotes · 0 comments ## Summary A vendor guide from Teleport maps SOC 2 controls CC6.1, CC6.2, CC6.3, CC6.6, CC7.2, CC7.3, and CC8.1 to specific capabilities for securing non-human identities such as CI/CD pipelines, AI agents, microservices, and bots. It explains workload attestation, bot registration and revocation, short-lived certificates, Sigstore signature verification, SIEM-exported audit events, and declarative/Terraform-based configuration management, detailing what evidence each control produces for auditors. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is workload attestation and how does it verify machine identities before issuing credentials? Workload attestation is a process where an agent checks properties of a requesting process, such as its Kubernetes namespace, service account, or Linux user, before issuing any credential. Administrators define access rules specifying which combinations of these properties are allowed to receive credentials, replacing static secrets with policy-driven, short-lived access rather than relying on possession of a static key. _Teams designing zero-trust access for bots and services can find related deep dives on daily.dev._ ### What is the default certificate TTL for machine identity credentials in Teleport and why does it matter? Teleport issues short-lived certificates with a default 1-hour time to live for bot and workload credentials, automatically renewing them before expiration. Because credentials expire quickly, a compromised certificate has a narrow window of usefulness, reducing the long-term exposure risk compared to static, long-lived secrets, while all communication between components uses TLS encryption. _Engineers hardening credential lifecycles against leaks can track these patterns on daily.dev._ ### How can Sigstore attestation help detect unauthorized software execution in a CI/CD pipeline? Sigstore attestation checks whether a container image was signed by a trusted party and carries valid build provenance, such as an SLSA attestation from a CI pipeline. Requests failing signature or provenance checks are denied credentials at request time, before reaching protected resources, and the denial is recorded as a structured audit event, reducing the scope of potential supply chain attacks. _Developers securing CI/CD supply chains can follow related security practices on daily.dev._ ## Similar posts on daily.dev - [With the Rise of AI Agents, SOC 2 Should Adapt or Risk Irrelevance](https://daily.dev/posts/with-the-rise-of-ai-agents-soc-2-should-adapt-or-risk-irrelevance-gpv5fkfwq) · BleepingComputer · 1 upvotes · 0 comments - [SOC 2 Type 1 and Type 2 Compliance with Aikido](https://daily.dev/posts/soc-2-type-1-and-type-2-compliance-with-aikido-yc2hwdaa7) · Aikido Security · 0 upvotes · 0 comments - [How are SOC teams empowered by Non-Human Identities](https://daily.dev/posts/how-are-soc-teams-empowered-by-non-human-identities-kfmhkoyxg) · Security Boulevard · 0 upvotes · 0 comments - [What PCI DSS 4.0 Requires for Infrastructure Identity and Access Evidence](https://daily.dev/posts/what-pci-dss-4-0-requires-for-infrastructure-identity-and-access-evidence-cupw4jsiq) · Teleport · 0 upvotes · 0 comments - [What CISOs need to get right as identity enters the agentic era](https://daily.dev/posts/what-cisos-need-to-get-right-as-identity-enters-the-agentic-era-b6wyytcb7) · CSO Online · 0 upvotes · 0 comments --- [View this post on daily.dev](https://daily.dev/posts/soc-2-controls-for-non-human-identities-cc6-cc7-and-cc8-yovugcnvs) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"SOC 2 Controls for Non-Human Identities: CC6, CC7, and CC8","url":"https://daily.dev/posts/soc-2-controls-for-non-human-identities-cc6-cc7-and-cc8-yovugcnvs","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/soc-2-controls-for-non-human-identities-cc6-cc7-and-cc8-yovugcnvs"},"datePublished":"2026-08-23T12:23:01.609Z","dateModified":"2026-08-23T12:47:32.208Z","description":"A vendor guide from Teleport maps SOC 2 controls CC6.1, CC6.2, CC6.3, CC6.6, CC7.2, CC7.3, and CC8.1 to specific capabilities for securing non-human identities...","image":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","thumbnailUrl":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/soc-2-controls-for-non-human-identities-cc6-cc7-and-cc8-yovugcnvs","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"SOC 2 Controls for Non-Human Identities: CC6, CC7, and CC8"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/soc-2-controls-for-non-human-identities-cc6-cc7-and-cc8-yovugcnvs#faq","mainEntity":[{"@type":"Question","name":"What is workload attestation and how does it verify machine identities before issuing credentials?","acceptedAnswer":{"@type":"Answer","text":"Workload attestation is a process where an agent checks properties of a requesting process, such as its Kubernetes namespace, service account, or Linux user, before issuing any credential. Administrators define access rules specifying which combinations of these properties are allowed to receive credentials, replacing static secrets with policy-driven, short-lived access rather than relying on possession of a static key. Teams designing zero-trust access for bots and services can find related deep dives on daily.dev."}},{"@type":"Question","name":"What is the default certificate TTL for machine identity credentials in Teleport and why does it matter?","acceptedAnswer":{"@type":"Answer","text":"Teleport issues short-lived certificates with a default 1-hour time to live for bot and workload credentials, automatically renewing them before expiration. Because credentials expire quickly, a compromised certificate has a narrow window of usefulness, reducing the long-term exposure risk compared to static, long-lived secrets, while all communication between components uses TLS encryption. Engineers hardening credential lifecycles against leaks can track these patterns on daily.dev."}},{"@type":"Question","name":"How can Sigstore attestation help detect unauthorized software execution in a CI/CD pipeline?","acceptedAnswer":{"@type":"Answer","text":"Sigstore attestation checks whether a container image was signed by a trusted party and carries valid build provenance, such as an SLSA attestation from a CI pipeline. Requests failing signature or provenance checks are denied credentials at request time, before reaching protected resources, and the denial is recorded as a structured audit event, reducing the scope of potential supply chain attacks. Developers securing CI/CD supply chains can follow related security practices on daily.dev."}}]} ```