SOC 2 · GCP
Fix failing SOC 2 access and logging tests in GCP
Deixic removes service account keys and owner grants nobody uses, turns on audit logging, and waits for an approver before changing access on production projects.
Tests Deixic fixes in GCP
Criteria touched: CC6.3 Access modification and least privilege, CC6.2 Provisioning and deprovisioning, CC7.2 Monitoring and logging.
Failing testWhat Deixic doesCriterion
No unused service account keysDeletes service account keys unused for 180 days.CC6.3
Offboarding revokes accessRemoves IAM bindings held by a person your HR system marks terminated.CC6.2
Audit logging enabledTurns on Admin Activity and Data Access audit logs for the project.CC7.2
What runs, what waits, what is yours
Deixic classifies every GCP action before it runs.
Runs within policy
- Delete a service account key unused for 180 days
- Enable audit logs on a project
Waits for a named approver
- Removing the Owner role on a production project
- Changing an organization-level policy
Sent to you as a decision
- Deleting a service account used in the last 180 days.
- Deleting a project.
Read back and evidence
Each change is read back from GCP, attached to the test in your compliance platform (or kept in Deixic if you have none), and the test runs again.
Deixic reads back
- The key list for each service account
- The IAM policy on each project after a binding is removed
- The audit log configuration
Your auditor gets
- Key last-used dates behind each deletion
- Before and after IAM policy
- Approver and reason for each production change