SOC 2 · Okta
Close failing SOC 2 identity tests in Okta
Deixic reads your Okta users, groups, apps, and logs, finds the accounts that fail a test, and routes every identity policy change to a named approver.
Tests Deixic works on in Okta
Criteria touched: CC6.1 Logical access, including MFA, CC6.2 Provisioning and deprovisioning, CC7.2 Monitoring and logging.
Failing testWhat Deixic doesCriterion
MFA enforced for all usersReads each user and group and lists accounts without a second factor.CC6.1
Offboarding revokes accessMatches Okta users to HR terminations and flags accounts still active after the termination date.CC6.2
Authentication events are loggedReads the system log and keeps the sign-in records for the audit period.CC7.2
What runs, what waits, what is yours
Deixic classifies every Okta action before it runs.
Runs within policy
- Read users, groups, apps, and system logs
- Match Okta accounts to HR records
Waits for a named approver
- Any identity policy change an approver authorizes, with the approver and reason recorded
Sent to you as a decision
- Changing an authentication policy or sign-on rule, sent to your admin as a decision.
- Deactivating an account used in the last 180 days.
Read back and evidence
Each change is read back from Okta, attached to the test in your compliance platform (or kept in Deixic if you have none), and the test runs again.
Deixic reads back
- The user status and factor list after your admin acts
- The policy as it reads once changed
Your auditor gets
- The user and factor snapshot the test was judged against
- System log extracts for the audit period
- The decision, approver, and reason for each policy change