1Password + SOC 2 Compliance
Looking for 1Password's own SOC 2 report? It is in 1Password's Trust Center at 1password.com/security, request via your account team (NDA required). 1Password Business is SOC 2 Type II, ISO 27001, and HIPAA BAA-eligible. This page covers something different: what your auditors will check in your 1Password setup, and where teams typically fall short.
1Password is one of the most common tools in a SOC 2 scope.
Most auditors have seen it before and know what to look for. The question is not whether it is acceptable, it is, but whether your implementation satisfies the control, or just checks the box.
This guide covers what 1Password maps to in SOC 2, what auditors actually ask for, and where teams most often fall short.
What SOC 2 Criteria 1Password Covers
1Password is primarily a CC6 control. The mapping looks like this:
| SOC 2 Criteria | What 1Password Addresses |
|---|---|
| CC6.1 | Password manager enforces strong, unique credentials per system |
| CC6.7 | Vault data is encrypted in transit and at rest |
| CC6.2 | Shared vaults provide auditable access for provisioned credentials |
| CC6.3 | Vault access can be revoked when someone leaves |
It does not replace MFA, SSO, or access review processes. It is one layer of your CC6 posture, not the whole thing.
What Auditors Actually Ask For
When 1Password appears in your control documentation, auditors typically want to verify:
-
Enforcement, not just availability. Is 1Password required, or just recommended? There is a significant difference in audit weight. If it is optional and some employees use it and others do not, that is a gap.
-
Password policy alignment. Your 1Password settings should match your documented password policy. If your policy says minimum 16 characters and MFA required, your 1Password enforced settings should reflect that.
-
Who has access to what vaults. For shared credentials (infrastructure accounts, social media, service accounts), auditors may ask to see that vault access is limited to people who need it.
-
Offboarding process. When someone leaves, their 1Password access should be removed promptly. If you use 1Password Business with SSO, this can happen automatically when the SSO account is deactivated.
-
1Password's own SOC 2 report. 1Password is a subservice organization in your audit. Auditors will ask for their SOC 2 Type II report to cover the controls they manage on your behalf.
1Password Business vs Teams
The plan you are on matters for compliance purposes.
| Feature | Teams | Business |
|---|---|---|
| SSO integration (Okta, Azure AD) | No | Yes |
| Admin activity log | Limited | Full |
| Unlock with SSO | No | Yes |
| Security dashboard | No | Yes |
| SCIM provisioning | No | Yes |
For SOC 2, 1Password Business is the right tier. The SSO integration means deprovisioning is automatic when an employee's SSO account is disabled. The admin activity log gives you auditable evidence of access changes. The security dashboard shows you which team members have weak or reused passwords.
If you are on Teams and going through a SOC 2 audit, upgrading to Business is worth doing before fieldwork starts.
Configuring 1Password for a SOC 2 Audit
These are the settings auditors look for:
Enforce 1Password use. Use your MDM or SSO provider to require 1Password enrollment as part of onboarding. Document this in your onboarding procedure.
Set minimum password length and complexity. In your 1Password Business admin console, configure the password generator defaults to match your written policy. Most policies require 16 or more characters.
Require MFA on the 1Password account itself. If someone compromises a 1Password account, they get everything. Require MFA for vault access, separate from the master password.
Enable SSO unlock. With 1Password Business, configure SSO as the unlock method. This ties vault access to your identity provider, so deprovisioning in Okta or Azure AD automatically locks the 1Password account.
Enable the activity log. The admin activity log records vault access events, user provisioning, and credential changes. This is the audit trail your auditor needs.
Review vault memberships. Audit who has access to each shared vault at least quarterly. Remove people who no longer need access. Document the review.
The Gap Most Teams Miss
Common gap
Deploying 1Password and requiring 1Password are two different things.
A common audit finding is that the organization has 1Password deployed, has a password policy that references it, but has no enforcement mechanism and no evidence that credentials are actually stored there. Some team members use it diligently. Others store passwords in browser auto-fill, Google Sheets, or Slack messages.
Auditors can probe this by asking employees directly or by reviewing whether service account credentials appear in places they should not. The risk is not just the audit finding, it is that a credential stored outside the vault is untracked, unrotated, and unknown.
The fix is enforcement: make 1Password the only approved path for credential storage, configure SSO unlock so it is the path of least resistance, and document that employees acknowledged the policy.
Evidence to Collect
| Evidence | Source |
|---|---|
| 1Password Business admin settings screenshot | 1Password admin console |
| Password policy document | Your policy library |
| SSO integration configuration | 1Password + your identity provider |
| Activity log export (sample period) | 1Password admin console |
| 1Password SOC 2 Type II report | 1Password Trust Center |
| Vault membership review sign-off | Your access review process |
Getting 1Password audit-ready means mapping its vault and access policies to your SOC 2 controls and keeping that evidence current as your team changes. If you would rather a fractional CISO owned that than track it yourself, book a call.
Related reading
Want a security leader to run this?
Xorabyte is a fractional CISO for startups who can review your cloud for the gaps found first, so a blocked deal or an audit stops being your problem to carry alone. Book a call and you will leave with a clear path, not a sales pitch.