Avoiding Common Pitfalls in SOC 2 & ISO 27001

Most teams walk into a SOC 2 audit expecting standard requirements for their password policy: minimum length, 90-day rotation, one uppercase letter, one symbol, and so on. But there is no such checklist. The AICPA never published a list of mandatory password rules, and the federal guidance that most auditors lean on has thrown out half of what passed for best practice a decade ago.  Beyond compliance, this is remains a crucial cybersecurity control: Stolen and brute-forced credentials still drive a large share of breaches, and password policies are the main way to mitigate this risk. This guide covers what SOC 2 expects around passwords, where those expectations come from, and how to build a policy that satisfies an auditor without making your security worse. What Are SOC 2 Password Requirements? SOC 2 password requirements are the access controls that a service organization implements to govern how passwords are created, stored, enforced, and retired, all in service of the Trust Services Criteria. The important word is controls, not rules. SOC 2 does not hand you a specification. It asks whether your controls are suitably designed and operating effectively to keep unauthorized people out of your systems.   The Role of Passwords in the SOC 2 Trust Services Criteria The Trust Services Criteria, developed by the AICPA, are the evaluation standard for every SOC 2 report. Passwords sit inside the Security category, which is mandatory in all SOC 2 engagements, and specifically inside the Common Criteria series CC6, covering logical and physical access. Passwords are one of the most basic logical access controls you have, and one of the most scrutinized, because CC6 is usually the most evidence-intensive part of the entire audit. Relevant Common Criteria: CC6.1, CC6.2, and CC6.3 CC6.1 covers the controls that restrict logical access to systems, infrastructure, and data, this is where your password policy, MFA enforcement, and account lockout settings live. CC6.2 governs how access is granted, modified, and removed, meaning your provisioning workflows, access reviews, and offboarding processes are all evaluated here. CC6.3 focuses on the removal of access when it is no longer needed and the management of privileged credentials specifically. Together, these three criteria map to the full lifecycle of a credential: creation, ongoing use, and retirement. An auditor working through CC6 will expect evidence at every stage.   Does SOC 2 Mandate Specific Password Rules? No. The AICPA is explicit that the Trust Services Criteria do not define the controls an organization must have. You identify and implement controls that meet the criteria, and the auditor evaluates them. That means there is no AICPA-mandated minimum length, no required rotation interval, and no prescribed complexity formula. What the auditor checks is whether your stated controls exist, work, and reasonably prevent unauthorized access. Insider note: Auditors rarely fail you for choosing a 10-character minimum over 12. They fail you when your written policy says one thing and your actual system configuration says another. Consistency between the policy document and the enforced setting matters far more than the specific number. Why Password Requirements Matter for SOC 2 Compliance Preventing Unauthorized Access Credentials are the front door. The 2025 Verizon DBIR found that stolen credentials remained the single most common initial access vector, appearing in 22% of breaches, and that brute force attacks against basic web applications nearly tripled year over year. Strong authentication controls are the difference between an attacker hitting a wall and an attacker walking straight in with a valid login. Reducing Data Breach Risk Weak or reused passwords feed credential stuffing, where attackers replay username and password pairs harvested from earlier breaches against your login pages. Reuse is rampant: research from Microsoft’s Digital Defense Report routinely finds that the majority of people reuse passwords across services. A single leaked password elsewhere becomes a working key to your environment unless your controls catch it. Demonstrating Logical Access Controls to Auditors SOC 2 is an attestation. It is not enough to be secure; you have to prove it with evidence. Well-designed password controls produce exactly the artifacts an auditor wants: configuration screenshots, enforcement logs, MFA reports, and access review records. Good controls and good evidence are two sides of the same coin, and an internal audit process that routinely collects this evidence makes the formal engagement significantly less stressful. Core SOC 2 Password Requirements Although SOC 2 prescribes nothing specific, a defensible password policy almost always addresses the same set of controls. These are what auditors expect to see and what your peers in compliance treat as table stakes. Minimum Password Length Length is the strongest single lever for password entropy, and modern guidance favors it over everything else. A common defensible baseline is at least 12 characters for standard user accounts, with longer requirements for service and admin accounts. NIST SP 800-63B recommends that verifiers support passwords up to 64 characters so that passphrases and password-manager output are never truncated, an important implementation detail that many teams overlook. Password Complexity and Blocklists Old-style complexity rules, one uppercase, one symbol, one number, are fading, and for good reason. They push users toward predictable substitutions without meaningfully raising entropy. The more effective control is a blocklist: screening new passwords against dictionaries of common and previously breached credentials and rejecting matches. Tools like Have I Been Pwned’s Pwned Passwords API make this straightforward to implement. This stops Password1! from sneaking through even though it technically satisfies a legacy complexity rule. Password Rotation and History Forced periodic rotation is the control most teams keep out of habit, and it is also the one that modern guidance most clearly discourages. Rotation pushes users toward predictable patterns, Spring2025 becoming Summer2025, without improving security in any measurable way. Password history settings, which prevent the immediate reuse of recent passwords, still have a place, but blind calendar-based expiry should be replaced with event-driven resets: force a change when there is evidence of compromise, not because the calendar says 90 days have passed. Account Lockout After Failed Login Attempts An account