Does Okta's SOC 2 report cover our own SOC 2?

No. Okta's own SOC 2 report covers the controls Okta operates for its platform. Your examination covers how your company configures and uses Okta: who has access, how it is authenticated, what is logged and how data in it is protected. Auditors read the vendor's report to decide what they can rely on, and the Vendor and Third-Party Risk Management Policy tells you to collect it at onboarding and annually.

What does the generator pre-fill when I arrive from this page?

The link on this page opens the generator with a preset that sets the identity provider to Okta. The other answers (company, product, headcount, owners, data types, scope and review cadence) are yours to fill in. The policies render in your browser as Markdown; nothing is sent to a server and there is no signup.

Which policies change when I add Okta to my answers?

3 policies name Okta once it is in the intake: Access Control Policy, Authentication and Password Policy, Human Resources Security Policy. The free generator names it in scope, roles and procedures; the Audit Kit ($39 one-time) rewrites sections 4 and 5 of each policy with statements specific to how Okta is configured, like the examples on this page. Refunds are available within 14 days on request.

SOC 2 policies for Okta teams

Name: Policyseed
Author: Policyseed

Okta is the system of record for who works at your company, so it appears in the policies about access provisioning, authentication and multi-factor enforcement, and the joiner, mover and leaver steps in HR security.

Identity providers · Referenced by 3 of 22 policies · Generator preset available

The 3 policies that reference Okta

With Okta in your intake, these policies name it in their scope, roles and procedures. The other 19 policies in the set apply to your company regardless of tooling; the template index lists all 22.

P03 Access Control Policy: Defines how access to systems and data is requested, approved, provisioned, reviewed and removed.
P04 Authentication and Password Policy: Sets the requirements for passwords, multi-factor authentication, sessions and secrets used by people and systems.
P18 Human Resources Security Policy: Sets the security requirements that apply to people before, during and after their engagement so that screening, access, training and accountability follow every personnel change.

What the Audit Kit writes for Okta

The free generator fills in names. The Audit Kit goes further: Claude rewrites section 4 (Policy Statements) and section 5 (Procedures) of each policy using your full intake, so the text describes Okta the way you actually run it. The statements below are examples of that output for Okta; your own answers produce different text, and every statement should be checked against your configuration before management adopts it.

P03 Access Control Policy

Okta is the source of truth for workforce identity. Every application is assigned to Okta groups, group rules assign the standard groups for a role from the department and title attributes, and SCIM provisioning is enabled for every application that supports it so that access is created and removed automatically. Assigning an application directly to a person requires a documented exception.

Okta administrator privileges follow least privilege: the Super Administrator role is limited to two named accounts and one emergency account, Help Desk, Group and Application administrators use the standard scoped roles or custom admin roles bound to resource sets, and every administrator role assignment raises an alert that is matched to a ticket.

The Okta System Log is streamed to the central logging tool through Okta Log Streaming, and alerts fire on administrator role grants, authentication policy and global session policy changes, new API tokens, MFA factor resets and sign-ins from new countries. The Security Owner reviews these alerts weekly.

P04 Authentication and Password Policy

The Okta global session policy requires multi-factor authentication for every sign-in and limits sessions to twelve hours with a two-hour idle timeout. Authentication policies for the Okta Admin Console, the cloud provider, source control and any application holding customer data require a phishing-resistant factor, either Okta FastPass with hardware-protected keys or a FIDO2 WebAuthn authenticator, and SMS, voice and email one-time codes are disabled in the authenticator enrolment policy.

Okta device assurance policies deny access to production applications from devices that are not enrolled in the endpoint management tool, have disk encryption turned off or run an operating system below the minimum version. The Okta password policy requires at least 14 characters, locks the account after ten failed attempts and rejects passwords caught by the common password check.

P18 Human Resources Security Policy

The HR system is the upstream source for Okta through HR-driven provisioning: a hire creates the Okta user and standard groups before day one, a title or department change re-evaluates group rules, and a termination deactivates the Okta user at the end of the last working day, which ends every session and deprovisions each SCIM-connected application.

How to use this page

Open the generator with the Okta preset and answer the remaining questions: company, product, headcount, other tools, data types, owners, scope and review cadence.
Download the 22 policies as Markdown. Read the sections that mention Okta with the admin console open and fix anything that is not true of your setup.
Optionally buy the Audit Kit to have sections 4 and 5 tailored to Okta and the rest of your stack, and to get Word documents, the TSC crosswalk, an evidence checklist, acknowledgment forms and a review calendar in one ZIP built on your machine.
Have management approve the policies, collect acknowledgments, and start producing the evidence the procedures describe. The CPA firm performs the examination.

Other tools

Cloud platforms: AWS, Google Cloud, Microsoft Azure, Vercel, Cloudflare

Source control and CI: GitHub, GitLab

Identity providers: Google Workspace, Microsoft 365

Vendors and subprocessors: Supabase, Clerk

Frequently asked questions

Does Okta's SOC 2 report cover our own SOC 2?: No. Okta's own SOC 2 report covers the controls Okta operates for its platform. Your examination covers how your company configures and uses Okta: who has access, how it is authenticated, what is logged and how data in it is protected. Auditors read the vendor's report to decide what they can rely on, and the Vendor and Third-Party Risk Management Policy tells you to collect it at onboarding and annually.
What does the generator pre-fill when I arrive from this page?: The link on this page opens the generator with a preset that sets the identity provider to Okta. The other answers (company, product, headcount, owners, data types, scope and review cadence) are yours to fill in. The policies render in your browser as Markdown; nothing is sent to a server and there is no signup.
Which policies change when I add Okta to my answers?: 3 policies name Okta once it is in the intake: Access Control Policy, Authentication and Password Policy, Human Resources Security Policy. The free generator names it in scope, roles and procedures; the Audit Kit ($39 one-time) rewrites sections 4 and 5 of each policy with statements specific to how Okta is configured, like the examples on this page. Refunds are available within 14 days on request.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.