Access Control
SOC 2 CC6.1, HIPAA 164.312(a), PCI DSS 7, NIST AC-2Least privilege access enforced for all users
CtrlLayer removes admin rights and provides app-scoped, time-limited elevation
Just-in-time privileged access with automatic revocation
JWT-based elevation grants with configurable time limits and auto-revocation
Multi-factor authentication for privileged actions
Elevation requests can require MFA verification before approval
Role-based access control (RBAC) implemented
CtrlLayer dashboard supports RBAC with tenant-scoped permissions
Privileged access requests require documented justification
Elevation requests capture user-provided justification text stored in audit log
Separation of duties for approval workflows
Configurable approval chains prevent self-approval of elevation requests
Periodic access reviews conducted
Security Master reports identify users with excessive elevation frequency for review
Emergency access procedures documented and tested
Emergency elevation mode provides break-glass access with enhanced logging
Audit and Logging
SOC 2 CC7.2, HIPAA 164.312(b), PCI DSS 10, NIST AU-2All privileged actions logged with user attribution
Every elevation request, approval, and revocation is logged with full user context
Audit logs include timestamp, user, action, and outcome
Comprehensive audit entries capture who, what, when, where, and why
Audit logs protected from tampering
Cloud-stored audit logs with immutable write and role-based read access
Log retention meets regulatory requirements
Configurable retention policies per organization with minimum 90-day default
Security events trigger real-time alerts
Blue Team correlation generates alerts for detected threat patterns
Audit reports exportable for external review
Reports exportable in standard formats for auditor review
Failed access attempts logged and monitored
Failed elevation attempts tracked and correlated with brute force detection
Encryption and Data Protection
SOC 2 CC6.7, HIPAA 164.312(a)(2)(iv), PCI DSS 3-4, NIST SC-13Data encrypted in transit (TLS 1.2+)
All agent-to-cloud communication uses TLS 1.3 encrypted WebSocket connections
Data encrypted at rest
All stored data encrypted at rest using AES-256 in cloud infrastructure
Elevation grants cryptographically secured
JWT tokens signed with RS256, scoped to application, user, and time window
Disk encryption status monitored on endpoints
Device security scoring includes BitLocker/encryption status verification
Secrets and credentials not stored in plain text
CtrlLayer does not store or vault credentials; elevation is token-based
Network Security
SOC 2 CC6.6, HIPAA 164.312(e), PCI DSS 1, NIST SC-7Network connections monitored and logged
CtrlLayer tracks all endpoint network connections with source, destination, and metadata
Firewall rules centrally managed
Centralized firewall rule management across all managed endpoints
Known malicious IPs blocked
IP blocklist management with 48,000+ threat intelligence indicators
Outbound connections analyzed for anomalies
Bandwidth analysis and connection pattern monitoring detect anomalous traffic
Network segmentation enforced
Device isolation capability enables instant quarantine of compromised endpoints
Threat intelligence integrated with network monitoring
Real-time matching of observed connections against threat intelligence feeds
Policy Management
SOC 2 CC1.1, HIPAA 164.316, PCI DSS 12, NIST PL-1Security policies documented and communicated
CtrlLayer policies are defined in the platform and enforced by the agent automatically
Policies enforced technically, not just administratively
Elevation policies are technically enforced at the agent level; no user bypass possible
Policy changes logged and attributed
All policy modifications tracked in audit log with administrator attribution
Incident response procedures defined
Device isolation, alert escalation, and emergency elevation provide IR capabilities
Risk assessment conducted regularly
Security Master provides continuous risk assessment with A-F scoring per endpoint
Third-party risk assessed
Cloud App Security scores SaaS applications for risk and compliance certification
Acceptable use policies enforced
Application elevation policies define approved and blocked applications