Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
SOC 2 CC6.1 does not literally recognize only humans: its points of focus address identifying and authenticating persons, infrastructure, and software. The harder problem is whether an organization can show, in reviewable evidence, which identity an AI agent used, what authority it had, what it did, and who was accountable. ISO/IEC 27001 provides a risk-management framework for designing those controls, but the public standard information does not identify agent-specific controls.
What CC6.1 says—and what it does not
SOC 2 is an examination of a service organization’s system and controls, not a certification label. The AICPA describes the engagement as examining the fairness of management’s system description and the suitability of control design; a Type 2 examination also considers whether controls operated effectively over the specified period. Evidence therefore needs to fit the system as described and the organization’s stated objectives. A policy or inventory by itself does not establish that controls operated effectively.
CC6.1 concerns logical access security software, infrastructure, and architectures over protected information assets. Its points of focus include inventorying information assets, restricting logical access, identifying and authenticating persons, infrastructure, and software, managing access points, and managing credentials for infrastructure and software. It also addresses removing credentials and disabling access when access is no longer required or software or infrastructure is no longer in use.
The AICPA defines a system through infrastructure, software, people, processes, and data, and defines security events to include actual or attempted unauthorized access or use by internal or external parties. That system-based scope supports treating an agent as a software component with its own access path while keeping accountable human roles visible. It does not establish a universal agent checklist, nor does it mean an agent inherently violates CC6.
#1 Best Overall
Why agent evidence can be hard to review
The standards language is not the only issue. An implementation can still have an evidence gap if its identity inventory, approvals, access reviews, or logs are organized around employees and conventional service accounts but do not make an agent’s identity and delegated authority clear. That is an implementation risk, not a finding that the AICPA criteria are human-only.
For example, a record showing that an employee approved an agent’s deployment does not, on its own, show which workload identity the agent used during a run, which tools that identity could invoke, or what the run changed. Conversely, a log that records tool calls without connecting them to an identity, applicable approval or policy decision, and accountable owner may be difficult to interpret as control evidence. These examples illustrate an evidence-design concern; they are not prescribed CC6.1 fields.
A practical evidence model for agents
The following is a risk-based design recommendation derived from CC6.1’s access-control language, not a mandatory AICPA checklist. Adapt it to the organization’s system description, information assets, objectives, and policies.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
1. Inventory the agent and its execution identity
Record the agent’s owner, business purpose, environment, material model and tool components, execution identity, and human sponsor. Connect the record to the system boundary and the information assets the agent can reach. If an agent is represented as a software component or workload, identify that component and its access path rather than relying only on the name of the employee who initiated a run.
Rank #3
2. Show what authority is delegated
Document the actions the agent is permitted to take, the credentials or tokens available to it, and how permissions are scoped. State whether authority is inherited from a person or assigned to a workload identity, and identify the approvals or policy gates for higher-impact actions. Keep the agent’s identity distinct from the human sponsor’s identity so reviewers can see whose authority was used and what the sponsor authorized.
3. Preserve attributable action records
For relevant actions, retain records that can connect the initiating identity, any human approval or policy decision, target system, action, timestamp, result, and a run or correlation identifier. Protect the records against unauthorized alteration and retain them according to documented organizational policies. These fields are a practical recommendation, not a list quoted from CC6.1.
4. Review access when circumstances change
Make the review process responsive to changes in purpose, owner, model, integrations, or risk. Keep evidence that permissions and tool connections were reviewed, and show that credentials were disabled when the agent was retired or no longer needed access. CC6.1 addresses credential removal and disabling access when software or infrastructure is no longer in use; the review cadence should come from the organization’s risk assessment and policies.
Free tools Windows power users keep installed
One-click scans. No signup required.
5. Connect incidents to containment
Define how authorized responders can suspend the agent, revoke its tokens, stop tool execution, preserve relevant records, and assess whether data or systems were affected. Tie those actions to the organization’s incident process and control objectives. CC6.1 does not prescribe one particular shutdown mechanism.
Best Value
6. Keep control ownership attributable to people
Identify who approves deployment and permission changes, who reviews exceptions, and who can halt or remediate the system. Automation may carry out actions, but the organization should be able to identify the people accountable for governing those actions.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How SOC 2 and ISO/IEC 27001 differ for this problem
| Question | SOC 2 | ISO/IEC 27001 |
|---|---|---|
| What is it? | An attestation examination based on a system description and applicable Trust Services Criteria. | A requirements standard for an information security management system (ISMS). |
| How is assurance obtained? | The examination considers management’s system description and control design; Type 2 also examines operating effectiveness over a period. | Certification is optional and is performed by an accredited conformity assessment body. |
| How should agent controls be treated? | Show how relevant access controls fit the described system, objectives, and examination evidence. The criteria do not provide a universal AI-agent checklist. | Apply the ISMS’s risk-management process to agent-related risks. The public ISO material reviewed does not specify agent-specific controls. |
| Which may fit the need? | Relevant when customers or other stakeholders need a SOC report about a defined service organization’s system. | Relevant when the organization needs to establish and maintain an ISMS and may choose to seek certification. |
ISO identifies ISO/IEC 27001:2022 as the published third edition and lists Amendment 1:2024. It describes the standard as preserving confidentiality, integrity, and availability through a risk-management process. ISO calls it “the world’s best-known standard for information security management systems (ISMS)”; that is ISO’s characterization, not an independent comparative assessment. ISO Survey 2022 reported more than 70,000 certificates across 150 countries and sectors, a measure of the standard’s reach—not of AI-agent deployments or the quality of agent evidence.
What the AICPA’s AI examination guidance establishes
On September 11, 2026, the AICPA published TQA Section 9561, titled SOC Examinations: Effect of the Service Organization’s Use of AI on SOC 1 and SOC 2 Examinations. The full document is behind a free-account gate on the public landing page. The available public information establishes its publication and subject, but does not expose its detailed requirements or conclusions; it should not be cited as support for a specific auditor treatment without consulting the document itself.
What a useful evidence package should let a reviewer answer
- Which agent and execution identity were in scope, and which system components and information assets could they reach?
- What authority did the identity have, and what approvals or policy gates applied?
- Can relevant actions be traced from identity to target, result, and run record?
- Were permissions reviewed after material changes, and were obsolete credentials disabled?
- Who owns approvals, exceptions, incident response, and remediation?
Those answers help make the relationship among identity, authority, actions, and human accountability legible. Whether the evidence is sufficient depends on the system description, applicable criteria, stated objectives, and examination or certification scope; no single artifact guarantees a particular report or certification outcome.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
