Compliance
VeraID maps its identity governance capabilities to the control requirements of major compliance frameworks, giving you a single view of your compliance posture across SOC 2, HIPAA, and PCI-DSS. Controls are tracked with status, evidence, and ownership — eliminating the spreadsheet-driven compliance workflows that consume security team bandwidth and produce unreliable results.
Supported Frameworks
| Framework | Scope | Key Requirements |
|---|---|---|
| SOC 2 Type II | Trust Service Criteria (AICPA) | Logical access controls, monitoring, change management, risk assessment |
| HIPAA | Security Rule (45 CFR 164) | Access controls, audit controls, integrity controls, transmission security |
| PCI-DSS v4.0 | Payment card data protection | Least privilege, access monitoring, credential management, logging |
VeraID does not replace your GRC (Governance, Risk, and Compliance) platform. It provides the identity-specific controls, evidence, and metrics that feed into your broader compliance program.
Compliance Categories (SOC 2)
VeraID organizes controls according to the AICPA Trust Service Criteria (TSC) Common Criteria framework used in SOC 2 engagements.
| Category | Name | VeraID Coverage |
|---|---|---|
| CC1 | Control Environment | Organization-level identity governance policies, ownership mapping |
| CC2 | Communication and Information | Audit logging, notification workflows, incident reporting |
| CC3 | Risk Assessment | Identity risk scoring, blast radius analysis, anomaly detection |
| CC4 | Monitoring Activities | Continuous monitoring, behavioral analytics, alerting |
| CC5 | Control Activities | PBAC policies, JIT access, credential rotation, MCP governance |
| CC6 | Logical and Physical Access Controls | Authentication, authorization, IP allowlisting, credential management |
| CC7 | System Operations | Operational monitoring, incident detection, automated remediation |
| CC8 | Change Management | Identity lifecycle management, policy versioning, approval workflows |
| CC9 | Risk Mitigation | Insurance of coverage, risk treatment plans, compensating controls |
Example Controls
Each compliance category contains multiple controls. Here are representative examples:
{ "controls": [ { "id": "ctrl_cc6_001", "category": "CC6", "name": "Non-Human Identity Authentication", "description": "All non-human identities authenticate using managed credentials with defined scopes, TTLs, and rotation policies", "framework": "SOC2", "status": "IMPLEMENTED", "owner": "user:security-lead@example.com", "lastReviewedAt": "2026-03-01T10:00:00Z", "nextReviewAt": "2026-06-01T10:00:00Z", "evidenceCount": 4 }, { "id": "ctrl_cc6_002", "category": "CC6", "name": "Least Privilege Enforcement", "description": "Access is granted on a least-privilege basis using PBAC policies and JIT credentials", "framework": "SOC2", "status": "IMPLEMENTED", "owner": "user:security-lead@example.com", "lastReviewedAt": "2026-03-01T10:00:00Z", "nextReviewAt": "2026-06-01T10:00:00Z", "evidenceCount": 6 }, { "id": "ctrl_cc3_001", "category": "CC3", "name": "Identity Risk Assessment", "description": "All non-human identities are continuously assessed for risk using automated scoring based on access patterns, credential age, and behavioral signals", "framework": "SOC2", "status": "IMPLEMENTED", "owner": "user:risk-manager@example.com", "lastReviewedAt": "2026-02-15T10:00:00Z", "nextReviewAt": "2026-05-15T10:00:00Z", "evidenceCount": 3 } ]}Control Status
Every compliance control is tracked through a status lifecycle that reflects its implementation maturity.
┌─────────────┐ begin ┌─────────────┐ complete ┌──────────────┐│ NOT_STARTED │─────────────►│ IN_PROGRESS │──────────────►│ IMPLEMENTED ││ │ │ │ │ │└─────────────┘ └─────────────┘ └──────┬───────┘ │ review │ finding passed │ identified │ │ ▼ ▼ ┌──────────────┐ ┌───────────────┐ │ IMPLEMENTED │ │NON_COMPLIANT │ │ (renewed) │ │ │ └──────────────┘ └──────┬────────┘ │ │ remediate ▼ ┌──────────────┐ │ NEEDS_REVIEW │ └──────────────┘| Status | Description |
|---|---|
NOT_STARTED | Control has been identified but implementation has not begun |
IN_PROGRESS | Control is being implemented. Evidence collection and testing are underway |
IMPLEMENTED | Control is fully implemented and has passed its most recent review |
NEEDS_REVIEW | Control requires re-evaluation due to remediation, environmental changes, or scheduled review |
NON_COMPLIANT | Control has failed its most recent review or a finding has been identified |
Evidence Types
Compliance controls require evidence to demonstrate implementation and effectiveness. VeraID supports six evidence types that can be attached to any control.
| Evidence Type | Description | Example |
|---|---|---|
AUDIT_LOG | Automated log records from VeraID demonstrating control operation | Authentication logs showing credential validation on every request |
SCREENSHOT | Visual evidence of control implementation | Dashboard screenshot showing active PBAC policies |
DOCUMENT | Written documentation of control design and procedures | Access control policy document, runbook, or architecture diagram |
POLICY | VeraID policy configuration demonstrating enforcement | PBAC policy JSON showing deny-by-default configuration |
TEST_RESULT | Results from control testing (manual or automated) | Penetration test report confirming credential rotation |
ATTESTATION | Signed attestation from an authorized reviewer | Quarterly access review attestation from security lead |
Attaching Evidence
curl -X POST https://app.veraid.io/api/v1/compliance/controls/{controlId}/evidence \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d '{ "type": "AUDIT_LOG", "title": "Q1 2026 Authentication Logs", "description": "Automated extraction of authentication events demonstrating credential validation for all NHI access from January through March 2026", "dateRange": { "start": "2026-01-01T00:00:00Z", "end": "2026-03-31T23:59:59Z" }, "source": "veraid-audit-log", "automated": true }'Compliance API
List Controls
Retrieve all compliance controls, optionally filtered by framework, category, or status.
# List all controlscurl https://app.veraid.io/api/v1/compliance/controls \ -H "Authorization: Bearer $API_KEY"
# Filter by framework and statuscurl -G https://app.veraid.io/api/v1/compliance/controls \ -H "Authorization: Bearer $API_KEY" \ -d "framework=SOC2" \ -d "status=NON_COMPLIANT"
# Filter by categorycurl -G https://app.veraid.io/api/v1/compliance/controls \ -H "Authorization: Bearer $API_KEY" \ -d "category=CC6"Update a Control
curl -X PUT https://app.veraid.io/api/v1/compliance/controls/{controlId} \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d '{ "status": "IMPLEMENTED", "owner": "user:security-lead@example.com", "notes": "Control fully implemented. PBAC policies enforced across all production NHIs. JIT access deployed for CI/CD identities. Evidence attached.", "nextReviewAt": "2026-06-19T10:00:00Z" }'Compliance Overview
Get a high-level compliance score and status summary across all frameworks.
curl https://app.veraid.io/api/v1/compliance/overview \ -H "Authorization: Bearer $API_KEY"{ "complianceScore": 87, "frameworks": { "SOC2": { "score": 91, "totalControls": 42, "implemented": 38, "inProgress": 2, "nonCompliant": 1, "notStarted": 1, "needsReview": 0 }, "HIPAA": { "score": 84, "totalControls": 28, "implemented": 22, "inProgress": 3, "nonCompliant": 2, "notStarted": 0, "needsReview": 1 }, "PCI_DSS": { "score": 82, "totalControls": 35, "implemented": 27, "inProgress": 4, "nonCompliant": 2, "notStarted": 1, "needsReview": 1 } }, "byCategory": { "CC1": { "score": 100, "controls": 4, "implemented": 4 }, "CC2": { "score": 100, "controls": 5, "implemented": 5 }, "CC3": { "score": 80, "controls": 5, "implemented": 4 }, "CC4": { "score": 83, "controls": 6, "implemented": 5 }, "CC5": { "score": 88, "controls": 8, "implemented": 7 }, "CC6": { "score": 90, "controls": 10, "implemented": 9 }, "CC7": { "score": 100, "controls": 3, "implemented": 3 }, "CC8": { "score": 75, "controls": 4, "implemented": 3 }, "CC9": { "score": 67, "controls": 3, "implemented": 2 } }, "lastUpdated": "2026-03-19T14:30:00Z"}The complianceScore is a weighted average across all frameworks, calculated as:
complianceScore = (implemented / totalControls) * 100Scores range from 0 (no controls implemented) to 100 (all controls implemented). Controls with NEEDS_REVIEW or IN_PROGRESS status are not counted as implemented.
Pre-Built Compliance Reports
VeraID generates framework-specific compliance reports that can be exported for auditors, board presentations, or regulatory submissions.
| Report | Description | Format |
|---|---|---|
| SOC 2 Control Matrix | Full listing of TSC controls with status, evidence, and owner for each | PDF, CSV |
| HIPAA Security Assessment | HIPAA Security Rule control mapping with gap analysis | PDF, CSV |
| PCI-DSS SAQ | Self-Assessment Questionnaire with auto-populated answers from VeraID data | |
| Access Review Summary | Aggregated results from attestation campaigns with reviewer decisions | PDF, CSV |
| Identity Risk Report | Risk scores, anomalies, and remediation status across all NHIs | PDF, CSV |
| Credential Lifecycle Report | Credential issuance, rotation, and expiration metrics | PDF, CSV |
Generate a Report
curl -X POST https://app.veraid.io/api/v1/compliance/reports \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d '{ "type": "SOC2_CONTROL_MATRIX", "format": "PDF", "dateRange": { "start": "2026-01-01T00:00:00Z", "end": "2026-03-31T23:59:59Z" }, "includeEvidence": true }'{ "reportId": "rpt_7f8a9b2c-3d4e-5f6a-b7c8-d9e0f1a2b3c4", "type": "SOC2_CONTROL_MATRIX", "status": "GENERATING", "estimatedCompletionTime": "2026-03-19T14:35:00Z", "downloadUrl": null}What’s Next
- Attestation Campaigns — Run periodic access reviews that feed into compliance evidence
- Just-In-Time Access — Implement least-privilege controls for SOC 2 CC6 and PCI-DSS 7.2
- Policy Overview — Configure PBAC policies that map to compliance requirements