SOC 2 policies for JumpCloud teams

P03 Access Control Policy

JumpCloud is the source of truth for workforce identity. Access to applications is granted by binding SSO applications to JumpCloud user groups whose membership follows role, and automated provisioning through SCIM or JumpCloud Identity Management is enabled for every application that supports it, so that accounts are created and removed with group membership. Access granted outside a group, such as a local account inside an application, requires a documented exception.

JumpCloud administrator access follows least privilege: the Administrator with Billing role is held by no more than two named people, other administrators hold the Manager, Help Desk or Read Only role their work requires, and multi-factor authentication is required for every Admin Portal login. Every administrator role assignment is approved in a ticket and confirmed at the quarterly access review.

JumpCloud Directory Insights events are exported to the central logging tool through the Directory Insights API, and alerts fire on administrator account changes, changes to MFA or conditional access settings, user MFA resets, new SSO applications and changes to user group membership for privileged groups. The Security Owner reviews these alerts weekly and matches each one to an approved ticket.

P04 Authentication and Password Policy

Multi-factor authentication is required for the JumpCloud User Portal and for every SSO application. Administrators and engineers with production access enroll a phishing-resistant WebAuthn authenticator, either a FIDO2 security key or a platform authenticator, and other personnel use at least JumpCloud Protect push or a TOTP authenticator. The JumpCloud password policy requires at least 14 characters and locks the account after ten failed attempts.

Where the JumpCloud package includes Conditional Access, policies for the cloud provider console, source control and every application holding customer data allow sign-in only from JumpCloud-managed devices through device trust and require multi-factor authentication on every sign-in. Where the package does not include it, the same applications are limited to company devices through the endpoint management tool and the gap is recorded in the exception register.

P18 Human Resources Security Policy

The HR system drives joiner and leaver events in JumpCloud, through an HR directory integration where one is available and through the onboarding and offboarding tickets otherwise. A hire is created in JumpCloud and added to the standard user groups for the role before day one; on the last working day the leaver's JumpCloud account is suspended, which ends User Portal and SSO sign-in, the leaver is removed from every user group so that applications connected through Identity Management are deprovisioned, and any JumpCloud-managed device that is not returned receives a Lock or Erase command.

Frequently asked questions

Does JumpCloud's own security assurance cover our SOC 2?

No. Whatever independent assurance JumpCloud provides, such as a SOC 2 report or an ISO 27001 certificate, covers the controls JumpCloud operates for its own platform. Your examination covers how your company configures and uses JumpCloud: who has access, how it is authenticated, what is logged and how data in it is protected. Auditors read the vendor's assurance to decide what they can rely on, and the Vendor and Third-Party Risk Management Policy tells you to obtain it at onboarding and annually, and to send a security questionnaire where gaps remain.

What does the generator pre-fill when I arrive from this page?

The link on this page opens the generator with a preset that sets the identity provider to JumpCloud. The other answers (company, product, headcount, owners, data types, scope and review cadence) are yours to fill in. The policies render in your browser as Markdown; nothing is sent to a server and there is no signup.

Which policies change when I add JumpCloud to my answers?

3 policies name JumpCloud once it is in the intake: Access Control Policy, Authentication and Password Policy, Human Resources Security Policy. The free generator names it in scope, roles and procedures; the Audit Kit ($59 one-time) rewrites sections 4 and 5 of each policy with statements specific to how JumpCloud is configured, like the examples on this page. Refunds are available within 14 days on request.