CC9.2 is asking about OAuth. Your UAR is not the answer.
SOC 2 auditors have started sampling OAuth grants under CC9.2. Teams still hand over a user-access review and a vendor PDF pile. CC6.7 is who can log in. CC9.2 is which vendors you authorized to act as you, and whether you watch them. Different credentials. Different revoke path. Different finding if you conflate them.
This is a checklist you can run before fieldwork. Educational, not an audit opinion. Pair it with the longer compliance map and, if you use a GRC tool, Vanta vs ScopeMantle.
Checklist: identification
- Dated export of third-party grants from Google Admin and/or Okta, inside the observation window.
- Primary key is client ID, not logo.
- Scopes present on every sampled row.
- Entra called out as Beta / incomplete if Microsoft users exist and you cannot see their grants.
- Filename and hash stored in GRC. Reproducible next week.
If the export predates the period start, write the baseline explanation now. Do not back-date.
Checklist: risk assessment and approval
- Written rubric for scopes vs purpose (or ScopeMantle Scope Sanity, threshold documented).
- Attestations have a human sponsor and a ninety-day expiry. Permanent exceptions fail samples.
- Below-threshold rows are either revoked or excepted. No silent leftovers.
- Breach-history process: what you do when a vendor discloses (client-ID revoke, not a Slack shrug).
Checklist: termination and monitoring
- Terminated-user sample: ten humans from HRIS, zero grants remaining. Packet separate from the twenty-vendor sample.
- Revoke timestamps exist. Disable-only tickets are not this control.
- Weekly or monthly new-install review with a distribution list you can show.
- Quarterly management review: the one-slide trend, in the minutes, one sentence on OAuth.
- Tabletop at least once in the period: hours to revoke a (fictional) client ID.
How to survive a twenty-grant sample
- Let the auditor pick from your export, or publish a selection seed (every Nth row after sort by client ID).
- For each row: name, client ID, scopes, owner, attestation or revoke, DPA yes/no.
- Do not substitute a questionnaire answer for the row. If Vanta asked "do you review vendors," that is not the sample.
- If a row is an AI extension, have the Chrome policy story ready. Admin list plus store allow-list.
CISO sign-off letters should cite the hash and the date. Legal drafts. CISO checks the file. Swapping those jobs produces a confident letter on a stale CSV.
What to say in kickoff (almost a script)
"User access is CC6.7. Third-party OAuth is CC9.2. We will give you a grant export, attestation log, one termination revoke, and last quarter's board slide. CASB does not inventory refresh tokens. Entra is labelled Beta if it is in the estate. ScopeMantle is not HIPAA attested."
Then stop talking. Let them sample.
Common fails
- Annual spreadsheet, no scopes.
- Mixing OAuth into the UAR matrix.
- Questionnaire-only GRC with no live export.
- No terminated-user grant check.
- Threshold changed the week before fieldwork, undocumented.
- Claiming CASB coverage without an IdP export.
How ScopeMantle helps (and does not)
Daily inventory, scores, attestation trail, revoke logs, board export, optional SIEM. Google and Okta GA. Entra Beta. Jira GA for tickets. ServiceNow Beta. We do not replace Vanta, your auditor, or your counsel. $5 / $6, no seat min, custom 500+, trial. No customer counts invented on customers.
What to do this week
- Produce one hashed export for the current quarter.
- Sample ten terminations yourself before the auditor does.
- Write the CC9.2 vs CC6.7 paragraph and send it to the GRC lead.
- Attach the CSV to the GRC control with a boring filename:
oauth-CC9.2-YYYY-QX.csv. - Read shadow OAuth if someone still thinks the proxy saw the token.
Two weeks before fieldwork
- Re-export. Confirm the date sits inside the window.
- Re-hash. Confirm it matches the letter draft.
- Pick your own twenty-row sample and complete the packets. Fix holes now.
- Re-run ten terminations. If leftovers appeared since last month, that is a cascade bug. See SCIM cascade.
- Print the CC9.2 vs CC6.7 paragraph. Tape it to the war-room monitor if you are that kind of team.
Evidence folder layout
/cc9.2-oauth/ inventory-YYYY-QX.csv inventory-YYYY-QX.sha256 scores-YYYY-QX.csv attestations-YYYY-QX.csv revokes-YYYY-QX.csv board-slide-YYYY-QX.pdf tabletop-notes-YYYY-MM-DD.md cover-memo-cc9.2.md /cc6.7-uar/ (do not put OAuth here)
Predictable paths survive staff turnover. Clever names do not. If you use Vanta, the same files attach there. Do not maintain a third copy in Slack.
How to handle a finding
If they find a terminated user with a grant, do not argue definitions. Revoke, attach the after export, write the management response as a cascade gap, give a date for the ITSM line item. If they find an annual spreadsheet, commit to a cadence and a hash, not to "we will look at tools." If they conflate CASB, send the data-path paragraph and move on.
Do not offer a HIPAA mapping as a consolation prize. We are not attested. Do not offer customer references we have not published.
Observation-period calendar
Day 0 of the period: hash a baseline export even if the program is ugly. Mid-period: weekly digest distribution list stays alive (bounced mail is a finding in spirit). Last month: do not change the Scope Sanity threshold without a change ticket. Fieldwork week: do not regenerate files with a new join key. If you added Okta in month four, the cover memo says so. A sudden doubling of grant count is a methodology change until you prove otherwise.
Permanent exceptions: none. Ninety-day expiry, sponsor signature, reminder at day 75 if you have the product. If you are on spreadsheets, a calendar reminder is the poor cousin. Put the sponsor's manager on the reminder. Exceptions die when only the original human is on the thread and they left.
Sample packet, one row
Client ID, display name, scopes, owner, created, last attested or revoked, DPA yes/no, ticket URL. That is the whole packet for one sampled grant. If you cannot fill it in five minutes, the control is not operational. Practice on twenty rows before the auditor picks them. The mapping guide is the clause-level companion. This page is the week-of checklist. $5 / $6, no seat min, Entra Beta, no HIPAA attestation.
Field guide: the week the auditor is in the building
Monday: confirm hashes open. Tuesday: walk CC9.2 vs CC6.7 once, then stop repeating it. Wednesday: let them pick the sample. Thursday: deliver packets the same day they pick, which is why you pre-built twenty. Friday: do not regenerate files. If they ask about CASB, send the data-path paragraph and sit down.
If a sampled row is an AI extension, have Chrome policy ready. If a sampled owner is terminated, you already failed your own pre-sample. Fix it before they fly in next year. Management response dates should be dates, not "soon."
What "complete" means in the CISO letter
Complete means this export, this hash, these IdPs, this window, these known gaps (Entra Beta, non-IdP Salesforce, warehouse keys). It does not mean the internet. Legal drafts. CISO checks the hash. $5 / $6, no seat min. Mapping. Vanta.
Mistakes I keep seeing after the first workshop
People export once and call it culture. People revoke by display name after a rebrand. People promise Entra completeness. People put OAuth rows in the user-access matrix. People send DSAR mail without a case ID. People treat a CASB invoice as grant inventory. People change a score threshold the night before audit. People staff an MSSP sprint with someone who cannot read a scope string. Each of those has a fix already on this page. The failure is skipping the fix because the demo looked polished.
Write the one thing you will not skip this week. Put it on a calendar. If you want the inventory to stay current, the 30-day trial is the productized version of the export. Five dollars per employee per month billed annually, or six dollars monthly. No seat minimum. Custom terms at 500+ employees. Microsoft Entra stays labelled Beta. HIPAA is not attested. Templates stay operator-reviewed. No fabricated customer counts on the customers page.
If you are evaluating us next to a GRC tool, keep both jobs honest. If you are evaluating us next to a consent-intercept tool, stack prevention and inventory. If you are an MSP, register the deal before the demo and keep the counsel gate in the SOW. If you are writing a board slide, use last quarter as the only benchmark we will stand behind. That is enough program for a quarter. The next quarter is whether the leftover-grant count actually moved.
Pre-sample you run yourself
Twenty grants, stratified by score if you have one. Ten terminations. One tabletop note. One board slide PDF. One cover memo. If any packet takes more than fifteen minutes to assemble, the control is still a project. Fix the project before fieldwork. Do not hope the auditor picks the pretty rows. They will not.
Known gaps belong in the letter: Entra Beta, Salesforce apps that never touched the IdP, warehouse keys. Completeness is scoped, not cosmic. $5 / $6, no seat min, HIPAA not attested. Attach the CSV to Vanta the same week if that is your GRC. Predictable filename. Hash in the ticket.
What you can do without buying anything
Export the IdP list. Deduplicate on client ID. Revoke three rows you cannot explain. Write the CC9.2 versus CC6.7 sentence for your auditor. Add OAuth grants equals zero to offboarding. Put an extension allow-list in one OU. Schedule a Friday tabletop with a fictional client ID. Hash a file and put it in GRC. Those steps do not require ScopeMantle. They do require a calendar and a human who will not skip them.
When those steps start to rot (and they will, usually by week six), the productized version is daily Google and Okta sync, scores, attestation expiry, bulk revoke, and DSAR snapshot on the same inventory. Price is public. Beta labels stay on the page. We will not invent a case study to make the last paragraph feel finished. Start the trial if the calendar is already losing.
Tape the CC9.2 versus CC6.7 paragraph somewhere visible during fieldwork week. Repeating it in every meeting wastes the room. Say it once on Tuesday. Then let them sample. Pre-built packets make Thursday boring, which is the goal.
Related reading stays on the internal paths already linked above: platform, integrations, demo, and the companion resources or blog posts for this topic. Use those links when you brief a colleague so they get the same product truth: public $5 / $6 pricing, no seat minimum, custom at 500+, Entra labelled Beta, DSAR templates operator-reviewed, no HIPAA attestation, no invented logos. That is the briefing. Everything else is the procedure you can run this week.
Start the trial from /demo when the manual export starts to rot. That is usually week six, not week one.
Two extra sentences so the page stays useful: write the decision down, then run the next export on a calendar.