How to answer 'How are service accounts and machine credentials managed?' on a CAIQ
I. Reviewer Guidance & Pitfalls
Explain how API keys and machine credentials avoid hardcoding. Cite automated secret management vaults (e.g. AWS Secrets Manager, Vault) and automated key rotation intervals.
II. Example Answer Passing Enterprise Audit
Compliant Response
Sealed · IAM-07
Service credentials are stored in managed secret vaults, injected at runtime, and rotated every 90 days. Static hardcoded credentials in source code are strictly prohibited and audited via pre-commit hooks (SOC 2, CC6.1).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire drafts answers with citations pulled directly from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
No spam · No credit card · Confidential by default