How to Prepare Clients for a Surprise Compliance Audit (HIPAA, CMMC, SOC 2)

To prepare clients for a surprise compliance audit, MSPs should tag devices by framework scope, validate patch, antivirus, and encryption status, enforce policy baselines, confirm log retention, review access, and keep backup proof ready. These six tasks support audit preparation in HIPAA, SOC 2, and CMMC environments. Map the results to each client’s applicable requirements and retain the supporting evidence.

Surprise audits are common in regulated sectors because they reveal documentation gaps, inconsistent policies, and security weaknesses that scheduled reviews can miss. Managed service providers (MSPs) should build audit readiness into their routine operations throughout the year, especially when supporting HIPAA, SOC 2, and CMMC compliance.

MSPs that support defense contractors handling controlled unclassified information (CUI) should also map each task to the relevant NIST 800-171 controls.

This article walks through each task, including the commands and console steps to run and the evidence to keep.

Prefer video? Watch How to Prepare Clients for a Surprise Compliance Audit (HIPAA, CMMC, SOC 2) for more information.

Short on time? Here’s how MSPs can stay CMMC audit-ready

Preparing for audits like HIPAA, SOC 2, and CMMC takes more than manual processes. MSPs need tools that automate compliance checks and provide continuous visibility across all client environments.

The NinjaOne RMM combines endpoint management, automation, and reporting in a single platform, which helps MSPs tag in-scope devices, run compliance checks with scripts, and generate reports so audit evidence stays current across client environments.

Audit readiness checklist for MSPs

Use this checklist to quickly verify audit readiness across HIPAA, SOC 2, and CMMC environments.

Compliance requirements in 2026: what applies today

CMMC status

As of October 2026, CMMC Phase 1 is in effect, so contracts that involve controlled unclassified information (CUI) can require a Level 2 self-assessment. The Department of War suspended the Phase 2 move to mandatory third-party Level 2 certification on July 13, 2026, and a program review is underway. DFARS 252.204-7012 and NIST SP 800-171 Rev 2 still apply, so the six tasks in this checklist remain useful endpoint checks within a broader compliance program.

What CMMC means for MSPs

The CMMC rule refers to MSPs as external service providers (ESPs). An ESP that is not a cloud service provider is assessed as part of its client’s assessment scope and does not need its own CMMC certification, although it can certify voluntarily. An ESP that is a cloud service provider and handles CUI must meet FedRAMP Moderate or equivalent requirements. Confirm each client’s scope and contract requirements before you plan evidence collection.

HIPAA status

The HIPAA Security Rule update proposed in January 2025 is not final, and the current Security Rule remains in effect. The proposal would make measures such as multi-factor authentication and encryption of electronic protected health information (ePHI) at rest and in transit mandatory, so including them in your baselines now is a low-risk way to prepare.

SOC 2 status

SOC 2 is an independent attestation report against the AICPA Trust Services Criteria. A Type II report covers how controls operate over a review period, so evidence needs to cover the whole period.

Prerequisites for surprise compliance audit readiness

Before you begin, MSPs should confirm the following:

• Implementation of role-based access control based on least privilege, including enforced MFA.
• Standardized patch management, antivirus/EDR, and backup solutions.
• Proper configuration of Microsoft 365 or hybrid Active Directory environments.
• Maintained scripting capabilities (registry, CMD, and PowerShell).
• Deployment of a reliable RMM tool (such as NinjaOne) that is capable of pushing scripts, enforcing policies, and gathering compliance artifacts.

Task 1: Inventory devices by compliance scope

📌 Use Case:

Tagging devices lets MSPs filter devices in RMM tools (like NinjaOne) to quickly identify which systems fall under HIPAA, CMMC, or SOC 2 scope. Clearly defined in-scope systems are especially important for CMMC, where scope determines which systems must meet the requirements that protect CUI.

Proper device tagging also supports multi-tenant compliance management, so MSPs can apply the right checks to each client without mixing regulatory requirements.

To create compliance tags in the registry:

1. Open PowerShell as an administrator. Press the Windows key, type PowerShell, then right-click Windows PowerShell and select Run as administrator.
2. Run the following commands, but replace the “True” values with either True or False as appropriate for the endpoint’s compliance category (HIPAA, CMMC, SOC 2):

New-Item -Path “HKLM:\SOFTWARE\Org\ComplianceTags” -Force

Set-ItemProperty -Path “HKLM:\SOFTWARE\Org\ComplianceTags” -Name “HIPAA” -Value “True”

Set-ItemProperty -Path “HKLM:\SOFTWARE\Org\ComplianceTags” -Name “CMMC” -Value “True”

Set-ItemProperty -Path “HKLM:\SOFTWARE\Org\ComplianceTags” -Name “SOC2” -Value “True”

To manually verify tags:

1. Open Command Prompt as administrator. Press the Windows key + X, then select Command Prompt (Admin) or Windows Terminal (Admin). If using Windows Terminal, ensure you’re in a Command Prompt tab, not PowerShell.
2. Run the following commands:

reg query HKLM\SOFTWARE\Org\ComplianceTags

3. Alternatively, open the Registry Editor. Press the Windows key + R. Type regedit and press Enter.
4. Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Org\ComplianceTags
5. Verify that the expected compliance tag values (e.g., keys or string entries used by your organization) are present and match the configured policies. If they are missing or incorrect, the system may not be recognized as compliant during an audit.

Task 2: Validate patch, AV, and encryption status

This task verifies that systems are patched, antivirus is active, and encryption is enforced.

These checks align with NIST SP 800-171 controls and give auditors evidence that endpoints are properly secured. 

Steps

1. Open PowerShell as an administrator. Press the Windows key, type PowerShell, then right-click Windows PowerShell and select Run as administrator.

2. Check the operating system version on each in-scope device. Windows 10 reached the end of support on October 14, 2025, so devices still running it no longer receive free security updates and should be upgraded or enrolled in Extended Security Updates.

    Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, BuildNumber

3. Verify patch status for Windows Updates by running the following commands:

a. To see the last 5 installed updates:

        Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5

b. To list available updates, if the PSWindowsUpdate module is installed: 

        Get-WindowsUpdate -MicrosoftUpdate

c. To generate a readable Windows Update log from the update trace files (this command creates a log file and does not list missing updates):

        Get-WindowsUpdateLog

4. To verify AV/Defender status:

    Get-MpComputerStatus | Select AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled

5. To verify encryption (BitLocker):

    Get-BitLockerVolume | Select MountPoint, ProtectionStatus

6. The results can be exported to CSV and attached to audit prep tickets if needed.

Task 3: Enforce policy baselines

📌 Use Case:

This task applies consistent security policies across all systems, which supports audit preparation. GPOs or scripts can enforce compliance configurations, including account lockout policy, password length and complexity, auditing of object access and logon events, disabled guest accounts, and security event log retention.

For domain-joined systems (via Group Policy):

1. Open the Group Policy Management Console (GPMC).
2. Edit or create a GPO.
3. Navigate to:
   • Computer Configuration > Windows Settings > Security Settings > Account Policies
   • Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration
4. Configure password policies, account lockouts, screensaver (idle timeout enforcement) and auditing.

For standalone/non-domain systems (via Local Policy or scripts):

1. Press Windows key + R, type gpedit.msc, and press Enter to open the Local Group Policy Editor.
2. Configure the same policies locally under Security Settings.
3. If Group Policy is not available (e.g., Windows Home editions), apply registry-based scripts to enforce the same baselines.

Task 4: Validate logs, retention, and monitoring policies

This task checks that event logs are generated, retained, and not overwritten. Auditors typically expect proof of continuous monitoring, event tracking, and log retention.

To check security log status:

1. Open PowerShell as an administrator. Press the Windows key, type PowerShell, then right-click Windows PowerShell and select Run as administrator.
2. Run the following command:

Get-WinEvent -LogName Security -MaxEvents 5 | Format-List

This command queries the Windows Security event log for the 5 most recent events and sends the output to the console (screen) in a list view. The number “5” is just for reference and can be changed based on the number of events you want to see.

Running this command confirms that new events are actively being generated and recorded in the Security log. During an audit, this helps prove that log collection is functioning correctly and that logs aren’t missing or overwritten.

To check the log retention policy:

1. Open Command Prompt as administrator. Press the Windows key + X, then select Command Prompt (Admin).
2. Run the following command:

wevtutil gl Security | findstr /i “retention autoBackup

This command will show the retention status of the Windows Security Event Log:

• Retention: false means that when the log is full, the oldest events are overwritten by the newest events.
• Retention: true means that events are not overwritten when the log is full.
• autoBackup: true means that a full log is archived automatically.

Task 5: Verify access control and user tracking

This task can help MSPs document user accounts, privileged access, and RDP permissions. Documented access reviews support audit requirements for account governance, including access control and least-privilege expectations.

To check local user accounts:

1. Open Command Prompt as administrator. Press the Windows key + X, then select Command Prompt (Admin).
2. Run the following command: net user <username>

This command displays detailed information about the specified account, including:

• Username and full name
• Whether the account is active
• Password requirements (expiration, last set, change required)
• Group memberships
• Profile path and home directory
• Permitted logon hours

To list AD users with elevated rights:

1. Open PowerShell as an administrator. Press the Windows key, type PowerShell, then right-click Windows PowerShell and select Run as administrator.
2. Run the following command:

Get-ADGroupMember -Identity “Domain Admins”

This command retrieves all members of the Domain Admins group in Active Directory, which typically includes accounts with the highest level of privileges. Reviewing this list helps confirm that only authorized users have elevated rights.

Get-LocalGroupMember -Group “Remote Desktop Users”

This command displays all the accounts that belong to the Remote Desktop Users group on the local machine. Anyone in this group can remotely log in to the system through Remote Desktop Protocol (RDP). Auditors often check this list to ensure that only approved users have remote access, since excessive or unmonitored RDP permissions can create compliance and security risks.

Task 6: Document backup and recovery proof

This task records the last successful backup in the registry for automated RMM scanning, which gives auditors verifiable evidence that backup and recovery practices are enforced and monitored. Automated backup validation also supports compliance reporting for MSPs, providing evidence that auditors commonly request during HIPAA, CMMC, and SOC 2 reviews.

To create the last successful backup timestamp in the registry:

1. Open PowerShell as an administrator. Press the Windows key, type PowerShell, then right-click Windows PowerShell and select Run as administrator.

2. Run the following commands:

New-Item -Path “HKLM:\SOFTWARE\Org\ComplianceBackup” -Force

Set-ItemProperty -Path “HKLM:\SOFTWARE\Org\ComplianceBackup” -Name “LastSuccessfulBackup” -Value (Get-Date).ToString(“u”)

3. These commands create the ComplianceBackup key under HKEY_LOCAL_MACHINE and set the LastSuccessfulBackup value to the current date and time in universal format. Run the second command only as the final step of a successful backup job, so the timestamp reflects a completed backup.

4. Integrate with your RMM system:

1. Most RMMs let you define custom fields or registry scan rules.
2. Configure your RMM to read the value of HKLM:\SOFTWARE\Org\ComplianceBackup\LastSuccessfulBackup.
3. This way, the RMM can automatically track when the last successful backup was run and generate compliance evidence reports.

To verify that the last successful backup timestamp was recorded in the registry.

1. Open the Registry Editor. Press the Windows key + R. Type regedit and press Enter.
2. Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Org\ComplianceBackup
3. Confirm that the LastSuccessfulBackup value shows the correct timestamp.

In addition to registry-based tracking, RMM platforms like NinjaOne can generate detailed backup reports automatically. By applying policies, you can also define backup retention periods to support requirements with regulations such as HIPAA, CMMC, or SOC 2.

⚠️ Troubleshooting/Things to look out for

Additional considerations for surprise compliance audit preparation

Beyond the common matters to check, we recommend implementing these best practices to support compliance with various regulations. These practices are especially important for MSPs supporting clients in regulated industries such as defense and government contracting.

• DLP policies: Go beyond simply enabling Data Loss Prevention (DLP) in Microsoft 365 or on endpoints. During an audit, you may be asked to show how sensitive data is prevented from leaving the environment and how data retention and archiving rules are enforced. Be ready to demonstrate that backup systems meet required retention periods (for HIPAA, CMMC, or SOC 2) and that archived data is accessible for review.

RMM solutions like NinjaOne can simplify this step by generating detailed reports on backup status, retention settings, and endpoint compliance, giving auditors clear evidence that data is protected and retained properly.

• MFA audit: Ensure all administrators and end-user accounts use Multi-Factor Authentication (MFA), a requirement in NIST SP 800-171 (control 3.5.3) that CMMC Level 2 assesses.
• Offboarding: Confirm deactivated accounts and asset return logs exist.
• Vendor risk tracking: Maintain an updated list of third-party services with access to data (an important requirement for MSPs handling CUI under CMMC compliance for MSPs handling CUI under CMMC).
• Incident response readiness: Be prepared to explain your process for handling a compromised endpoint, including isolation, reimaging, and reporting procedures.
• Vulnerability scan results: Keep recent vulnerability scan reports for each endpoint to demonstrate proactive risk management.
• Device inventory: Maintain a complete, accurate inventory of all devices accessing organizational data.

To learn more about what NinjaOne can do, check out our FAQ on our RMM solution.

NinjaOne services for compliance audit readiness

The NinjaOne RMM supports audit preparation for HIPAA, SOC 2, and CMMC environments through device tagging, scripting, alerting, and reporting, with centralized visibility across client tenants.

• Endpoint management: Tag endpoints by compliance scope (HIPAA, CMMC, SOC 2).
• Scripting: Run regular checks for specific compliance requirements, such as encryption status and specific SaaS data, alongside built-in visibility into AV status, patching, and backups.
• Alerting: Alert on gaps in compliance coverage and agent issues.
• Reporting: Generate pre-audit and QBR reports for internal and client-facing use.

Final thoughts on preparing for surprise compliance audits

Audit readiness takes a joint effort from MSPs and clients, guaranteeing that the managed IT environment complies with industry regulations. MSPs, in particular, can implement practices such as device tagging, regular validation scripts, policy enforcement, log retention, user tracking, and backup documentation to help their clients prepare for surprise compliance audits.

Pairing these practices with an endpoint management platform like NinjaOne supports scalable audit readiness across tenants, ensuring clients are ready in case independent auditors or regulatory bodies do a surprise compliance check.

Related topics:

• HIPAA Compliance: Everything You Need to Know
• What is SOC Compliance? Basic Overview for Businesses
• What Is CMMC? Overview and Definition
• What is a Compliance Audit? Definition & Importance
• What is a Compliance Audit? Definition & Importance