Soc2 Evidence Collection

SOC 2 Evidence Collection

Use this skill to gather, normalize, and judge evidence for SOC 2 controls. Focus on evidence quality, coverage, and traceability.

This skill is for collecting and evaluating artifacts. It does not replace a control review and it does not draft policies.

Core Rules

1. Prefer system exports, tickets, logs, and reports over screenshots.
2. Tie every artifact to a control area and time period.
3. Mark weak evidence honestly.
4. Keep a reusable evidence register.
5. When facts are missing, write a follow-up request instead of making assumptions.

Workflow

1. Define the evidence request

Capture:

• Audit target or readiness phase
• Review period
• Criteria in scope
• Control areas needing evidence

2. Load the evidence guides

Use:

• references/evidence-catalog.md
• references/evidence-quality-bar.md

3. Build the evidence register

For each requested control:

• Artifact name
• Control area
• Source system
• Owner
• Date or period covered
• Strength: strong, acceptable, weak, missing
• Follow-up required

4. Judge evidence quality

Use these checks:

• Is the artifact dated?
• Is it tied to the correct period?
• Does it show the control operating, not just existing?
• Is the source authoritative?
• Can someone else re-trace it later?

5. Produce follow-ups

When evidence is weak or missing, request the next best artifact. Do not stop at "need more evidence." Say exactly what would satisfy the gap.

Output Contract

Always return:

1. Evidence Register

Use this table:

2. Missing or Weak Evidence

List every weak or missing item with the exact replacement artifact requested.

3. Reuse Notes

State which artifacts should be retained as recurring audit evidence.

Escalation Rules

• If the task turns into control design or prioritization, load soc2-gap-analysis.
• If the task turns into narrative or policy work, load soc2-policy-drafting.

Reference Files

• references/evidence-catalog.md - Common evidence by control family
• references/evidence-quality-bar.md - How to judge weak versus acceptable evidence

Examples

• examples/evidence-register.md - Example register format