SOC 2 Evidence Helper

SOC 2 Evidence Helper

SOC 2 audits test whether security controls exist (Type I, point in time) and operate consistently over a review period (Type II, typically 3-12 months). Engineering teams lose the most time gathering evidence reactively in the month before fieldwork - and for Type II that scramble cannot work, because auditors sample from the whole period and a gap in month two is already a finding. Build collection into normal operations instead.

Operating procedure

Step 1: Gather inputs

• Type I or Type II, and the review period dates. Default assumption: first audit is Type I, followed by a 6-month Type II.
• Which Trust Service Criteria are in scope (Security is mandatory; the rest are contract-driven). If unknown, check customer contracts and security questionnaires - scope only what customers demand.
• The systems of record: IdP (Okta, Entra), source control, CI, cloud provider, ticketing, HR system, vulnerability scanner.
• Any prior findings or bridge letters. Label unknowns as unknowns.

Step 2: Scope the criteria before collecting anything

Auditors only test criteria in scope:

• Security (CC - required): logical access, change management, risk assessment, incident response, monitoring.
• Availability (A): uptime commitments, capacity planning, backup and recovery.
• Processing Integrity (PI): complete and accurate processing, error handling.
• Confidentiality (C): data classification, encryption in transit and at rest, NDA controls.
• Privacy (P): personal data lifecycle - notice, consent, retention, deletion.

Step 3: Build the control-to-evidence map

For each in-scope criterion, name the control, the evidence artifact, the system of record, the owner, and the cadence. This table is the audit's backbone - create it in a shared doc before fieldwork. Never create artifacts that do not reflect how the system actually operates: auditors test consistency, and fabricated evidence is itself a finding.

Practitioner cadences by control family:

Step 4: Automate collection into a compliance folder

• Access reviews: scheduled IdP export to a designated, access-controlled evidence folder - not ad hoc screenshots.
• Vulnerability scans: schedule the scanner and archive full reports automatically; never run scans only when the auditor asks.
• Pen test: retain the full report including findings and retest results, not just the executive summary.
• Policy attestations: a GRC tool or a timestamped form; manual sign-off with no timestamp is not auditable.
• Encryption and infrastructure config: export IaC or config screenshots as evidence - "enabled" without proof of correct configuration is a common finding.

Step 5: Run the auditor interaction deliberately

• Provide the minimum necessary evidence - do not over-share system diagrams or design docs the control does not require.
• When a control has a gap (it was not operating for part of the period), disclose proactively with a documented remediation date. Auditors respond better to transparency than to discovering gaps in sampling.
• For Type II, maintain artifacts continuously across the whole period; auditors sample from all of it.

Worked artifact: evidence-collection table

CONTROL-TO-EVIDENCE MAP - [FILL: company] - Period: [FILL: start] to [FILL: end]

| TSC ref | Control statement                          | Evidence artifact                     | System of record | Cadence     | Owner  | Status |
|---------|--------------------------------------------|---------------------------------------|------------------|-------------|--------|--------|
| CC6.1   | Quarterly user access reviews              | IdP export + reviewer sign-off        | [FILL: Okta]     | Quarterly   | [FILL] | [FILL] |
| CC6.2   | Deprovisioning within 24h of offboarding   | Offboarding tickets w/ timestamps     | [FILL: HRIS+IdP] | Per event   | [FILL] | [FILL] |
| CC8.1   | All prod changes via reviewed PR + CI      | Branch protection config + PR sample  | [FILL: GitHub]   | Continuous  | [FILL] | [FILL] |
| CC7.1   | Monthly vuln scans, criticals fixed <15d   | Scan reports + remediation tickets    | [FILL: scanner]  | Monthly     | [FILL] | [FILL] |
| CC7.2   | Alerting on anomalous activity             | SIEM/CloudTrail config + alert sample | [FILL]           | Monthly     | [FILL] | [FILL] |
| A1.2    | Backups with tested restores               | Backup config + restore-test record   | [FILL]           | Quarterly   | [FILL] | [FILL] |
| CC7.3   | Incident response plan tested via tabletop | Plan doc + tabletop notes             | [FILL]           | Annual      | [FILL] | [FILL] |

Deliverable

Produce a control-to-evidence map covering every in-scope criterion, with artifact, system of record, owner, cadence, and status per row, plus a gap list with remediation dates for any control not yet operating.

Do NOT

• Do not collect evidence reactively before fieldwork - Type II samples the entire period.
• Do not fabricate or backdate artifacts; auditors test consistency and fabrication is itself a finding.
• Do not leave any control row ownerless - unowned controls are the ones that lapse mid-period.
• Do not hand auditors more than the control requires.
• Do not claim encryption or backups without configuration or restore-test proof.
• Do not skip the annual tabletop - an untested incident response plan is a standard finding.

Quality bar

• Every in-scope criterion has at least one mapped control with artifact, system, owner, and cadence.
• Every cadence meets or beats the table above; every automatable export is scheduled, not manual.
• Known gaps are disclosed with remediation dates before the auditor finds them.
• The four classic engineering findings are pre-empted: 24-hour deprovisioning, documented change management, configuration proof for encryption, and a tested incident response plan.

Escalation

This skill is not legal or compliance advice; the audit opinion belongs to a licensed CPA firm, and scoping questions with contractual consequences belong with counsel. Route incident writeups to postmortem-writer, vulnerability prioritization to vulnerability-triage, and secrets handling to secrets-hygiene.