Detailed Section-by-Section Evidence Requirements
A successful SOC 2 examination relies on providing concrete evidence of your controls operating effectively. Below is a breakdown of what a CPA auditor will request for each section of the checklist.
1. Access Control & Authentication
- MFA Verification: Auditors will request screenshots of configuration panels for your cloud provider (e.g., AWS IAM, Google Cloud, Azure), identity provider (e.g., Okta, JumpCloud), and source code repositories (e.g., GitHub, GitLab) showing MFA is set to "Enforced".
- Access Reviews: Maintain PDF exports or ticket logs showing that quarterly access audits were performed, identifying who reviewed the lists, what modifications were approved, and timestamps of stale accounts being removed.
- Unique Credentials: Provide a complete system user list to show no generic accounts (e.g.,
admin@company.com) have access permissions. If shared credentials are used for legacy systems, you must show documented compensatory controls like MFA or IP restrictions.
2. Change Management & Software Development
- Peer Approval Evidence: Expect auditors to select a random sample of 10 to 25 pull requests deployed during the audit period. They will verify that each PR contains at least one approval from a developer other than the author and that branch protection policies prevent merging unapproved commits.
- CI/CD Security: Provide configurations showing that branch policies prevent direct pushes to the production branch (e.g.,
mainormaster) and that only automated deployment runners have write permissions to production resources. - Pipeline Logs: Preserve build and deployment logs for every production release, proving that code passed automated security scans and test suites before deployment.
3. System Operations & Monitoring
- Logging Integrity: Show configuration showing logs are aggregated to a secure central platform (e.g., Datadog, AWS CloudWatch, Loggly) and that standard users cannot alter or purge these audit trails.
- External Scans: Keep historical reports of monthly external vulnerability scans (e.g., Nessus, AWS Inspector, Qualys) alongside evidence that vulnerabilities exceeding your risk thresholds (typically High/Critical) were remediated within policy limits (e.g., 30 days).
- Backup Testing: A common failure point is not having documentation of restore tests. Provide a log showing a database backup was successfully restored in a sandbox environment, listing the date, operator, output, and validation checks.
4. Governance & Human Resources Security
- Onboarding Files: For selected employee samples, auditors check completed background checks, signed employment contracts with NDAs, and acceptable use policies dated within the employee's first week.
- Annual Training Logs: Provide CSV logs from your training platform showing all personnel completed security training annually. The training must cover common threats like phishing and data classification.
5. Risk Management & Incident Response
- Risk Assessment Documentation: A completed annual risk register documenting business, operational, and technical risks, their calculated severity, assigned owners, and remediation strategies.
- Incident Testing Log: Produce meeting notes, tabletop scenario slides, and sign-offs proving you ran a mock incident exercise within the last 12 months.
Startup Case Study: Springfield FinTech App
Background: A 35-person SaaS startup processing credit applications needed a SOC 2 Type II report to sign their first Enterprise bank partner.
Implementation: The engineering lead enforced Okta SSO with mandatory WebAuthn MFA across all corporate and production logins. They automated the access review process by writing a script that pulls active GitHub and AWS IAM users monthly and flags discrepancies. For the SDLC, they configured GitHub branch protection to require two peer approvals, automatically rejecting commits that bypassed tests in GitHub Actions.
Audit Result: By maintaining automated trails (Terraform files proving AWS configuration, automated logs in Datadog, and background check records in Gusto), their SOC 2 Type II audit was completed in just 4 weeks with zero control exceptions.
Common Auditor Findings & How to Avoid Them
Common Gaps:
- Source Repositories Excluded: Forgetting to enforce MFA on GitHub. Auditors look closely at source repositories because code leaks could compromise customer systems.
- Informal Access Offboarding: Deactivating an employee's Slack/Email but leaving their AWS or database login active. Implement a strict de-provisioning checklist linked to HR termination events.
- No Backup Restoration Proof: Running backups daily but having no evidence that a backup has ever been successfully restored and tested. Document a restore drill annually.