A SOC 2 evidence collection checklist that survives fieldwork
What to collect for each Trust Services Criteria section, in what form, and how often — organised by the thing an auditor will actually ask you to produce.
Rony Shulkin · Software Engineer
On this page
- The rule that governs everything below
- CC1 — Control environment
- CC2 — Communication and information
- CC3 — Risk assessment
- CC4 — Monitoring activities
- CC5 / CC6 — Control activities and logical access
- CC7 — System operations
- CC8 — Change management
- CC9 — Risk mitigation and vendors
- Additional categories
- A cadence you can actually keep
- Two things to do before the period starts
Most SOC 2 checklists list controls. This one lists artefacts — the files, exports and records you will be asked to hand over — because the gap that sinks audits is almost never a missing control. It is a control that worked and left nothing behind.
Assumes SOC 2 Type II against the Trust Services Criteria, Security category, with notes where the additional categories change things.
The rule that governs everything below
Every artefact needs four properties, and an artefact missing any of them is weak evidence:
- What control it answers. Not "access control" — the specific criterion.
- What population it was drawn from, and how you know that population is complete.
- When it was collected, from the system, not from memory.
- Who collected it.
A dated system export beats a screenshot every time, because a screenshot proves the state at an unknown moment. If you take a screenshot, capture the clock and the URL in the frame.
CC1 — Control environment
| Artefact | Form | Cadence |
|---|---|---|
| Org chart with reporting lines | Export or dated PDF | Quarterly |
| Board or advisory minutes covering security oversight | Signed minutes | Per meeting |
| Code of conduct, with acknowledgement records | Per-person acknowledgement with date | On hire, annually |
| Background check records | Completion confirmations, not the reports | On hire |
| Job descriptions for security-responsible roles | Current versions | Annually |
The acknowledgement records are the ones teams miss. A published code of conduct is a document; a list of who accepted it and when is evidence.
CC2 — Communication and information
| Artefact | Form | Cadence |
|---|---|---|
| Published security policies with version history | Approval trail showing who approved and when | On change |
| Evidence policies reached staff | Training completion, acknowledgements | Annually |
| Security training records | Per-person completion with dates | Annually + on hire |
| External commitments (trust page, DPAs, contract terms) | Current published versions | On change |
| Internal channel for reporting concerns | Screenshot plus a real example if you have one | Once |
CC3 — Risk assessment
| Artefact | Form | Cadence |
|---|---|---|
| Risk register with scoring and owners | Export with dates | Quarterly review |
| Risk assessment meeting records | Minutes or ticket trail | At least annually |
| Fraud risk consideration | Documented, even if brief | Annually |
| Change-driven reassessments | Records tied to the triggering change | On major change |
The register needs movement. A risk register with identical scores for twelve months reads as a document nobody used. Show items being added, rescored and closed.
CC4 — Monitoring activities
| Artefact | Form | Cadence |
|---|---|---|
| Internal control self-assessments | Dated results | Quarterly |
| Continuous monitoring results, with history | Time series, not current state | Daily/weekly |
| Deficiencies found and remediated | Ticket trail from discovery to close | As they occur |
| Prior audit findings and their remediation | Tracker with evidence of closure | Per finding |
Retention is the trap. See continuous control monitoring vs point-in-time audit — a dashboard that shows only current state produces no evidence of the period.
CC5 / CC6 — Control activities and logical access
This is the heaviest section and where most sampling happens.
| Artefact | Form | Cadence |
|---|---|---|
| Complete user listing for in-scope systems, with grant dates | System export | Quarterly |
| Access request approvals | Ticket showing approval before grant | Per grant |
| Access reviews | Reviewer, date, and the resulting removals | Quarterly |
| Termination records against access revocation | Joined HR + IdP export showing revocation timing | Per leaver |
| Privileged access listing with justification | Export | Quarterly |
| MFA enforcement configuration | Config export plus a compliance report | Quarterly |
| Password policy configuration | Config export | Annually |
| Encryption at rest and in transit | Config export, TLS scan results | Quarterly |
| Key management, including rotation | Rotation records | Per policy |
| Firewall and security group rules | Config export with change history | Quarterly |
The leavers artefact needs care: the assertion is that access was removed promptly, so the evidence has to show both the termination date and the revocation date. Two separate exports that cannot be joined do not demonstrate the interval.
CC7 — System operations
| Artefact | Form | Cadence |
|---|---|---|
| Logging configuration and continuity | Config plus proof it was never disabled | Quarterly |
| Vulnerability scan results | Full results with dates | Monthly |
| Remediation of findings, against SLA | Ticket trail with timestamps | Per finding |
| Penetration test report | Full report plus retest | Annually |
| Alert configuration and firing history | Alarm history export | Quarterly |
| Incident records | Full lifecycle: detection, triage, response, closure | Per incident |
| Incident response plan test | Tabletop record with participants | Annually |
The detail for cloud logging is in AWS CloudTrail evidence for SOC 2 CC7 controls.
If you had no incidents, say so explicitly and show the detection capability. Silence reads as a gap.
CC8 — Change management
| Artefact | Form | Cadence |
|---|---|---|
| Complete listing of production changes | CI/CD export for the whole period | Continuous |
| Peer review on sampled changes | Pull request showing reviewer and approval time | Per change |
| Branch protection configuration | Config export | Quarterly |
| Test evidence for sampled changes | CI run results | Per change |
| Emergency change records | The exception path, with retrospective approval | Per occurrence |
| Separation between author and deployer | Config or role evidence | Quarterly |
Watch squash-merges with deleted branches. The control operated; the reviewer became invisible. Check that a sampled deploy from month one is still traceable today.
CC9 — Risk mitigation and vendors
| Artefact | Form | Cadence |
|---|---|---|
| Vendor inventory with criticality tiers | Export — see choosing a questionnaire | Quarterly |
| Due diligence per vendor, proportionate to tier | Questionnaire, SOC 2, or documented rationale | On onboard, annually |
| Contracts with security and privacy terms | Executed agreements | On signing |
| Vendor review records | Dated review with outcome | Annually |
| Offboarding records | Access and data disposal confirmation | On termination |
Additional categories
Availability: capacity monitoring, backup execution and restoration testing, BCP/DR test records with results. The restoration test is the one that gets skipped — a backup nobody has restored is a hypothesis.
Confidentiality: data classification, retention schedules with evidence of execution, secure disposal records.
Processing integrity: input validation, reconciliations, error handling and correction records.
Privacy: notice, consent records, data subject request handling with timings.
A cadence you can actually keep
Continuously — configuration monitoring with retained history; change and deploy records; incident records as they occur.
Monthly — vulnerability scans and remediation status.
Quarterly — access reviews, privileged access, firewall rules, self-assessments, vendor tiering, risk register review.
Annually — penetration test, policy review, training, BCP/DR test, vendor reassessment, IR tabletop.
Once, then on change — classification, retention schedules, org structure, contracts.
Two things to do before the period starts
The mechanics of how those samples get drawn are in what auditors actually ask for.
Dry-run three controls. Write the population, generate it, pick five at random, produce the evidence. You will find a gap. Finding it now is a task; finding it in month eleven is a finding.
Make every population query repeatable. If your complete list of production access takes two days of manual joining, it will take two days again next year and be subtly different. A query beats a spreadsheet.
The controls are usually fine. It is the evidence that goes missing.