A SOC 2 auditor reads your policies, but they do not grade you on them. They ask for evidence that what the policy says actually happened. "We review access quarterly" becomes "Please provide the access review records for each quarter in the period, showing who reviewed, what was found and what action was taken." If the answer is a promise, you have an exception.

This checklist organises the evidence auditors most commonly request in a SOC 2 examination, helping you prepare in advance. Requirements vary by auditor and by the criteria in scope, so treat this as a practical starting point, not an exhaustive standard.

General principles

  • Date and attribute everything. Evidence should show who, what and when.
  • Provide population and samples. Auditors often request a full list (population) of events, such as all new hires, then select samples. Be able to produce complete, accurate populations.
  • Retain evidence for the full period and until the auditor finishes.
  • Keep a consistent folder structure organised by control or criteria.
  • Align evidence with the system description so statements and proof match.

1. Governance and risk

  • Information security policies, approved and dated, with version history.
  • Evidence of annual policy review and approval by management.
  • Organisation chart and role descriptions for security responsibilities.
  • Risk assessment report and risk register, with treatment decisions.
  • Minutes of management or board meetings discussing security and risk.
  • Evidence of employee acknowledgment of policies.

2. Human resources

  • Background check records or process evidence for new hires, where applicable and lawful.
  • Signed employment agreements and confidentiality commitments.
  • Security awareness training materials and completion records for all staff, including new joiners within required timeframes.
  • Onboarding and offboarding checklists, completed for sampled employees.
  • Disciplinary process documentation.

3. Access control

  • User access policy and role definitions.
  • List of all users with access to in-scope systems, with roles.
  • Access request and approval tickets for sampled new users.
  • Termination records and system deprovisioning timestamps for sampled leavers.
  • Periodic access review records with reviewer sign-off and remediation actions.
  • Privileged access lists and reviews.
  • Multi-factor authentication configuration screenshots or exports.
  • Password and authentication configuration standards.

4. Change management and development

  • Change management policy and process.
  • Population of changes during the period, with samples showing request, review, testing and approval before deployment.
  • Code repository settings showing branch protection and required reviews.
  • Evidence of segregation of duties between development and production deployment, or compensating controls.
  • Emergency change records with retrospective approvals.
  • Secure development guidelines and evidence of code scanning where applicable.

5. Vulnerability and security testing

  • Vulnerability management policy with remediation timeframes.
  • Scan reports across the period and remediation tickets for findings.
  • Penetration test report and retest evidence.
  • Evidence of patch management for servers, endpoints and key applications.
  • Endpoint protection deployment evidence.

6. Logging, monitoring and incident response

  • Logging and monitoring configuration showing coverage of in-scope systems.
  • Alert rules, sample alerts and investigation records.
  • Log retention settings.
  • Incident response plan, including roles, escalation and communication.
  • Population of security incidents in the period, with tickets, timelines, root cause analysis and lessons learned.
  • Evidence of incident response testing or tabletop exercises.

7. Availability and resilience (if in scope)

  • Business continuity and disaster recovery plans.
  • Backup configuration and sample backup success logs.
  • Restoration test results.
  • Capacity and performance monitoring records.
  • Uptime and incident communication records.

8. Confidentiality and data handling (if in scope)

  • Data classification policy and data inventory.
  • Encryption configuration for data in transit and at rest.
  • Key management procedures.
  • Data retention and disposal policy and evidence of execution.
  • Confidentiality agreements with customers and vendors.

9. Privacy (if in scope)

  • Privacy notice and consent practices.
  • Data subject request handling process and records.
  • Data processing agreements and subprocessor lists.
  • Privacy impact assessment records where used.

10. Vendor and third-party management

  • Vendor inventory with criticality tiers.
  • Due diligence assessments for sampled vendors.
  • Contracts or security addenda with required clauses.
  • Review of vendor assurance reports, such as SOC 2 or ISO certifications, with follow-up on exceptions.
  • Periodic vendor reviews.

11. Network and infrastructure security

  • Network diagrams and firewall rules reviews.
  • Cloud configuration baselines and posture reports.
  • Evidence of secure configuration standards.
  • Remote access controls such as VPN or zero-trust configurations.
  • Physical security evidence for offices or data centres where applicable, or provider reports where relying on cloud hosts.

Tips for smooth fieldwork

  • Assign one evidence coordinator to manage requests and responses.
  • Pre-populate evidence folders by control before the audit starts.
  • Run a mock audit by sampling your own evidence for a few controls monthly.
  • Check population completeness. Auditors compare lists across sources, and missing items create credibility issues.
  • Answer precisely. Provide what is asked, clearly labelled. Overloading with irrelevant documents slows review.
  • Escalate gaps early, so they can be explained or remediated rather than discovered by the auditor.

Common evidence failures

  • Access review done but not recorded.
  • Changes deployed with approvals given verbally.
  • Training completed by most, but no record for late joiners.
  • Vendor assessments performed once at onboarding and never refreshed.
  • Incident postmortems conducted informally with no documentation.

Get the checklist

F9 Infotech offers a detailed SOC 2 evidence tracker, mapped to the Trust Services Criteria, with owner assignment and sampling guidance. Request our SOC 2 evidence checklist.

This checklist is general guidance; your audit firm's request list is authoritative for your examination.