SOC 2 evidence is the record that a control operated, and auditors collect it in two steps. First they ask for a population, the complete list of occurrences in the review period, such as every new hire, every leaver or every production change. Then they pick samples from it and ask for the evidence behind each one, such as the access request and its approval, the ticket showing access was removed, or the pull request with its review. Policies, configurations and system settings are inspected once or a few times. The evidence has to show when it was produced, because a Type 2 tests operation across the whole period.
Most of SOC 2 fieldwork is an exchange of evidence requests. Knowing what the auditor will ask for before the period starts is what lets each control leave the right record as it runs.
Populations and samples
For a control that runs many times, the auditor first asks for the population: every occurrence during the review period, exported from the system of record. They check it is complete, then pick a sample and ask for the evidence behind each item. The sample size grows with how often the control runs. For a control that runs rarely, such as an annual risk assessment, they may test every occurrence.
Evidence by control area
| Area | Population the auditor asks for | Evidence per sample or inspection |
|---|---|---|
| Onboarding | Everyone who joined during the period | Access request and approval, background check where required, signed policies, security training completion |
| Offboarding | Everyone who left during the period | Leave date and the date each account was disabled |
| Access reviews | Each scheduled review in the period | The review record: who reviewed, which accounts, what was changed, and when |
| Authentication | None; inspected | MFA and single sign-on settings, password policy configuration |
| Change management | Every production change in the period | Ticket or pull request, the review or approval, tests passed, who deployed |
| Vulnerability management | Scans and penetration tests in the period | Scan results, the pen test report, and remediation of findings within the policy's timelines |
| Logging and monitoring | Alerts and their handling | Alert configuration, examples of alerts investigated and closed |
| Incident response | Every security incident in the period | Incident record, timeline, communication, root cause and follow-up |
| Backups and recovery | Backup jobs and restore tests | Backup configuration and logs, restore test results |
| Vendor management | Vendors in scope | Risk assessment per vendor, the vendor's own SOC 2 or equivalent, and its review |
| Risk assessment | Each assessment in the period | The risk register, ratings, treatment decisions and management review |
| Governance | Management and board meetings covering security | Minutes or records showing oversight, policy approvals with dates |
| Encryption | None; inspected | Encryption settings for data at rest and in transit |
What makes evidence acceptable
- It is dated, so the auditor can tell it falls inside the period.
- It comes from the system of record, not a document written afterwards to describe what happened.
- It is complete: a population export with filters the auditor can see, not a curated list.
- It is attributable: it shows who performed or approved the action.
- It matches the control as described in the report, so the test checks what the description says.
Screenshots versus system evidence
Screenshots taken when the auditor asks work, but they show the state on the day they are taken, not during the period, and they have to be taken again for every request. Evidence collected from connected systems as controls run, with timestamps and retained for the period, answers sample requests directly and does the same job every year.
How long to keep it
Keep evidence at least until the report for the period has been issued and any follow-up questions are answered, and in line with your own retention policy. Evidence from one period is also useful when writing a bridge letter or answering a customer's questions about an exception.