A SOC 2 audit is an evidence exercise. The auditor tests whether the controls you describe exist and, for Type II, whether they operated throughout a period. This checklist covers the evidence most auditors ask for.
SOC 2 in brief
SOC 2 is an attestation framework from the AICPA. An independent CPA firm examines your controls against the Trust Services Criteria. Security (the “common criteria”) is always in scope. Availability, Processing Integrity, Confidentiality and Privacy are optional and chosen based on what you promise customers.
- Type I reports on the design of your controls at a single point in time.
- Type II reports on whether those controls operated effectively over a period, commonly between three and twelve months. Most customers ultimately ask for Type II.
For Type II, auditors typically request a full list (the population) of events, such as every new hire or every production change in the period, then select a sample and ask for evidence for each item.
Governance and policies
- Information security policy and supporting policies, with approval dates and owners
- Evidence that employees acknowledged the policies
- Organisation chart and defined security roles
- Board or management oversight of security, such as meeting minutes
- Code of conduct
Risk management
- A documented risk assessment, performed at least annually
- Risk register with owners and treatment decisions
- Vendor inventory and vendor risk reviews, including SOC reports from critical vendors
People
- Background checks for new hires, where lawful and in policy
- Security awareness training completion records
- Onboarding records showing access was granted appropriately
- Offboarding records showing access was removed promptly
Access control
- User access reviews for production systems and key applications, with reviewer decisions
- Evidence of MFA and single sign-on configuration
- Least-privilege role definitions and admin account lists
- Password and authentication settings
Change management and development
- Pull request approvals and code review records for sampled changes
- Branch protection or deployment pipeline configuration
- Separation between development and production environments
- Testing evidence before release
Operations and monitoring
- Logging and alerting configuration
- Vulnerability scanning results and remediation tickets
- Penetration test report and follow-up
- Endpoint protection and device management evidence
- Encryption at rest and in transit
Incident response and continuity
- Incident response plan and evidence of a test or tabletop exercise
- Incident tickets and post-incident reviews for the period
- Backup configuration and a restore test
- Business continuity and disaster recovery plan
How to keep SOC 2 evidence ready
- Give every control an owner. Unowned controls are the ones that fail testing.
- Collect evidence when the work happens, not in the week before fieldwork.
- Keep versions. Auditors want the evidence that existed during the period, not a screenshot taken today.
- Record reviews. Who looked at the evidence, which version, and what they decided.
The exact evidence depends on your system description, the criteria in scope and your auditor’s approach. Always confirm the request list with your audit firm.
Where ControlQuay fits
ControlQuay is not an auditor and does not issue SOC 2 reports. When customers send you security questionnaires during or after your SOC 2 work, we answer them in 1–3 working days for CHF 490, using the evidence you have already collected. See how it works.
Published 2 October 2026 by ControlQuay. General information, not legal or audit advice.