Evidence checklist
The 39-item SOC 2 evidence checklist
The full list of evidence items Attestlane tracks for SOC 2 readiness, grouped by Trust Services Category. Each item carries the control reference auditors ask for, a short description, example artifacts, and the risk level the product uses to rank remediation.
This is the live product list — if an item appears in a customer workspace, it appears here. See the provenance guide for what turns an artifact into audit-grade evidence.
Security
32 itemsThe common criteria every SOC 2 report covers.
- CC1.1High risk
Security Awareness Training
Demonstrate that employees complete security awareness training upon hire and annually thereafter.
Example evidence
- Training completion records
- Training materials/slides
- Quiz results
- CC1.2Medium risk
Code of Conduct
Maintain a code of conduct that is acknowledged by all employees.
Example evidence
- Signed code of conduct
- Employee handbook acknowledgment
- CC1.3Low risk
Organizational Chart
Document reporting structure and key security responsibilities.
Example evidence
- Org chart document
- Role descriptions with security duties
- CC1.4High risk
Background Checks
Perform background checks on employees before granting system access.
Example evidence
- Background check policy
- Completed check records (redacted)
- CC2.1Critical risk
Information Security Policy
Maintain a documented information security policy approved by management.
Example evidence
- Security policy document
- Management approval signature
- Version history
- CC2.2Medium risk
Acceptable Use Policy
Define acceptable use of company systems, devices, and data.
Example evidence
- Acceptable use policy
- Employee acknowledgment records
- CC2.3High risk
Incident Communication Procedures
Document how security incidents are communicated internally and externally.
Example evidence
- Incident response plan
- Communication templates
- Escalation matrix
- CC3.1Critical risk
Risk Assessment Process
Conduct formal risk assessments at least annually to identify threats.
Example evidence
- Risk assessment document
- Risk register
- Assessment methodology
- CC3.2High risk
Risk Treatment Plan
Document how identified risks are mitigated, accepted, transferred, or avoided.
Example evidence
- Risk treatment plan
- Mitigation actions with owners
- Risk acceptance records
- CC3.3High risk
Vendor Risk Management
Assess and monitor security risks from third-party vendors and service providers.
Example evidence
- Vendor inventory
- Vendor security questionnaires
- SOC 2 reports from vendors
- CC4.1High risk
Control Monitoring
Monitor security controls on an ongoing basis and report deficiencies.
Example evidence
- Monitoring dashboard screenshots
- Alert configurations
- Monthly review records
- CC4.2Medium risk
Internal Audit
Conduct internal audits of security controls and remediate findings.
Example evidence
- Internal audit reports
- Remediation tracking
- Audit schedule
- CC5.1High risk
Segregation of Duties
Separate critical duties so no single person controls all aspects of a key process.
Example evidence
- Duty segregation matrix
- Approval workflows
- Access role documentation
- CC5.2Critical risk
Change Approval Process
Require approval for changes to production systems before deployment.
Example evidence
- PR approval requirements
- Change management policy
- Git branch protection settings
- CC6.1Critical risk
User Access Management
Control logical access to systems through provisioning, modification, and deprovisioning.
Example evidence
- User access list
- Onboarding/offboarding procedures
- Access review records
- CC6.2Critical risk
Multi-Factor Authentication
Require MFA for all access to production systems and critical applications.
Example evidence
- MFA policy
- MFA enrollment status for all users
- Screenshots of MFA config
- CC6.3Critical risk
Encryption at Rest
Encrypt sensitive data at rest in databases, file systems, and backups.
Example evidence
- Encryption configuration screenshots
- KMS key management
- Database encryption settings
- CC6.4Critical risk
Encryption in Transit
Encrypt all data in transit using TLS 1.2+ for external and internal communications.
Example evidence
- TLS certificate records
- SSL scan results
- HSTS configuration
- CC6.5High risk
Password Policy
Enforce minimum password complexity, rotation, and secure storage requirements.
Example evidence
- Password policy document
- IdP password requirements screenshot
- Hashing algorithm documentation
- CC6.6High risk
Network Security
Implement firewalls, security groups, and network segmentation.
Example evidence
- Firewall rules
- Security group configs
- Network architecture diagram
- CC6.7Medium risk
Physical Security
Control physical access to offices and data centers (or document cloud-only posture).
Example evidence
- Cloud-only attestation
- Office access controls
- AWS/GCP physical security inheritance docs
- CC6.8High risk
Endpoint Security
Deploy endpoint protection (antivirus, EDR, disk encryption) on all employee devices.
Example evidence
- MDM enrollment list
- Disk encryption status
- Antivirus deployment records
- CC7.1High risk
Infrastructure Monitoring
Monitor system health, performance, and security events in real time.
Example evidence
- Monitoring tool dashboard
- Alert configurations
- Uptime reports
- CC7.2Critical risk
Incident Response Plan
Maintain a documented incident response plan with roles, procedures, and communication protocols.
Example evidence
- IRP document
- Incident severity classification
- Post-mortem templates
- CC7.3Critical risk
Vulnerability Management
Scan for vulnerabilities regularly and remediate findings within defined SLAs.
Example evidence
- Vulnerability scan reports
- Remediation tracking
- Patch management records
- CC7.4Critical risk
Logging and Audit Trail
Maintain audit logs for system access, changes, and security events. Retain logs for at least 90 days.
Example evidence
- Log retention configuration
- Sample audit logs
- SIEM/log aggregator setup
- CC7.5Critical risk
Backup and Recovery
Perform regular backups of critical data and test recovery procedures.
Example evidence
- Backup schedule
- Recovery test results
- RPO/RTO documentation
- CC8.1Critical risk
Change Management Policy
Document and follow a formal change management process for all production changes.
Example evidence
- Change management policy
- Sample change tickets
- Deployment pipeline config
- CC8.1High risk
Code Review Requirements
Require peer code review before merging changes to production branches.
Example evidence
- Branch protection rules
- Sample PRs with reviews
- Code review policy
- CC8.1High risk
Testing Before Deployment
Test changes in a staging environment before deploying to production.
Example evidence
- CI/CD pipeline config
- Test results
- Staging environment documentation
- CC9.1High risk
Business Continuity Plan
Maintain a business continuity plan that addresses disaster recovery and service restoration.
Example evidence
- BCP document
- DR test results
- Recovery procedures
- CC9.2Medium risk
Data Retention and Disposal
Define retention periods for data types and secure disposal procedures.
Example evidence
- Data retention policy
- Disposal procedures
- Data classification matrix
Availability
2 itemsItems that only apply when Availability is in scope.
- A1.1High risk
Uptime and SLA Commitments
Define and monitor service availability commitments to customers.
Example evidence
- SLA documentation
- Uptime monitoring reports
- Status page history
- A1.2Medium risk
Capacity Planning
Monitor resource utilization and plan for capacity needs.
Example evidence
- Resource utilization dashboards
- Scaling policies
- Capacity review records
Confidentiality
2 itemsItems for customer data that must stay disclosed only to the parties agreed.
- C1.1High risk
Data Classification
Classify data by sensitivity level and apply appropriate protections.
Example evidence
- Data classification policy
- Data inventory
- Handling procedures by classification
- C1.2Medium risk
Confidentiality Agreements
Require NDAs or confidentiality clauses with employees, contractors, and vendors.
Example evidence
- NDA templates
- Signed agreements
- Contractor confidentiality terms
Processing integrity
1 itemItems proving that data processing is complete, valid, accurate, and authorized.
- PI1.1Medium risk
Data Processing Integrity
Validate that system processing is complete, accurate, timely, and authorized.
Example evidence
- Input validation rules
- Processing error logs
- Reconciliation procedures
Privacy
2 itemsItems for personal information handling under the AICPA privacy criteria.
- P1.1High risk
Privacy Notice
Publish a privacy notice describing data collection, use, retention, and sharing.
Example evidence
- Privacy policy URL
- Cookie consent implementation
- Data processing records
- P5.1Medium risk
Data Subject Rights
Provide authenticated access to personal data (P5.1), correction (P5.2), and deletion procedures (P4.3). P5.1 is the primary mapping; review each related criterion separately.
Example evidence
- DSR request process
- Request fulfillment records
- Data export functionality