SOC 2 Evidence Collection: What Auditors Actually Want | Osto<\/title>\n<meta name=\"description\" content=\"A practical guide to SOC 2 evidence collection. What counts as evidence, how Type I and Type II differ, how auditors sample, what they want by control area, and how to collect it well.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n<\/style>\n<\/head>\n<body>\n\n<div class=\"wrap\">\n <p class=\"dek\">SOC 2 evidence is what turns strong security into a passing audit. Strong security alone does not pass; provable security does. This is how to collect the evidence that proves it.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span>\n <span class=\"dot\"><\/span>\n <span>8 min read<\/span>\n <span class=\"dot\"><\/span>\n <span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>Evidence is the proof that each of your controls actually operated. Auditors do not take your word for it. They sample dated artifacts, access reviews, change tickets, logs, and verify the control ran.<\/p>\n <p>The teams that pass cleanly are the ones whose evidence is collected continuously, indexed by Trust Services Criteria, and retrievable in minutes, not reconstructed the week before fieldwork.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">What counts as evidence<\/a><\/li>\n <li><a href=\"#types\">Type I vs Type II evidence<\/a><\/li>\n <li><a href=\"#sample\">How auditors sample<\/a><\/li>\n <li><a href=\"#byarea\">What they want, by area<\/a><\/li>\n <li><a href=\"#collect\">How to collect it well<\/a><\/li>\n <li><a href=\"#mistake\">The mistake that sinks audits<\/a><\/li>\n <li><a href=\"#osto\">Evidence that collects itself<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">What counts as SOC 2 evidence<\/h2>\n <p>SOC 2 evidence is any objective artifact that shows a control exists and operated as described. Policies say what you intend to do; evidence proves you did it.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">The hard truth good teams miss<\/div>Companies with genuinely strong security fail SOC 2 audits all the time. Not because their controls are weak, but because they cannot produce the dated, retrievable proof that those controls ran.<\/div>\n\n <p>The details matter to an auditor. Logs should carry timestamps and user identifiers. Tickets should show approvals, dates, and outcomes. Attestations must be signed and dated.<\/p>\n\n <h2 class=\"sec\" id=\"types\">Type I vs Type II: two different evidence jobs<\/h2>\n <p>How much evidence you need, and of what kind, depends entirely on which report you are pursuing.<\/p>\n\n <div class=\"keyrow\">\n <div class=\"k1\"><div class=\"lab\">Type I evidence<\/div><div class=\"big\">Collected once<\/div><div class=\"sm\">Proves controls are properly designed as of a single date. Mostly policies, procedures, and limited samples showing the control exists. It does not need to show continuous operation, which is why Type I can be done in weeks.<\/div><\/div>\n <div class=\"k2\"><div class=\"lab\">Type II evidence<\/div><div class=\"big\">Collected continuously<\/div><div class=\"sm\">Proves controls operated effectively across an observation window, usually 3 to 12 months. Evidence must cover the entire period, week after week, not a single snapshot.<\/div><\/div>\n <\/div>\n\n <div class=\"bbox indigo\"><div class=\"bt\">The crux<\/div>Type II is not a bigger Type I. It is a different job. Type I asks “is this control designed correctly today?” Type II asks “did this control run correctly every week for months?”<\/div>\n\n <h2 class=\"sec\" id=\"sample\">How auditors sample evidence<\/h2>\n <p>Auditors do not inspect every event. For a <a href=\"https:\/\/www.osto.one\/resources\/soc-2-type-1-vs-type-2\">Type II<\/a> they use population sampling: they ask for the full population of something, then test a representative sample from it.<\/p>\n\n <div class=\"sampleflow\">\n <div class=\"sf a\"><div class=\"t\">Full population<\/div><div class=\"d\">every change ticket in the window<\/div><\/div>\n <div class=\"sarr\">→<\/div>\n <div class=\"sf b\"><div class=\"t\">Representative sample<\/div><div class=\"d\">the auditor tests a subset<\/div><\/div>\n <div class=\"sarr\">→<\/div>\n <div class=\"sf c\"><div class=\"t\">A miss becomes an exception<\/div><div class=\"d\">a gap in the sample lands in the report<\/div><\/div>\n <\/div>\n\n <div class=\"bbox navy\"><div class=\"bt\">What this means for you<\/div>Because the auditor tests a sample from the whole window, one missed month can surface as an exception. A control that ran eleven times out of twelve still failed the twelfth. The takeaway is practical: your evidence has to be complete and consistent for every control, across the entire period, which is exactly why it helps to know what auditors look for in each area.<\/div>\n\n <h2 class=\"sec\" id=\"byarea\">What auditors want, by control area<\/h2>\n <p>Auditors organise their SOC 2 evidence requests around the <a href=\"https:\/\/www.osto.one\/resources\/soc-2-controls-cc1-cc9\">Common Criteria<\/a>. Indexing your evidence the same way, by criterion, makes fieldwork dramatically faster.<\/p>\n\n <div class=\"checkgrid\">\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">A<\/span><h4>Access (CC6)<\/h4><\/div><ul><li>Access reviews with sign-offs<\/li><li>MFA configuration proof<\/li><li>Deprovisioning records for leavers<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">B<\/span><h4>Operations (CC7)<\/h4><\/div><ul><li>Monitoring and alert logs<\/li><li>Vulnerability scan results<\/li><li>Incident records, including tests<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">C<\/span><h4>Change (CC8)<\/h4><\/div><ul><li>Change tickets with approvals<\/li><li>Dates and outcomes recorded<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">D<\/span><h4>Governance & vendors<\/h4><\/div><ul><li>Risk assessment, signed<\/li><li>Vendor assessment files<\/li><li>Training completion logs<\/li><\/ul><\/div>\n <\/div>\n\n <h2 class=\"sec\" id=\"collect\">How to collect evidence well<\/h2>\n <p>The goal is SOC 2 evidence that is continuous, complete, and instantly retrievable. A repeatable approach:<\/p>\n\n <div class=\"checkgrid\">\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">1<\/span><h4>Map each control to a source<\/h4><\/div><ul><li>Decide exactly what artifact proves it<\/li><li>No evidence source means a gap to fix now<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">2<\/span><h4>Index by criterion<\/h4><\/div><ul><li>Organise the way auditors request it<\/li><li>Retrievable in minutes beats a stronger control you cannot locate<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">3<\/span><h4>Automate collection<\/h4><\/div><ul><li>Pull logs, configs, access events via APIs<\/li><li>Manual collection is slow and misses days<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">4<\/span><h4>Start on day one<\/h4><\/div><ul><li>Begin when the observation window opens<\/li><li>What you miss in month two cannot be recreated in month six<\/li><\/ul><\/div>\n <\/div>\n\n <p>Run periodic internal checks too, so a missed access review or lapsed scan surfaces while you can still fix it, not during fieldwork.<\/p>\n\n <h2 class=\"sec\" id=\"mistake\">The mistake that sinks audits<\/h2>\n <p>If there is one SOC 2 evidence failure mode to burn into memory, it is treating evidence collection as a one-time push at the end of the window. Type II is about continuous operation, and evidence you did not capture as you went cannot be reconstructed later.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">What separates clean passes<\/div>The teams that pass cleanly are not the ones with the strongest controls on paper. They are the ones whose evidence is captured continuously, indexed by Trust Services Criteria, and retrievable in minutes, rather than reconstructed the week before fieldwork.<\/div>\n\n <h2 class=\"sec\" id=\"osto\">Evidence that collects itself<\/h2>\n <p>Step back and the core problem is obvious. Evidence collection is painful because the controls live in one set of tools, and the evidence they produce lands in another, so someone has to bridge the two by hand, for months.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Osto removes the bridge<\/div>Because your controls run on one platform, the evidence they generate, access reviews, MFA configs, monitoring and alert logs, vulnerability scans, VAPT results, is captured from the same modules, continuously, and mapped to the criteria. The receipts are already in hand when fieldwork starts.<\/div>\n\n <div class=\"callout\">\n <h3>Walk into fieldwork with the receipts already in hand.<\/h3>\n <p>Osto is a one-stop cybersecurity and compliance platform for growing companies. Controls and their evidence in one place, captured continuously and mapped to the criteria, so you can get SOC 2 ready in about 115 days. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n\n <details>\n <summary>What counts as SOC 2 evidence?<\/summary>\n <p>Any objective artifact that proves a control exists and operated as described: policies, procedures, access logs, change tickets, access reviews with sign-offs, monitoring and alert logs, vulnerability scans, and signed attestations, all dated and retrievable.<\/p>\n <\/details>\n <details>\n <summary>How does evidence differ between Type I and Type II?<\/summary>\n <p>A Type I report evaluates control design at a single point in time, so evidence is collected once and is mainly policies, procedures, and limited samples. A Type II proves controls operated across the whole observation window, so evidence must be collected continuously.<\/p>\n <\/details>\n <details>\n <summary>How do auditors sample evidence?<\/summary>\n <p>For a Type II, auditors use population sampling. They request the full population of an item, such as every change ticket or every user granted access during the window, then test a representative sample from it.<\/p>\n <\/details>\n <details>\n <summary>Can strong security still fail a SOC 2 audit?<\/summary>\n <p>Yes, because SOC 2 tests provability, not just security. A control can be working perfectly, but if it left no retrievable, dated evidence trail, the auditor cannot verify it, and that becomes an exception.<\/p>\n <\/details>\n <details>\n <summary>Do I need to automate evidence collection?<\/summary>\n <p>For a Type II it is effectively non-optional at any real team size. Automated tools pull audit logs, configuration snapshots, and access events via APIs, so evidence accumulates continuously instead of being gathered by hand.<\/p>\n <\/details>\n\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>SOC 2 Evidence Collection: What Auditors Actually Want | Osto SOC 2 evidence is what turns strong security into a\u2026<\/p>\n","protected":false},"author":8,"featured_media":584,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-583","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/583","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=583"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/583\/revisions"}],"predecessor-version":[{"id":585,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/583\/revisions\/585"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/584"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=583"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=583"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=583"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":583,"date":"2026-08-09T18:58:15","date_gmt":"2026-08-09T18:58:15","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=583"},"modified":"2026-08-09T18:58:15","modified_gmt":"2026-08-09T18:58:15","slug":"soc-2-evidence-collection","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/soc-2-evidence-collection\/","title":{"rendered":"SOC 2 Evidence Collection: What Auditors Actually Want"},"content":{"rendered":"\n\n\n\n\n\nSOC 2 Evidence Collection: What Auditors Actually Want | Osto<\/title>\n<meta name=\"description\" content=\"A practical guide to SOC 2 evidence collection. What counts as evidence, how Type I and Type II differ, how auditors sample, what they want by control area, and how to collect it well.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n<\/style>\n<\/head>\n<body>\n\n<div class=\"wrap\">\n <p class=\"dek\">SOC 2 evidence is what turns strong security into a passing audit. Strong security alone does not pass; provable security does. This is how to collect the evidence that proves it.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span>\n <span class=\"dot\"><\/span>\n <span>8 min read<\/span>\n <span class=\"dot\"><\/span>\n <span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>Evidence is the proof that each of your controls actually operated. Auditors do not take your word for it. They sample dated artifacts, access reviews, change tickets, logs, and verify the control ran.<\/p>\n <p>The teams that pass cleanly are the ones whose evidence is collected continuously, indexed by Trust Services Criteria, and retrievable in minutes, not reconstructed the week before fieldwork.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">What counts as evidence<\/a><\/li>\n <li><a href=\"#types\">Type I vs Type II evidence<\/a><\/li>\n <li><a href=\"#sample\">How auditors sample<\/a><\/li>\n <li><a href=\"#byarea\">What they want, by area<\/a><\/li>\n <li><a href=\"#collect\">How to collect it well<\/a><\/li>\n <li><a href=\"#mistake\">The mistake that sinks audits<\/a><\/li>\n <li><a href=\"#osto\">Evidence that collects itself<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">What counts as SOC 2 evidence<\/h2>\n <p>SOC 2 evidence is any objective artifact that shows a control exists and operated as described. Policies say what you intend to do; evidence proves you did it.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">The hard truth good teams miss<\/div>Companies with genuinely strong security fail SOC 2 audits all the time. Not because their controls are weak, but because they cannot produce the dated, retrievable proof that those controls ran.<\/div>\n\n <p>The details matter to an auditor. Logs should carry timestamps and user identifiers. Tickets should show approvals, dates, and outcomes. Attestations must be signed and dated.<\/p>\n\n <h2 class=\"sec\" id=\"types\">Type I vs Type II: two different evidence jobs<\/h2>\n <p>How much evidence you need, and of what kind, depends entirely on which report you are pursuing.<\/p>\n\n <div class=\"keyrow\">\n <div class=\"k1\"><div class=\"lab\">Type I evidence<\/div><div class=\"big\">Collected once<\/div><div class=\"sm\">Proves controls are properly designed as of a single date. Mostly policies, procedures, and limited samples showing the control exists. It does not need to show continuous operation, which is why Type I can be done in weeks.<\/div><\/div>\n <div class=\"k2\"><div class=\"lab\">Type II evidence<\/div><div class=\"big\">Collected continuously<\/div><div class=\"sm\">Proves controls operated effectively across an observation window, usually 3 to 12 months. Evidence must cover the entire period, week after week, not a single snapshot.<\/div><\/div>\n <\/div>\n\n <div class=\"bbox indigo\"><div class=\"bt\">The crux<\/div>Type II is not a bigger Type I. It is a different job. Type I asks “is this control designed correctly today?” Type II asks “did this control run correctly every week for months?”<\/div>\n\n <h2 class=\"sec\" id=\"sample\">How auditors sample evidence<\/h2>\n <p>Auditors do not inspect every event. For a <a href=\"https:\/\/www.osto.one\/resources\/soc-2-type-1-vs-type-2\">Type II<\/a> they use population sampling: they ask for the full population of something, then test a representative sample from it.<\/p>\n\n <div class=\"sampleflow\">\n <div class=\"sf a\"><div class=\"t\">Full population<\/div><div class=\"d\">every change ticket in the window<\/div><\/div>\n <div class=\"sarr\">→<\/div>\n <div class=\"sf b\"><div class=\"t\">Representative sample<\/div><div class=\"d\">the auditor tests a subset<\/div><\/div>\n <div class=\"sarr\">→<\/div>\n <div class=\"sf c\"><div class=\"t\">A miss becomes an exception<\/div><div class=\"d\">a gap in the sample lands in the report<\/div><\/div>\n <\/div>\n\n <div class=\"bbox navy\"><div class=\"bt\">What this means for you<\/div>Because the auditor tests a sample from the whole window, one missed month can surface as an exception. A control that ran eleven times out of twelve still failed the twelfth. The takeaway is practical: your evidence has to be complete and consistent for every control, across the entire period, which is exactly why it helps to know what auditors look for in each area.<\/div>\n\n <h2 class=\"sec\" id=\"byarea\">What auditors want, by control area<\/h2>\n <p>Auditors organise their SOC 2 evidence requests around the <a href=\"https:\/\/www.osto.one\/resources\/soc-2-controls-cc1-cc9\">Common Criteria<\/a>. Indexing your evidence the same way, by criterion, makes fieldwork dramatically faster.<\/p>\n\n <div class=\"checkgrid\">\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">A<\/span><h4>Access (CC6)<\/h4><\/div><ul><li>Access reviews with sign-offs<\/li><li>MFA configuration proof<\/li><li>Deprovisioning records for leavers<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">B<\/span><h4>Operations (CC7)<\/h4><\/div><ul><li>Monitoring and alert logs<\/li><li>Vulnerability scan results<\/li><li>Incident records, including tests<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">C<\/span><h4>Change (CC8)<\/h4><\/div><ul><li>Change tickets with approvals<\/li><li>Dates and outcomes recorded<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">D<\/span><h4>Governance & vendors<\/h4><\/div><ul><li>Risk assessment, signed<\/li><li>Vendor assessment files<\/li><li>Training completion logs<\/li><\/ul><\/div>\n <\/div>\n\n <h2 class=\"sec\" id=\"collect\">How to collect evidence well<\/h2>\n <p>The goal is SOC 2 evidence that is continuous, complete, and instantly retrievable. A repeatable approach:<\/p>\n\n <div class=\"checkgrid\">\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">1<\/span><h4>Map each control to a source<\/h4><\/div><ul><li>Decide exactly what artifact proves it<\/li><li>No evidence source means a gap to fix now<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">2<\/span><h4>Index by criterion<\/h4><\/div><ul><li>Organise the way auditors request it<\/li><li>Retrievable in minutes beats a stronger control you cannot locate<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">3<\/span><h4>Automate collection<\/h4><\/div><ul><li>Pull logs, configs, access events via APIs<\/li><li>Manual collection is slow and misses days<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">4<\/span><h4>Start on day one<\/h4><\/div><ul><li>Begin when the observation window opens<\/li><li>What you miss in month two cannot be recreated in month six<\/li><\/ul><\/div>\n <\/div>\n\n <p>Run periodic internal checks too, so a missed access review or lapsed scan surfaces while you can still fix it, not during fieldwork.<\/p>\n\n <h2 class=\"sec\" id=\"mistake\">The mistake that sinks audits<\/h2>\n <p>If there is one SOC 2 evidence failure mode to burn into memory, it is treating evidence collection as a one-time push at the end of the window. Type II is about continuous operation, and evidence you did not capture as you went cannot be reconstructed later.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">What separates clean passes<\/div>The teams that pass cleanly are not the ones with the strongest controls on paper. They are the ones whose evidence is captured continuously, indexed by Trust Services Criteria, and retrievable in minutes, rather than reconstructed the week before fieldwork.<\/div>\n\n <h2 class=\"sec\" id=\"osto\">Evidence that collects itself<\/h2>\n <p>Step back and the core problem is obvious. Evidence collection is painful because the controls live in one set of tools, and the evidence they produce lands in another, so someone has to bridge the two by hand, for months.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Osto removes the bridge<\/div>Because your controls run on one platform, the evidence they generate, access reviews, MFA configs, monitoring and alert logs, vulnerability scans, VAPT results, is captured from the same modules, continuously, and mapped to the criteria. The receipts are already in hand when fieldwork starts.<\/div>\n\n <div class=\"callout\">\n <h3>Walk into fieldwork with the receipts already in hand.<\/h3>\n <p>Osto is a one-stop cybersecurity and compliance platform for growing companies. Controls and their evidence in one place, captured continuously and mapped to the criteria, so you can get SOC 2 ready in about 115 days. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n\n <details>\n <summary>What counts as SOC 2 evidence?<\/summary>\n <p>Any objective artifact that proves a control exists and operated as described: policies, procedures, access logs, change tickets, access reviews with sign-offs, monitoring and alert logs, vulnerability scans, and signed attestations, all dated and retrievable.<\/p>\n <\/details>\n <details>\n <summary>How does evidence differ between Type I and Type II?<\/summary>\n <p>A Type I report evaluates control design at a single point in time, so evidence is collected once and is mainly policies, procedures, and limited samples. A Type II proves controls operated across the whole observation window, so evidence must be collected continuously.<\/p>\n <\/details>\n <details>\n <summary>How do auditors sample evidence?<\/summary>\n <p>For a Type II, auditors use population sampling. They request the full population of an item, such as every change ticket or every user granted access during the window, then test a representative sample from it.<\/p>\n <\/details>\n <details>\n <summary>Can strong security still fail a SOC 2 audit?<\/summary>\n <p>Yes, because SOC 2 tests provability, not just security. A control can be working perfectly, but if it left no retrievable, dated evidence trail, the auditor cannot verify it, and that becomes an exception.<\/p>\n <\/details>\n <details>\n <summary>Do I need to automate evidence collection?<\/summary>\n <p>For a Type II it is effectively non-optional at any real team size. Automated tools pull audit logs, configuration snapshots, and access events via APIs, so evidence accumulates continuously instead of being gathered by hand.<\/p>\n <\/details>\n\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>SOC 2 Evidence Collection: What Auditors Actually Want | Osto SOC 2 evidence is what turns strong security into a\u2026<\/p>\n","protected":false},"author":8,"featured_media":584,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-583","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/583","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=583"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/583\/revisions"}],"predecessor-version":[{"id":585,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/583\/revisions\/585"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/584"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=583"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=583"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=583"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}