Guide

SOC 2 evidence examples by control

By the ShipReady Metrics research team. Published September 22, 2026. Sources are cited inline at the end of each page.

The most common audit-week question is "what does good evidence look like for this control." Below are working examples for the Common Criteria controls engineering teams get asked about most. Each entry lists the artifact, where it comes from, how fresh it needs to be, and the follow-up questions auditors ask.

CC6.1 - Logical access to systems and data

The control: access to protected information assets is restricted to authorized users through authentication and authorization.

Artifact	Source system	Cadence
Organization member list with MFA enrollment status	GitHub org settings / API	Weekly snapshot, sampled at audit
SSO enforcement and session policy export	Identity provider (Okta, Google Workspace, Entra)	Quarterly
Access review with reviewer sign-off	Ticketing or GRC workflow	Quarterly, complete and signed
Offboarding tickets closed within policy SLA	Ticketing + HR system	Per event, sampled

Auditor follow-ups: pick a departed employee and show every system where access was revoked and when; show a user whose access changed role and the approval behind it.

CC6.6 - Protection against threats from outside system boundaries

Artifact	Source system	Cadence
Network boundary configuration: security groups, firewall rules, WAF policy	Cloud provider config export	Monthly
Encryption-in-transit settings: TLS policy on load balancers and endpoints	Cloud / CDN configuration	Quarterly
Public exposure scan results (open ports, public buckets)	External scanner or cloud posture tooling	Weekly or continuous

Auditor follow-ups: why is this port open; show the change ticket for this security group modification.

CC7.1 - Monitoring to detect configuration changes and vulnerabilities

Artifact	Source system	Cadence
Vulnerability scan reports with remediation status	Scanner (cloud-native or third-party)	Monthly or better
Dependency vulnerability alerts and resolution times	GitHub Dependabot / equivalent	Continuous, sampled monthly
Configuration change detection log on security-relevant settings	Cloud audit log / posture tool	Continuous

Auditor follow-ups: show a vulnerability found in the period and its fix timeline; show what happens when a scan fails to run.

CC7.2 - Monitoring to detect anomalies and security events

Artifact	Source system	Cadence
Alert rules and notification routing configuration	SIEM / monitoring platform	Quarterly review
Security event tickets with triage outcome	Ticketing / on-call system	Per event, sampled
Audit logging enabled and retained per policy	Cloud audit log settings	Quarterly

CC8.1 - Change management

Artifact	Source system	Cadence
Pull requests with required review and passing CI before merge	GitHub branch protection + PR history	Continuous, sampled
Branch protection configuration export	GitHub repository settings	Weekly snapshot
Emergency change records with after-the-fact approval	Ticketing	Per event
Deployment log tied to merged commits	CI/CD system	Continuous

Auditor follow-ups: sample merged PRs and check each had review and green CI; ask how the team stops direct pushes to main, then verify the branch protection settings prove it.

Patterns across all of these

• System-of-record beats screenshots. Every artifact above can be pulled from an API. Screenshot evidence decays and is easy to challenge.
• Freshness is part of the evidence. A perfect artifact from last year fails a Type II period test. See evidence freshness and expiry.
• Failures with fixes are fine. A drift event that was detected and remediated inside SLA is evidence the control works. Hiding it is what turns into a finding.

Frequently asked questions

Are screenshots ever acceptable SOC 2 evidence?

Sometimes, for settings that have no API. But auditors prefer system-generated exports because screenshots are easy to stage and hard to date. Treat screenshots as a fallback with a timestamped capture process, not a strategy.

How many samples will an auditor take?

Sample sizes depend on control frequency and the firm. A quarterly control typically means all four instances are examined; a daily or continuous control means a sample across the period. Ask your auditor for their sampling approach during planning.

What is the difference between evidence for Type I and Type II?

Type I needs evidence the control is designed and in place at a point in time. Type II needs evidence the control operated across the whole review period, which is why freshness and continuity of collection matter so much more for Type II.