Automating SOC 2 evidence so the observation window is not a second job
A Type II window means proving, month after month, that controls ran. Collecting that by hand consumes an engineer. What to automate, what to buy, and what still has to be done by a person.
The Type II audit tests operating effectiveness over a period. In practice that means that for each control, for each month of the window, somebody has to produce dated proof that the control ran.
Teams who discover this in month four of a six-month window spend the remaining two months reconstructing evidence, which is unpleasant, partly impossible, and visible to the auditor. The fix is to decide how each piece of evidence will be produced before the window opens.
The evidence that is expensive by hand
A typical Security-plus-Availability-plus-Confidentiality scope generates a few dozen controls. Most are cheap. These are the ones that consume time:
- Quarterly user access reviews across every system in scope — the cloud accounts, the identity provider, the code repository, the database, the CI system, the support tool. Someone must review each list, confirm or revoke, and the result must be recorded with who reviewed and when.
- Onboarding and offboarding records with dates, showing access granted on start and revoked on departure, usually within a stated number of days.
- Change management evidence that changes were reviewed and approved before deployment, for every deployment.
- Vulnerability management showing findings triaged and remediated within the timeframes your own policy states.
- Backup and restore testing with results.
- Security awareness training completion per employee.
- Vendor reviews for each subservice organisation, with their SOC 2 or ISO certificate on file and in date.
What to automate, and how
Access reviews. Script the extraction. A scheduled job that pulls IAM users and roles, identity provider group memberships, repository collaborators and database grants into a dated file in a versioned store gives you the "as of" snapshot the auditor wants. The human step — someone looking at the list and deciding — stays human, but it becomes an hour of reviewing rather than a day of collecting. Record the decision in the same repository so the review and its input are one artefact.
Change management. This is free if you use it properly. Branch protection requiring review, plus deployments triggered only from the protected branch, means the pull request record is the change management evidence. Export the merged PR list for the period with approver and date. Say explicitly in your control description that the PR approval is the change approval, so the auditor tests the thing that actually exists rather than looking for a change advisory board.
Vulnerability triage. The scanner output alone is not evidence. What the auditor tests is: finding appeared on date X, was triaged by date Y, was fixed or accepted by date Z, within your stated SLA. Push scanner findings into your issue tracker automatically with a due date derived from severity, and the tracker becomes the evidence.
Infrastructure controls. Encryption at rest, TLS versions, logging enabled, MFA enforced, public access blocked — all of these are continuously verifiable. A scheduled posture scan that stores a dated report means you can show the control held on every day of the window rather than on the day the auditor asked. This is much stronger evidence than a screenshot, and it costs one scheduled job.
Backups. A scheduled restore into a scratch environment that records the time taken and a row count. It satisfies the control and, more usefully, it tells you whether your restore actually works.
What a compliance platform buys you
The platforms in this space connect to your cloud providers, identity provider and repositories, map the collected data to control requirements, and give the auditor a portal. They genuinely save time on the mapping and on the auditor-facing packaging, and their questionnaire libraries are useful.
What they do not do is create the controls. A platform showing 94 percent compliance on a dashboard is measuring the checks it knows how to make, not your actual security posture. The custom parts of your environment — the ones that carry the real risk — are exactly the parts the integrations do not cover, and those you evidence yourself regardless.
The honest comparison: a platform costs roughly what a month or two of engineer time costs per year, and saves more than that in a first audit. It is a reasonable buy for a first SOC 2, and the thing to negotiate is whether you can export your evidence if you leave.
What stays manual, permanently
Risk assessment. Policy approval by management. The judgement in an access review. Incident postmortems. Vendor risk decisions. Security training that is about your actual risks rather than a generic video.
These are the controls that carry the real weight, and they are worth doing properly precisely because they cannot be automated. An auditor who sees automated evidence for the mechanical controls and thoughtful, dated records for the human ones concludes quickly that the system is real.
The reverse — thin automated coverage everywhere and no evidence of anyone thinking — produces a longer audit and a list of exceptions in the report your customers will read.