SOC 2 Type 2
SOC 2 Type 2 audit evidence requirements
ER-26 Pre-Kickoff - Penetration Test Results and Remediation
ER-27 Pre-Kickoff - Incident Response Policies
ER-28 Pre-Kickoff - Access Control Policy
ER-29 Pre-Kickoff - Information Security Policies
ER-30 Pre-Kickoff - Patching and Vulnerability Management and System Monitoring Policy
ER-31 Pre-Kickoff - Supplier/Vendor Risk Management Policy
ER-32 Pre-Kickoff - Change Management Procedures
ER-45 Password Policy and Configurations
ER-46 Pre-Kickoff - Network Diagram and Segmentation
ER-61 Incident Response Plan Test
ER-62 Sample - Software/Infrastructure Change Ticket for a Sample of Production Changes
ER-63 Pre-Kickoff - Segregation of Duties for Production Deployments Documentation
ER-64 Sample Vendor Assessments for a Sample of Critical Vendors
ER-65 Pre-Kickoff - Capacity Monitoring Configurations and Alerts
ER-66 Pre-Kickoff - Replication, Backup Configurations, and Schedules
ER-67 Pre-Kickoff - BC/DR Plan and Test
ER-68 Pre-Kickoff - Backup Policy and Procedures
ER-69 Pre-Kickoff - Data Backup Restoration Test
ER-70 Pre-Kickoff - Policy Restricting Production Data in Lower Environments
ER-71 Sample - Customer Data Deletion Tickets for a Sample of Customer Data Deletions
ER-16 Job Descriptions for a Sample of Current Employees
ER-17 Security Awareness Training for a Sample of New Hires
ER-18 Security Awareness Training for a Sample of Current Employees
ER-19 Performance Review Policy
ER-20 Performance Reviews for a Sample of Current Employees
ER-21 Customer Agreement (MSA/EULA etc.)
ER-22 Critical Vendor Confidentiality Agreements for a Sample of Critical Vendors
ER-23 Pre-Kickoff - Technical Support Resources
ER-24 Pre-Kickoff - Risk Assessment
ER-25 Pre-Kickoff - Configuration Management Tool
ER-37 Walkthrough - Privileged Access to the Production Network
ER-43 Walkthrough - Privileged Access to Firewalls/Security Groups
ER-44 Walkthrough - Privileged Access to the Log(s) or Log Management Tool
ER-47 Walkthrough - Data Encryption at Rest And in Transit Configurations
ER-51 Walkthrough - Production System Inventory
ER-53 Walkthrough - Firewall Rules/Security Groups
ER-54 Pre-Kickoff - AWS Trusted Advisor and IAM Credential Report
ER-55 Pre-Kickoff - Intrusion Detection System (IDS) Policy, Configurations, and Alerts
ER-59 Pre-Kickoff - Log Management Policy, Configurations, and Alerts
ER-33 Pre-Kickoff - System Hardening Standards
ER-34 Pre-Kickoff - Data Classification, Retention and Disposal Policies
ER-35 Walkthrough - Production Authentication and Logins
ER-36 Walkthrough - Password Vault and Password Manager
ER-38 Walkthrough - Privileged Access to the Application(s)
ER-39 Walkthrough - Privileged Access to the Operating System
ER-40 Walkthrough - Privileged Access to the Data Stores
ER-41 Walkthrough - Privileged Access to the Cloud Console
ER-42 Walkthrough - Privileged Access to the Encryption Keys
ER-48 Access Request Form for a Sample of New Hires
ER-49 Termination Ticket for a Sample of Terminated Employees
ER-50 Evidence of Access Review Documentation for a sample of [FREQUENCY]
ER-52 Walkthrough - Multi-factor Authentication Configurations
ER-56 Pre-Kickoff - Infrastructure Patching Evidence
ER-57 Antimalware Policy and Configurations
ER-58 Sample - Vulnerability Scans and Remediation for a Sample of [Quarters and Months]
ER-60 Infrastructure Monitoring Policy, Configurations, and Alerts
ER-7 Signed Code of Conducts for a Sample of New Hires
ER-8 Pre-Kickoff - Code of Conduct
ER-9 Signed Confidentiality Agreements for a Sample of New Hires
ER-10 Pre-Kickoff - Confidentiality Agreement Template
ER-11 Background Check Reports for a Sample of New Hires
ER-12 Pre-Kickoff - Background Check Policy
ER-13 Pre-Kickoff - Risk Committee or Board Charter and Meeting Minutes
ER-14 Pre-Kickoff - Organizational Chart
ER-15 Pre-Kickoff - Roles & Responsibilities
ER-1 Population and C&A 1 - Listing of all current employees and contractors with a job title and hire date
ER-2 Population and C&A 2 - Listing of all terminated employees and contractors during the review period.
ER-3 Population and C&A 3 - Listing of all critical vendors
ER-4 Population and C&A 4 - Listing of all software and infrastructure production changes that took place during the review period
ER-5 Pre-Kickoff - Population and C&A 5 - Listing all of all customer data deletions that took place during the review period
ER-6 Pre-Kickoff - Population and C&A 6 - List of all security Incidents identified during the review period