Control

A rule your team follows that the auditor can test, for example "every merge needs a non-author approval". Each item here is one control.

Evidence

Proof the control operated: an export, a setting, a log, a ticket. Dated, from the system itself, covering the audit period.

Audit period

The months a Type 2 report covers, usually 3 to 12. The auditor samples from it, so evidence from early in the period must still exist at the audit.

Type 1 and Type 2

Type 1 checks a control exists on one date. Type 2 checks it worked for the whole period. Most customers ask for Type 2.

Criteria

The SOC 2 requirements a control maps to, written as CC codes (CC8.1 is change management). Shown on each item for your auditor's workpapers.

Sampling

How auditors test: they take a list of all occurrences in the period (merged pull requests, leavers, alerts) and check a sample. The list must be complete first.

Gap

An item you answered No or Partly: the control or its evidence is missing. Core gaps come first in your list.

Exception

A documented, approved, time-limited departure from a rule. Without one, a departure is a finding.

Numbers and frequencies

Numbers marked "commonly" or "a common choice" (25 to 40 pull requests, quarterly reviews, 30-day fixes) are examples. SOC 2 sets no numbers; your policies do.

Optional items

Strengthens the program but is not needed to meet the criteria. No here is an improvement opportunity, not an audit gap. If a company lists it as a control in its SOC 2 report, the auditor will test it, so list it only if it runs reliably.

The 18 optional items: Code scanning (SAST), Secret scanning, Infrastructure code scanning, SSO for engineering systems, Just-in-time and break-glass access, Per-service secret access, Machine credential inventory, Dynamic scanning (DAST), Penetration test, Infrastructure as code through the pipeline, Hardening baselines, Live configuration monitoring, Drift detection, Tamper-proof logs, Alerts when monitoring stops, Threat detection, Isolated, immutable backups, Key management.

Optional items count in progress but never as gaps. Their answers are kept and exported, and "Hide optional" in All items takes them out of the sequence.

Answers

YesYou could hand the evidence to an auditor now, for the whole period.
PartlyThe control runs, but the evidence is incomplete.
NoNot yet.
Doesn't applyOnly where the item allows it. The rule is shown next to the answer.