SOC 2 Evidence Gathering

This document provides guidance on how to gather the evidence needed for SOC 2 certification purposes. We will cover the types of evidence that our auditors typically request for the controls that are not monitored by Drata, as well as best practices for collecting and organizing the evidence.

Evidence Repository

We keep the evidence we gather in the following places:

  • In the Evidence Repository under <control-id>/YYYY-MM-DD to keep a record of the evidence we previously gathered
  • We upload it in Drata under the appropriate control to make it available for auditors

DCF-7: Separate Testing and Production Environments

DCF-7: Separate Testing and Production Environments

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Screenshots from test and production environments for the application

How to gather the evidence:

DCF-11: Annual Access Control Review

DCF-11: Annual Access Control Review

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Tickets documenting the access control lists that were reviewed for in scope cloud environments, SaaS applications, infrastructure as code tools, and security protection tools (as applicable)
  2. Tickets should be marked as completed/closed and the reviewer should provide comments on the results of the reviews.

How to gather the evidence:

DCF-12: Hardening Standards in Place

DCF-12: Hardening Standards in Place

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Evidence from infrastructure as code tools showing configurations that would be implemented when new infrastructure is deployed.
  2. Any type of document that formally documents the configurations that should be implemented for newly deployed infrastructure.

How to gather the evidence:

DCF-22: Network segmentation in place

DCF-22: Network segmentation in place

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Formal, documented network/architecture diagram evidencing network segmentation of your cloud environments.

How to gather the evidence:

DCF-35: Security Team Communicates in a Timely Manner

DCF-35: Security Team Communicates in a Timely Manner

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Screenshots from communication tools (Slack, PagerDuty) showing the process for security events to be communicated to appropriate personnel.

How to gather the evidence:

DCF-43: Termination/Offboarding Checklist

DCF-43: Termination/Offboarding Checklist

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Formal documented termination checklist/help desk ticket for a recent terminated employee.

How to gather the evidence:

DCF-56: Vendor Agreements Maintained (TODO: Seth)

DCF-56: Vendor Agreements Maintained

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Executed Agreement/contract between the entity and key vendors.

How to gather the evidence:

  • TODO: Seth

DCF-57: Vendor Compliance Reports (TODO: Seth)

DCF-57: Vendor Compliance Reports

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Screenshots from the vendor directory showing that vendors are categorized based on impact /risk.
  2. Review documents showing that vendors' SOC2 reports were reviewed (Drata can provide a review template for this).

How to gather the evidence:

  • TODO: Seth

DCF-58: Authentication Protocol

DCF-58: Authentication Protocol

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. If SSO is an option, screenshots of a user logging in with SSO.
  2. If username and password is an option, screenshots of a user logging in with a username and password.
  3. Screenshots of MFA being required for employee users.
  4. If customer users have the option to enable MFA, screenshots showing they are provided the option to enable MFA.

How to gather the evidence:

DCF-59: Role-Based Security Implementation

DCF-59: Role-Based Security Implementation

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Screenshots from the application showing how users are assigned roles.

How to gather the evidence:

DCF-60: Password Storage

DCF-60: Password Storage

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. If username and password is required, screenshots from the database showing that password are stored using a salted hash.

How to gather the evidence:

  • Execute the following query and screenshot the result
    $ nio-db connect -d marketplace -s dev
    marketplace> select password from users order by random() limit 10;

DCF-61: Customer Data Segregation

DCF-61: Customer Data Segregation

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Screenshots from the database showing that customers are assigned separate IDs.
  2. Screenshots from the application showing that a customer cannot see data of another customer (attempt to show one customer trying to access data of another customer). How to gather the evidence:
  • Execute the following query and screenshot the result
    $ nio-db connect -d marketplace -s dev
    marketplace> select id,name from companies order by id limit 10;
  • Screenshot the Datasets page for two different companies

DCF-62: Inactivity and Browser Exit Logout (TODO: Marko)

DCF-62: Inactivity and Browser Exit Logout

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Screenshots of users being logged out of the application when browser/tab is closed and being forced to reauthenticate upon next login.
  2. Screenshots showing that a user is logged out after pre-defined activity timeout and being forced to reauthenticate upon next login.

How to gather the evidence:

  • TODO: Marko

DCF-63: Accepting The Terms of Service (TODO: Marko)

DCF-63: Accepting The Terms of Service

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Screenshots of the new account creation process showing that new users must explicitly or implicitly accept the terms of service.

How to gather the evidence:

  • TODO: Marko

DCF-69: System Access Granted

DCF-69: System Access Granted

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control: 1.Formal, documented access request form/help desk ticket for a recent new hire.

How to gather the evidence:

DCF-72: Unique SSH

DCF-72: Unique SSH

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Screenshots of a user logging into the production systems, showing that they have to use a unique SSH account.
  2. Screenshot of the setting from the production servers showing that the "root" account cannot be used to login to production.

How to gather the evidence:

DCF-74: Customers Informed of Changes (TODO: Seth)

DCF-74: Customers Informed of Changes

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Example emails communicating changes to customers.
  2. Screenshots of banners warning customers of downtime prior to system maintenance.

How to gather the evidence:

  • TODO: Seth

DCF-79: Logs Centrally Stored

DCF-79: Logs Centrally Stored

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Screenshots from the location where logs of system activity are stored.

How to gather the evidence:

DCF-80: Log Management System

DCF-80: Log Management System

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Screenshots from the location where logs of system activity are stored.

How to gather the evidence:

DCF-86: Operational Audit

DCF-86: Operational Audit

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Screenshots from the systems used to monitor for system availability issues.
  2. Screenshots showing how personnel would be alerted of availability issues and who would be alerted.

How to gather the evidence:

DCF-92: VPN Required for Production Access

DCF-92: VPN Required for Production Access

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. screenshots of a user trying to access production systems without being connected to a VPN and providing access is denied.
  2. Screenshots of a user accessing production after connecting to a VPN to show a successful connection.

How to gather the evidence:

  • Screenshot access to the marketplace database with and without the VPN connection
    nio-db connect -d marketplace -s prod

DCF-105: Employee Non-Disclosure Agreement (NDA) (TODO: Seth)

DCF-105: Employee Non-Disclosure Agreement (NDA)

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Example new hire employee agreement, with NDA included.

How to gather the evidence:

  • TODO: Seth

DCF-108: Storage of Sensitive Data on Paper (TODO: Seth)

DCF-108: Storage of Sensitive Data on Paper

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Pictures of secure storage bins from office locations.

How to gather the evidence:

  • TODO: Seth

DCF-109: Disposal of Sensitive Data on Hardware

DCF-109: Disposal of Sensitive Data on Hardware

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Data Deletion Policy or equivalent policy documenting this policy and procedure.

How to gather the evidence:

DCF-143: Board Oversight Briefings Conducted (TODO: Seth)

DCF-143: Board Oversight Briefings Conducted

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Meeting minutes from the Board of Directors meeting showing that the state of cybersecurity and privacy risks were discussed.

How to gather the evidence:

  • TODO: Seth

DCF-144: Board Charter Documented (TODO: Seth)

DCF-144: Board Charter Documented

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Copy of Board Charter

How to gather the evidence:

  • TODO: Seth

DCF-145: Board Expertise Developed (TODO: Seth)

DCF-145: Board Expertise Developed

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Board of Directors Backgrounds

How to gather the evidence:

  • TODO: Seth

DCF-146: Board Meetings Conducted (TODO: Seth)

DCF-146: Board Meetings Conducted

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Board of Directors Bios
  2. Meeting minutes from Board meetings

How to gather the evidence:

  • TODO: Seth

DCF-149: Board Meetings Conducted (TODO: Seth)

DCF-149: Board Meetings Conducted

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. If removable media devices are issued by the company to employees, provide evidence that removable media devices are encrypted.

How to gather the evidence:

  • TODO: Seth

DCF-152: Virtual Machine OS are Patched Monthly (TODO: Sami)

DCF-152: Virtual Machine OS are Patched Monthly

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Evidence from servers or patching systems showing that operating systems were patched monthly.

How to gather the evidence:

  • TODO: Sami

DCF-153: Conduct Control Self-Assessments (TODO: Seth)

DCF-153: Conduct Control Self-Assessments

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Screenshots of how Drata is used for continuous monitoring of controls.

How to gather the evidence:

  • TODO: Seth

DCF-154: Annual Incident Response Test (TODO: Seth)

DCF-154: Annual Incident Response Test

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Most recently completed incident response tabletop test.

How to gather the evidence:

  • TODO: Seth

DCF-155: Code Changes are Tested

DCF-155: Code Changes are Tested

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Screenshots from the ticketing system for a few changes showing that changes were tested.

How to gather the evidence:

  • Take a screenshot of the latest Github Actions CI run showing that some tests have run
  • If the automated tests end up not being considered enough evidence by the auditor, ask the Product Manager for recent tickets showing that product changes have been tested and undergone bugfixes before being rolled out to production.

DCF-156: Production Code Released by Appropriate Personnel

DCF-156: Production Code Released by Appropriate Personnel

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Screenshots from the ticketing system for a few changes showing that changes were approved by appropriate personnel.

How to gather the evidence:

DCF-157: Cybersecurity Insurance Maintained (TODO: Seth)

DCF-157: Cybersecurity Insurance Maintained

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Cybersecurity insurance certificate.

How to gather the evidence:

  • TODO: Seth

DCF-160: Continuous Control Monitoring (TODO: Seth)

DCF-160: Continuous Control Monitoring

Drata Example Evidence for Not Monitored Controls Sheet suggests the following evidence for this control:

  1. Screenshots of how Drata is used for continuous monitoring of controls.

How to gather the evidence:

  • TODO: Seth
Table of Contents