SOC 2 evidence checklist: 30 artifacts on a schedule

How to use this list

A list sorted by control area tells you what an auditor will ask about. A list sorted by cadence tells you what goes on your calendar. Calendars are where evidence programs fail. You do not schedule a criterion. You schedule a Tuesday.

This is not the same document as the auditor’s request. The SOC 2 PBC list is the numbered demand that arrives once fieldwork begins. This checklist is the supply side, the routine that means those requests are already answered. The artifacts overlap. The index is different.

A note on scope. We scope Security only, and that is not a customer setting. Security does not test availability commitments, so the backup and restore rows are here because recovering from a security incident falls inside the common criteria,¹ not because availability is in scope.

The checklist in five cadences

Owners are roles, not names. On a team of six they collapse onto two people, which is normal and covered in SOC 2 for a small team. Pick the group that matches a meeting you already hold, and put one named person on every row before you close this page.

Four tests every artifact must pass

A file becomes evidence when it passes four tests. They apply to all thirty rows, so fix them once at the source instead of thirty times under a deadline.

Dated

The date sits inside the artifact, not just in the filename. A period is tested by comparing dates, so an undated file cannot be placed in it.

Scoped

It shows which environment, account or population it covers. A crop of one toggle shows the toggle and nothing about where it applies.

Sourced

The generating tool is visible on the artifact. A list you retyped into a spreadsheet proves your typing, not the system.

Complete

Populations go out whole. Choosing the sample is the auditor’s job under the attestation standards,² and a list you filtered first is not a population anymore.

Your policy sets the schedule you are tested on

The criteria do not hand you a schedule.¹ You write frequencies into your own policies, and from then on the examination holds you to them. Write quarterly and you owe four. Write monthly and you owe twelve. That makes drafting your policy set an operating decision, not a writing exercise.

So pick the longest interval you can defend, write it down, and hit it every time. A monthly control missed twice reads worse than a quarterly control met four times. The first does not operate as described. The second does.

Type 1 versus Type 2: why cadence counts

A Type 1 describes your controls on one date,³ so this list is a state you set up once. A Type 2 covers a window, and the math inside it is strict. Across a 3-month observation window, a yearly control may not fire at all and a quarterly control fires about once. One instance means one chance to get it right.

That argues for shortening cadences before the window opens, not during it. How long the observation period has to be weighs a shorter window against how many times each control gets to show itself. Our SOC 2 readiness assessment page explains how to find the rows you cannot yet produce.

Order of work

Work the list backward from the slowest items. Yearly artifacts take longest and cannot be backdated. Quarterly reviews need a real system list first. Event rows are discipline. The always-on rows come last and are mostly a settings check.

1. Name one owner per row. A row owned by a team is owned by nobody, and it will be the one still open in week three.
2. Fix retention first. Logs, alerts and backup history are the only rows where waiting destroys evidence for good.
3. Match policy to calendar. Change the document to the cadence you will really keep, before the period opens.
4. File each artifact the day it exists, named with its date and the control it supports, so nobody rebuilds nine months of history in the week the request arrives.
5. Send exports, not transcriptions. If the system can generate the list, let it. Your spreadsheet summarizes evidence. The export is the evidence.

Cost: platform, consultant, or yourself

Evidence collection is the job compliance platforms are built to automate, and it is a core part of what their contracts pay for. Here is what the outside routes cost, according to sources that track them.

• Vendr reports a median annual contract value of $20,000 for Vanta, based on purchases completed through its marketplace. Source, checked 2026-07-30.
• Vendr reports a median annual contract value of $24,601 for Drata, based on purchases completed through its marketplace. Source, checked 2026-07-30.
• Comp AI states that a vCISO or compliance consultant might charge $150 to $400 an hour, which can total $20,000 to $50,000 for a full SOC 2 prep engagement. Source, checked 2026-07-30.

You can run much of this list yourself. The always-on rows are settings. The event rows are habits. The recurring rows are calendar entries with an owner. What a tool adds is collection from systems it can reach, mapping to criteria, and a package the examination reads from. Someone at your company still confirms each artifact is what it claims to be, because that statement is about your system.

Our software does that collection for $199 a month, cancel any time, or $2,189 a year, pay for eleven months, get twelve. Audits go through our preferred pricing program, and we negotiate the fee on your behalf, and the price shows in your account before you book. Audits unlock after four paid months on monthly, or right away on yearly, and a Type 2 also waits for the 3-month observation window to finish. cybersoftware is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Your next step

Find out which of the thirty rows you can already produce. The free readiness assessment takes about 15 minutes, asks about each control, and separates what needs building from what only needs evidence. When you know the size of the gap, compare the plans.