Appearance
SOC2 Audit Readiness — September 2026
Overview
Cirius Group's SOC2 Type II audit is scheduled for September 2026. This document is the pre-audit readiness checklist — what evidence to gather, which docs satisfy which controls, and the preparation timeline.
Audit type: SOC2 Type II (covers a period of time, not a point in time)
Evidence period: Approximately April 2026 – September 2026
Owner: Rory (Security Officer)
Supporting: Adriana (vendor/risk docs)
This checklist supplements the specific compliance docs — it tells you where to look for each piece of evidence rather than re-documenting the controls.
Evidence system of record — Bedrock GRC
SOC2 control evidence is tracked and collected in the Bedrock GRC product (grc.bedrockcybersecurity.org), not assembled by hand. GRC is the authoritative source; this doc and the per-area maps below are the human-readable index into it.
- SOC2 controls tracked: 44 (of 226 total across HIPAA/SOC2/NIST), 100% current at last reconciliation (2026-06-21) — 0 stale, 0 missing.
- Collection: 33 fully automated, 11 automated + manual ("BOTH"), via the GRC collection agents (
framework_crossref_agent,sharepoint_compliance_agent, and the Azure/AWS/GitHub posture pipelines). - Per-control evidence: each control's latest evidence record (with its archive key) is at GRC
GET /api/controlsandGET /api/evidence; coverage roll-up atGET /api/controls/coverage. - Archive: evidence artifacts are retained in S3
cirius-audit-evidence-prod(Logging account, 7-year Object-Lock WORM) — the durable copy auditors can be shown.
For the auditor, pull live coverage from GRC at the start of fieldwork rather than trusting a static export — GRC reflects the current state; the tables below describe where each control's evidence comes from.
SOC2 Trust Services Criteria in Scope
| Criteria | Description | In Scope |
|---|---|---|
| CC1 | Control environment (policies, org structure) | Yes |
| CC2 | Communication and information | Yes |
| CC3 | Risk assessment | Yes |
| CC4 | Monitoring of controls | Yes |
| CC5 | Control activities | Yes |
| CC6 | Logical and physical access | Yes — primary focus |
| CC7 | System operations | Yes |
| CC8 | Change management | Yes |
| CC9 | Risk mitigation | Yes |
| A1 | Availability | Yes |
Evidence Map by Control Area
CC6 — Logical and Physical Access
This is the highest-scrutiny area. Auditors will verify access is appropriately restricted, credentials are managed, and access is reviewed.
| What Auditors Check | Evidence Document | Where Evidence Lives |
|---|---|---|
| Access provisioning process | Entra Identity Operations | This repo |
| Access termination (offboarding) | Employee Offboarding | This repo |
| Privileged access controls | Keeper Credential Guide + Keeper Admin Console audit log | This repo + Keeper |
| Break-glass account management | Break-Glass Procedure + SecOps break-glass alert history | This repo + SecOps |
| Credential rotation | Key Rotation Schedule + Keeper audit log (who changed what, when) | This repo + Keeper |
| MFA enforcement | Conditional Access Reference + Entra sign-in logs showing MFA required | This repo + Entra portal |
| Access reviews for privileged accounts | Admin Account Hygiene + Entra Access Review results | This repo + Entra portal |
| Vendor access controls | Vendor Contractor Access + access register | This repo + Keeper |
CC7 — System Operations
| What Auditors Check | Evidence Document | Where Evidence Lives |
|---|---|---|
| Security monitoring | SecOps Platform Guide + SecOps incident history | This repo + SecOps |
| Incident response | Incident Response + SecOps resolved incidents | This repo + SecOps |
| Penetration testing | Pentest Results Log — three-layer programme: Vonahi vPenTest monthly internal scans (app.vpentest.io), attack-teams weekly purple-team (attack.bedrockcybersecurity.org + authorization 2026-04-20), bedrock-soc external surface scan monthly. Authorization document: bedrock-attack/AUTHORIZATION.md. | vpentest.io + attack.bedrockcybersecurity.org + GitHub Actions artifacts |
| Log retention | Log Retention Verification + LAW retention settings screenshot | This repo + Azure portal |
| Backup integrity | Backup Restore Verification + RSV job history, Veeam reports | This repo + Azure portal |
| Malware protection | Cortex XDR deployment screenshot, Arctic Wolf coverage | SecOps CMDB |
| Patch management | Patch Management + Intune compliance report | This repo + Intune |
| Vulnerability management | Arctic Wolf findings history, SecOps finding resolution | Concierge portal + SecOps |
CC8 — Change Management
| What Auditors Check | Evidence Document | Where Evidence Lives |
|---|---|---|
| Change management process | CLAUDE.md (PR → CI → merge → apply) | This repo |
| Change documentation | GitHub PR history for all infra repos | GitHub |
| Automated CM tickets | SecOps changes table (every merged infra PR creates one) | SecOps |
| Emergency change process | Break-Glass Procedure | This repo |
CC9 / A1 — Availability and DR
| What Auditors Check | Evidence Document | Where Evidence Lives |
|---|---|---|
| DR plan exists | DR Failover Procedure | This repo |
| DR tested periodically | DR Test Results Log | This repo |
| RTO/RPO defined and measured | DR Test Results Log + Q2 test results | This repo |
| Backup architecture | Backup Architecture | This repo |
CC6.1/CC6.6 — Credential Management (HIPAA Crossover)
| What Auditors Check | Evidence Document |
|---|---|
| Rotation policy exists | Key Rotation Schedule |
| Rotation occurred | Keeper admin audit log (who changed, when) |
| Certificate monitoring | SecOps cert_expiry_agent finding history |
HIPAA Evidence (Parallel Track)
SOC2 and HIPAA requirements overlap significantly. Collect this evidence for both:
| HIPAA Section | Requirement | Evidence |
|---|---|---|
| §164.308(a)(1) | Security management process | HIPAA Controls |
| §164.308(a)(3) | Workforce security | Entra Identity Operations |
| §164.308(a)(5) | Security awareness | KnowBe4 training completion reports |
| §164.308(a)(7) | Contingency plan | DR Failover Procedure + DR Test Results Log |
| §164.312(b) | Audit controls (log retention) | Log Retention Verification |
| §164.312(a)(2)(iv) | Credential rotation | Key Rotation Schedule |
| §164.312(d) | Authentication | Conditional Access Reference |
Pre-Audit Preparation Timeline
60 Days Before Audit (July 2026)
- [ ] Complete the Q3 DR test and populate DR Test Results Log
- [ ] Verify all key rotation dates are populated in Key Rotation Schedule
- [ ] Run an access review for all privileged accounts
- [ ] Verify log retention is configured correctly and archive is populating
- [ ] Pull Keeper admin audit log for the evidence period
- [ ] Confirm Arctic Wolf monthly health checks are filed in SharePoint (Adriana)
- [ ] Review open gaps in DR Test Results Log — are any Critical/High gaps still open?
30 Days Before Audit (August 2026)
- [ ] Assemble the evidence package (see below)
- [ ] Walk through each CC control area with the evidence map above — do we have a doc for everything?
- [ ] Verify all GitHub infra repos have PR history for the evidence period (no direct pushes to main)
- [ ] Verify SecOps shows CM tickets corresponding to infra deployments
- [ ] Pull Entra Conditional Access sign-in logs showing MFA enforced
- [ ] Pull Intune patch compliance report showing devices are current
- [ ] Confirm KnowBe4 shows training completion for all staff
2 Weeks Before Audit (Early September 2026)
- [ ] Dry-run with Adriana — review each evidence artifact
- [ ] Confirm auditor access logistics (do they need guest accounts? VPN?)
- [ ] Pre-brief Kevin and Greg on likely DC/AD questions
- [ ] Resolve any remaining gaps or prepare risk acceptance documentation
Evidence Package Assembly
Gather these artifacts into a SharePoint folder before the audit:
Policies and Procedures
- HIPAA policy set (
compliance/hipaa-policy-set.md) - HIPAA controls (
compliance/hipaa-controls.md) - Incident response procedure (
runbooks/incident-response.md) - Key rotation schedule (
compliance/key-rotation-schedule.md) - This repo (bedrock-docs) — the primary evidence base
Access Control Evidence
- Keeper admin audit log (exported from Keeper Admin Console → Reports)
- Entra Access Review results (Entra ID → Identity Governance)
- Entra sign-in logs showing MFA enforced (filtered for evidence period)
- Break-glass account alert history (SecOps)
Monitoring and Operations Evidence
- SecOps incident history for evidence period
- Arctic Wolf monthly health check reports (SharePoint → Compliance → Monthly Reviews)
- Intune device compliance report
- Patch status report
Penetration Testing Evidence
- Vonahi vPenTest PDF reports from app.vpentest.io (Apr–Sep 2026 monthly runs)
- attack-teams authorization document (
bedrock-attack/AUTHORIZATION.mdsigned 2026-04-20) - attack.bedrockcybersecurity.org campaign history (weekly since April 2026)
- bedrock-soc GitHub Actions artifacts (
gh run list --repo Bedrock-Cybersecurity/bedrock-soc --workflow "monthly-pentest.yml" --limit 12) - Pentest results log (
compliance/pentest-results-log.md)
DR and Backup Evidence
- Q3 DR test results (populated in DR Test Results Log)
- RSV backup job history (Azure portal screenshot)
- Veeam completion email archive
- S3 Object Lock screenshot (AWS Backup account)
- Log archive immutability screenshot (Azure Storage)
Risk Acceptance Evidence
- Risk acceptance register (
compliance/risk-acceptance-register.md) — RA-2026-001 (FIDO2), RA-2026-002 (IR retainer), RA-2026-003 (session recording) - For each accepted risk: compensating control evidence (PIM activation logs, Azure Activity Log, Entra CA policy screenshot)
Change Management Evidence
- GitHub PR history (all infra repos, evidence period)
- SecOps changes table (API export or screenshot)
Working with the Auditor
Auditors will typically request:
- A tour of the systems (SecOps platform, Azure portal, GitHub)
- Specific evidence artifacts from the list above
- Interviews with Rory (and possibly Kevin/Greg for AD questions)
Responses to common auditor questions:
"Show me that MFA is required for all users" → Entra CA policy + sign-in logs showing MFA step
"Show me that credentials are rotated" → Key rotation schedule document + Keeper audit log showing the rotation dates
"Show me that your DR plan has been tested" → DR test results log with Q2 2026 results
"Show me your access provisioning and termination process" → Entra identity operations + employee offboarding documents
"Show me audit logs for privileged account activity" → SecOps break-glass alert history + Entra audit logs for the break-glass accounts
Related Documents
- HIPAA Controls — control framework
- DR Test Results Log — DR evidence
- Key Rotation Schedule — credential rotation evidence
- Log Retention Verification — log archive evidence
- Annual Review Checklist — broader annual review
Document History
| Date | Change | Author |
|---|---|---|
| May 2026 | Initial draft — evidence map by SOC2 control area, HIPAA crossover table, pre-audit timeline, evidence package assembly, auditor Q&A. Targeted at September 2026 audit. | Rory |