Appearance
SOC2 Audit — Provided By Client (PBC) Guide
Purpose
When the SOC2 auditor arrives they send a PBC list — a specific set of evidence requests. This guide maps each common request to exactly where the evidence lives so audit response time is hours, not days.
Audit window: September 2026 (Type II — evidence covers the preceding 12 months) Auditor contact: TBD — see Adriana for current engagement details Internal coordinator: Rory (technical evidence), Adriana (administrative docs)
How SOC2 Type II Evidence Works
Type II means the auditor is checking that controls operated consistently over the audit period — not just that they exist today. For every control, they want to see:
- A policy or procedure describing the control
- Evidence the control actually ran during the period (logs, screenshots, reports)
- Exception handling if it ever failed
If a control was implemented mid-period, document the implementation date. Partial coverage is better than pretending it was always there.
PBC Evidence Map
CC1 — Control Environment (Policies and Organization)
| Auditor Request | Location | Who Provides |
|---|---|---|
| Information security policy | compliance/hipaa-policy-set.md | Rory |
| Acceptable use policy | compliance/hipaa-policy-set.md | Rory |
| Org chart / key personnel | README.md → Key People table | Rory |
| Risk assessment | compliance/hipaa-risk-assessment.md | Rory |
| Evidence of risk assessment review | Git commit history on hipaa-risk-assessment.md | Rory |
| Vendor management policy | compliance/vendor-risk-inventory.md | Adriana |
| BAA register | compliance/vendor-phi-inventory.md | Adriana |
CC2 — Communication and Information
| Auditor Request | Location | Who Provides |
|---|---|---|
| Security awareness training policy | compliance/hipaa-policy-set.md | Rory |
| Training completion records for audit period | compliance/training-completion-log.md | Rory |
| Phishing simulation results | compliance/phishing-simulation-schedule.md + SecOps evidence | Rory |
| Evidence employees acknowledged policies | Onboarding checklist completion records | Adriana |
CC3 — Risk Assessment
| Auditor Request | Location | Who Provides |
|---|---|---|
| Formal risk assessment document | compliance/hipaa-risk-assessment.md | Rory |
| Threat model | security/threat-model.md | Rory |
| Risk acceptance register | compliance/risk-acceptance-register.md | Rory |
| Evidence of risk assessment updates | Git history on threat model and risk assessment | Rory |
CC4 — Monitoring Activities
| Auditor Request | Location | Who Provides |
|---|---|---|
| Evidence of continuous monitoring | compliance/logging-architecture.md — log sources and archive | Rory |
| Security monitoring tool evidence | architecture/security-monitoring-architecture.md | Rory |
| Sample HIPAA audit email reports | ops-automation email archive (IT admin mailbox) | Rory |
| Arctic Wolf MDR reports (sample) | Arctic Wolf portal → Reports | Rory |
| Vulnerability scan results | compliance/pentest-results-log.md → GitHub Actions artifacts | Rory |
| Evidence of alert review | SecOps incident history for audit period | Rory |
CC5 — Control Activities (Policies and Procedures)
| Auditor Request | Location | Who Provides |
|---|---|---|
| Change management policy/procedure | cicd/pipeline-overview.md + security/firewall-change-procedure.md | Rory |
| Evidence of change management during period | GitHub PR history (all infra repos) — every merge = documented CM | Rory |
| Change management tickets | SecOps → Changes table (auto-created per merged PR) | Rory |
| Incident response procedure | runbooks/incident-response.md | Rory |
| Evidence of IR procedure use | SecOps incident history for audit period | Rory |
CC6 — Logical and Physical Access Controls
| Auditor Request | Location | Who Provides |
|---|---|---|
| Access control policy | compliance/three-layer-access-architecture.md | Rory |
| User access provisioning/de-provisioning procedure | compliance/onboarding-security-checklist.md | Rory |
| MFA evidence | Entra ID → Conditional Access policy screenshots | Rory |
| Privileged access controls | compliance/pam-scope.md + PIM audit reports | Rory |
| Access review evidence | compliance/access-control-review.md + periodic review records | Rory |
| Terminated user offboarding evidence | HR records + Entra account disable timestamps | Adriana + Rory |
| Remote access controls | compliance/vpnlyr-audit-evidence.md | Rory |
| Encryption in transit/at rest | compliance/hipaa-controls.md §164.312(a)(2)(iii) | Rory |
| Break-glass account controls | runbooks/break-glass-procedure.md | Rory |
CC7 — System Operations
| Auditor Request | Location | Who Provides |
|---|---|---|
| Vulnerability management procedure | security/vulnerability-management.md + security/penetration-testing.md | Rory |
| Penetration test results for audit period | compliance/pentest-results-log.md → GitHub Actions artifacts | Rory |
| Patch management evidence | security/patch-management.md + Intune patch reports | Rory |
| EDR coverage evidence | security/edr-cortex-xdr.md + Cortex XDR console screenshots | Rory |
| MDR evidence | Arctic Wolf portal — MDR scope + coverage reports | Rory |
| Incident log for audit period | SecOps incident export | Rory |
| Evidence of log review | Monthly security review records | Rory |
CC8 — Change Management
| Auditor Request | Location | Who Provides |
|---|---|---|
| Change management procedure | cicd/pipeline-overview.md + security/firewall-change-procedure.md | Rory |
| Evidence of CI/CD pipeline enforcing controls | GitHub Actions run history + Checkov scan results on PRs | Rory |
| OIDC authentication evidence (no stored secrets) | cicd/oidc-authentication.md + GitHub Actions workflow files | Rory |
| Sample change tickets | SecOps → Changes for audit period | Rory |
| Evidence changes were tested before production | terraform plan output in PR comments (GitHub PR history) | Rory |
CC9 — Risk Mitigation
| Auditor Request | Location | Who Provides |
|---|---|---|
| Vendor due diligence | compliance/vendor-risk-inventory.md | Adriana |
| BAA status | compliance/vendor-phi-inventory.md | Adriana |
| Cyber insurance | compliance/cyber-insurance-review-checklist.md + policy on file | Adriana |
| IR retainer | compliance/ir-retainer-evaluation.md | Adriana |
A1 — Availability (if in scope)
| Auditor Request | Location | Who Provides |
|---|---|---|
| Business continuity / DR plan | aws/dr-overview.md + aws/dr-failover-procedure.md | Rory |
| Emergency mode operation plan | compliance/emergency-mode-operation-plan.md | Rory |
| Backup architecture | runbooks/backup-architecture.md | Rory |
| Evidence of backup testing | Veeam validation report (March 4, 2026) in runbooks/backup-architecture.md | Rory |
| DR test results | Q2 2026 DR test results (post June test) | Rory |
| RTO/RPO definitions | runbooks/backup-architecture.md — RPO ~24h, RTO 1–4h/4–8h | Rory |
C1 — Confidentiality (if in scope)
| Auditor Request | Location | Who Provides |
|---|---|---|
| Data classification policy | compliance/hipaa-policy-set.md | Rory |
| PHI handling procedures | compliance/hipaa-administrative-procedures.md | Rory |
| DLP controls evidence | compliance/purview-dlp-enforce-mode-criteria.md + Purview audit logs | Rory |
| Encryption documentation | compliance/hipaa-controls.md §164.312(a)(2)(iii) | Rory |
Evidence Collection — How To Pull It
GitHub evidence (CI/CD, change management)
Pull all merged PRs for a given repo and date range:
gh pr list --repo Cirius-Group-Inc/azure-infra --state merged --limit 200 \
--json number,title,mergedAt,author | jq '.[] | select(.mergedAt > "2025-09-01")'For each PR, the auditor can see: what changed, who approved, what Checkov/terraform plan said, when it merged.
Entra / Azure evidence
Export from Azure Portal → Entra ID → Sign-in logs (CSV export, max 30 days per pull). For longer periods, use Log Analytics — SignInLogs table in cirius-logging-law-central.
SecOps incident evidence
Export from secops.bedrockcybersecurity.org — admin panel → Incidents → Export CSV for date range. Provides incident timeline, severity, resolution for the audit period.
Arctic Wolf evidence
Log in to Arctic Wolf portal → Reports → generate coverage and activity report for the audit period. Arctic Wolf also provides an annual summary letter for auditors on request.
Cortex XDR evidence
Log in to Cortex XDR console → Reports → Endpoint inventory report (shows all protected endpoints) + activity summary. Export as PDF for auditor.
What Auditors Always Ask That You Might Forget
These come up every audit and are easy to miss:
Terminated user list — show that departed employees' access was revoked within X days. Pull from HR (Adriana) + Entra account disable timestamps. Match the dates.
Evidence that someone actually looked at the security reports — not just that they were generated. Monthly security review records with a date and Rory's sign-off.
Exception register — any deviation from policy (a privileged account without MFA, a resource without tagging) must be formally accepted. See
compliance/risk-acceptance-register.md. An auditor who finds an undocumented exception is more concerned than one who finds a documented one.Evidence of training for everyone, not just new hires — annual refresher completion, not just onboarding completion.
Business continuity test evidence — not just the plan, but proof it was tested. The June 2026 DR test with written results is critical for the September audit.
Pre-Audit Checklist (Run 4–6 Weeks Before Audit)
- [ ]
compliance/hipaa-risk-assessment.md— reviewed and dated within 12 months - [ ]
compliance/training-completion-log.md— all employees have current-year entries - [ ]
compliance/pentest-results-log.md— last 12 months of monthly results documented - [ ]
compliance/vendor-phi-inventory.md— all BAAs current (check expiry dates) - [ ]
compliance/risk-acceptance-register.md— all open exceptions reviewed - [ ]
compliance/access-control-review.md— access review completed within 6 months - [ ] June 2026 DR test completed and results documented
- [ ] SecOps incident export for audit period — verify all P1/P2 incidents have resolution notes
- [ ] Arctic Wolf annual summary letter requested
- [ ] Cortex XDR endpoint coverage report exported
Related Documents
- HIPAA Controls Matrix — control-by-control mapping to HIPAA
- HIPAA Risk Assessment — formal risk analysis
- Compliance Scorecard — current posture
- Annual Review Checklist — yearly review requirements
Document History
| Date | Change | Author |
|---|---|---|
| May 2026 | Initial draft — maps all common SOC2 PBC requests to evidence locations. Covers CC1–CC9, A1, C1. | Rory |