SOC2 Evidence Collector#

Automate evidence gathering for SOC2 Type I and Type II audits across all 5 Trust Service Criteria.

When to Use#

• Preparing for an upcoming SOC2 audit (Type I or Type II)
• Building continuous compliance evidence pipelines
• Auditor requests evidence and you need to gather it fast
• Onboarding a new client who requires SOC2 compliance proof
• Annual evidence refresh cycle
• Gap analysis before engaging an audit firm

Input#

Gather these from the user before generating:

Required#

1. Audit type: Type I (point-in-time) or Type II (over a period, typically 3-12 months)
2. Trust Service Criteria in scope: Security (CC — always required), plus any of: Availability, Processing Integrity, Confidentiality, Privacy
3. Cloud provider(s): AWS, GCP, Azure, multi-cloud, on-prem, hybrid
4. Primary tech stack: languages, frameworks, CI/CD, IaC tools
5. Team size: engineering + ops headcount

Optional#

• Current compliance certifications (ISO 27001, HIPAA, PCI-DSS, etc.)
• Audit firm name and timeline
• Previous audit findings or gaps
• Specific control frameworks already mapped (NIST 800-53, CIS, etc.)
• SSO/IdP provider (Okta, Azure AD, Google Workspace, etc.)

Evidence Categories#

CC — Common Criteria (Security) — Always In Scope#

CC1: Control Environment

EvidenceSourceCollection MethodOrg chart with security rolesHR system / ConfluenceManual export quarterlySecurity policy documentsPolicy repo / wikiGit log showing annual reviewCode of conduct acknowledgmentsHR systemExport signed acknowledgmentsBoard/management meeting minutes on securityCalendar + notesScreenshot + agenda exportRisk assessment documentationGRC tool / spreadsheetExport current risk register

CC2: Communication and Information

EvidenceSourceCollection MethodSecurity awareness training recordsLMS / training platformCompletion report exportOnboarding security checklistHR systemTemplate + completion logsIncident communication proceduresRunbook / wikiVersion-controlled doc with review historyExternal communication policiesPolicy repoGit log + approval records

CC3: Risk Assessment

EvidenceSourceCollection MethodAnnual risk assessment reportGRC toolPDF export with sign-offVendor risk assessmentsVendor management toolExport assessment recordsPenetration test reportsSecurity vendorPDF reports with remediation trackingVulnerability scan resultsScanner (Qualys, Nessus, etc.)Automated export, monthly

CC4: Monitoring Activities

EvidenceSourceCollection MethodSIEM dashboards and alert configsDatadog / Splunk / CloudWatchScreenshot + config exportUptime monitoring evidencePingdom / Datadog / UptimeRobotMonthly uptime reportsLog retention configurationCloud provider consoleConfig export / IaC snippetAnomaly detection rulesSIEM / monitoring toolRule export with change log

CC5: Control Activities

EvidenceSourceCollection MethodAccess control matrixIdP / IAM consoleExport user-role mappingsMFA enforcement evidenceIdP admin consolePolicy config screenshotFirewall / security group rulesCloud console / IaCterraform state or console exportEncryption at rest configurationCloud console / IaCConfig export showing encryption enabledEncryption in transit (TLS)Load balancer / CDN configCertificate + config export

CC6: Logical and Physical Access Controls

EvidenceSourceCollection MethodUser access reviews (quarterly)IdP + spreadsheetReview meeting notes + updated access listTerminated user deprovisioningIdP audit logExport showing timely deactivationSSH key / credential rotation logsSecrets managerRotation event logsPhysical access logs (if applicable)Building managementBadge access reports

CC7: System Operations

EvidenceSourceCollection MethodChange management recordsJira / GitHub PRsExport merged PRs with approvalsCI/CD pipeline configurationGitHub Actions / CircleCIConfig file export from repoDeployment approval processPR review settingsBranch protection rule screenshotsIncident response logsPagerDuty / OpsgenieIncident timeline exportsBackup configuration and test resultsCloud console / IaCBackup policy + restore test logs

CC8: Change Management

EvidenceSourceCollection MethodPR review requirementsGitHub / GitLab settingsBranch protection configCode review evidenceGitHub PR historyExport PRs with review commentsRelease notes / changelogsRepoCHANGELOG.md with version historyRollback proceduresRunbookDocumented procedure with test evidence

CC9: Risk Mitigation

EvidenceSourceCollection MethodBusiness continuity planPolicy repoDocument with annual review evidenceDisaster recovery test resultsDR runbookTest execution logs + resultsInsurance certificatesFinance / legalCurrent certificate copiesSub-processor agreementsLegal / contract managementSigned DPAs + vendor list

A — Availability (If In Scope)#

EvidenceSourceCollection MethodSLA definitions and monitoringProduct docs + monitoringSLA doc + uptime dashboard exportsCapacity planning documentationArchitecture docsQuarterly capacity review notesAuto-scaling configurationCloud console / IaCConfig exportIncident response SLA adherencePagerDuty / incident trackerResponse time reportsRedundancy / failover configurationCloud architectureArchitecture diagram + failover test logs

PI — Processing Integrity (If In Scope)#

EvidenceSourceCollection MethodData validation rulesApplication code / configCode snippets + test resultsQA / testing proceduresCI/CD pipelineTest suite config + pass/fail reportsError handling and correction proceduresRunbook / codeError handling docs + incident examplesData reconciliation reportsApplication logs / reportsMonthly reconciliation output

C — Confidentiality (If In Scope)#

EvidenceSourceCollection MethodData classification policyPolicy repoDocument with review historyNDA / confidentiality agreementsLegal / HRSigned agreement copiesData retention and disposal policyPolicy repoPolicy doc + disposal logsDLP tool configurationDLP tool adminConfig export + alert samples

P — Privacy (If In Scope)#

EvidenceSourceCollection MethodPrivacy policy (public)WebsiteURL + version historyData processing agreementsLegalSigned DPAsConsent management recordsCMP / applicationConsent log exportsData subject request proceduresPolicy repo / ticketingProcedure doc + DSR ticket samplesPrivacy impact assessmentsGRC tool / docsPIA reports for high-risk processing

Automation Scripts#

When the user's stack is identified, generate shell scripts for automated evidence collection:

AWS Evidence Collection (example)#

bash

#!/bin/bash
# SOC2 Evidence Collector — AWS
# Generated by AfrexAI SOC2 Evidence Collector skill
set -euo pipefail

EVIDENCE_DIR="soc2-evidence/$(date +%Y-%m-%d)"
mkdir -p "$EVIDENCE_DIR"/{iam,network,encryption,logging,compute}

echo "=== CC5: Access Controls ==="
aws iam get-account-summary > "$EVIDENCE_DIR/iam/account-summary.json"
aws iam generate-credential-report && sleep 5
aws iam get-credential-report --output text --query Content | base64 -d > "$EVIDENCE_DIR/iam/credential-report.csv"
aws iam list-users --output json > "$EVIDENCE_DIR/iam/users.json"
aws iam list-policies --scope Local --output json > "$EVIDENCE_DIR/iam/custom-policies.json"

echo "=== CC5: Encryption at Rest ==="
aws rds describe-db-instances --query 'DBInstances[*].{ID:DBInstanceIdentifier,Encrypted:StorageEncrypted,KmsKey:KmsKeyId}' > "$EVIDENCE_DIR/encryption/rds-encryption.json"
aws s3api list-buckets --query 'Buckets[*].Name' --output text | tr '\t' '\n' | while read bucket; do
  aws s3api get-bucket-encryption --bucket "$bucket" >> "$EVIDENCE_DIR/encryption/s3-encryption.json" 2>/dev/null || echo "{\"bucket\":\"$bucket\",\"encryption\":\"NONE\"}" >> "$EVIDENCE_DIR/encryption/s3-encryption.json"
done

echo "=== CC4: Logging ==="
aws cloudtrail describe-trails > "$EVIDENCE_DIR/logging/cloudtrail-config.json"
aws cloudwatch describe-alarms --state-value ALARM > "$EVIDENCE_DIR/logging/active-alarms.json"

echo "=== CC5: Network Security ==="
aws ec2 describe-security-groups > "$EVIDENCE_DIR/network/security-groups.json"
aws ec2 describe-vpcs > "$EVIDENCE_DIR/network/vpcs.json"

echo "=== CC6: MFA Status ==="
aws iam list-virtual-mfa-devices > "$EVIDENCE_DIR/iam/mfa-devices.json"

echo "Evidence collected in $EVIDENCE_DIR"
echo "Review and redact sensitive values before sharing with auditors."

GitHub Evidence Collection (example)#

bash

#!/bin/bash
# SOC2 Evidence Collector — GitHub
set -euo pipefail

ORG="${1:?Usage: $0 <github-org>}"
EVIDENCE_DIR="soc2-evidence/$(date +%Y-%m-%d)/github"
mkdir -p "$EVIDENCE_DIR"

echo "=== CC8: Branch Protection ==="
gh api "/orgs/$ORG/repos" --paginate --jq '.[].name' | while read repo; do
  gh api "/repos/$ORG/$repo/branches/main/protection" 2>/dev/null > "$EVIDENCE_DIR/${repo}-branch-protection.json" || true
done

echo "=== CC7: Recent Deployments ==="
gh api "/orgs/$ORG/repos" --paginate --jq '.[].name' | head -10 | while read repo; do
  gh api "/repos/$ORG/$repo/deployments?per_page=10" > "$EVIDENCE_DIR/${repo}-deployments.json" 2>/dev/null || true
done

echo "=== CC8: PR Review Evidence ==="
gh api "/orgs/$ORG/repos" --paginate --jq '.[].name' | head -10 | while read repo; do
  gh pr list --repo "$ORG/$repo" --state merged --limit 20 --json number,title,mergedAt,reviewDecision > "$EVIDENCE_DIR/${repo}-merged-prs.json" 2>/dev/null || true
done

echo "=== CC5: Org Security Settings ==="
gh api "/orgs/$ORG" --jq '{two_factor_requirement: .two_factor_requirement_enabled, default_permissions: .default_repository_permission}' > "$EVIDENCE_DIR/org-security.json"

echo "Evidence collected in $EVIDENCE_DIR"

Output Format#

Generate a structured evidence package:

text

soc2-evidence/
├── README.md                    # Overview, scope, period, auditor info
├── evidence-matrix.md           # Full checklist with status (collected/pending/N-A)
├── collection-scripts/
│   ├── collect-aws.sh
│   ├── collect-github.sh
│   ├── collect-idp.sh
│   └── collect-monitoring.sh
├── gap-analysis.md              # Missing evidence + remediation steps
└── schedule.md                  # Evidence collection calendar (what to refresh when)

evidence-matrix.md Format#

markdown

| # | Control | Evidence | Status | Source | Last Collected | Notes |
|---|---------|----------|--------|--------|---------------|-------|
| CC1.1 | Org chart | org-chart-2026-Q1.pdf | ✅ Collected | HR export | 2026-01-15 | |
| CC5.3 | MFA enforcement | mfa-config.json | ✅ Automated | IdP API | 2026-03-17 | Script: collect-idp.sh |
| CC3.2 | Pen test report | — | ⏳ Pending | External vendor | — | Due 2026-04-01 |

Workflow#

1. Gather inputs (audit type, scope, stack, team size)
2. Generate the full evidence matrix for in-scope criteria
3. Mark known evidence sources based on their stack
4. Generate collection scripts for automated gathering
5. Identify gaps and generate remediation recommendations
6. Create an evidence collection schedule (daily/weekly/monthly/quarterly)
7. Output the complete evidence package

Tips for Users#

• Start 3-6 months before audit: evidence gaps take time to fill
• Automate early: scripts that run monthly save panic before audit
• Version everything: auditors love seeing change history
• Don't fake it: missing evidence is better than fabricated evidence
• Continuous > point-in-time: Type II requires sustained evidence over the audit period
• Tag evidence: use consistent naming so auditors can self-serve

AfrexAI Note#

This skill generates the framework and automation scaffolding. For hands-on SOC2 audit preparation with managed AI agents handling continuous evidence collection, monitoring, and auditor coordination — that's what AfrexAI's AI-as-a-Service delivers. Contact us at hello@afrexai.com.