SOC 2 evidence automation: what to automate, and what not to

Automate SOC 2 evidence that systems already produce, such as user lists, configuration state, scan results and change records. Keep human decisions manual and signed: access reviews, risk acceptance and incident post-mortems. Automation proves a control ran. It cannot prove that a person judged it correctly.

Why does a Type 2 audit favor automation?

A Type 2 report covers how controls operated over a period, so auditors sample across that window. One practitioner guide cites 25 to 40 samples for some recurring controls, such as change deployments, and says other controls differ. Sample sizes are the auditor's decision, so ask yours. Whatever the number, collecting evidence by hand every month invites gaps and late backfilled screenshots.

The same guide recommends automated collection for ongoing items such as user access and system configuration, and manual collection for policies, meeting minutes and approvals. That split matches how most teams end up. It comes from a vendor guide, so treat it as practice, not rule.

What is a good candidate for automation?

Look for evidence with three traits: a system holds it, it changes over time, and it needs no judgment.

• Access lists: current users and roles from your identity provider and cloud accounts, exported on a schedule.
• Configuration state: MFA enforced, encryption on, logging on, branch protection set.
• Change records: pull requests with required reviews, deployment logs.
• Security scans: dependency and vulnerability results with dates, SBOM exports per release.
• Backups: job success logs and restore test records.

Safeguard's docs describe this for SOC 2: its Type 2 framework page says connected systems run automated tests mapped to the criteria, with 360 connectors providing automated evidence and 855 automated tests mapped, and that everything else depends on evidence you supply or attestations. That page also separates requirements by who decides: one is decided by a scan, five need a scan plus evidence, and 55 are evidence only.

What should stay manual?

Anything where a person must decide.

• Access reviews. A script can list who has access. A manager must say "still needed" and sign it.
• Risk acceptance. A scanner can list an open finding. Only a named owner can accept it, with a reason and a date.
• Incident reviews. A timeline can be exported. The lessons and follow-ups are human.
• Vendor reviews. A questionnaire is an input. The decision is not.
• Policy approval and training. Signed, dated, by named people.

An automated "access review complete" ticket that no human read is worse than none: it is evidence that the control was designed to fail.

How do you keep automated evidence trustworthy?

1. Date and source everything. A screenshot with no date is weak. An export with a timestamp and system name is stronger.
2. Keep it immutable. Store evidence where it cannot be edited quietly, with access logged.
3. Test the collectors. A connector that fails silently leaves a hole you will find in the audit. Alert on missing runs.
4. Cover the whole period. Evidence should exist for every month of the window, not just the last week.
5. Show exceptions. A scan with zero findings every month looks suspicious. Findings with timely handling look real.

What can a platform not do for you?

It cannot decide your scope, write policies you follow or replace your auditor. Safeguard says its readiness score is the share of in-scope requirements that pass, and that it is "not an audit opinion or a certification." Requirements awaiting evidence count as not yet passing until someone attests them.

Open the framework mapping demo

What to do

1. List every SOC 2 control you operate, and tag each "system evidence" or "human decision."
2. Automate the system evidence first, starting with access lists and configuration state.
3. Create a signed template for each human decision, with date, owner and reason.
4. Alert on any collector that misses a run.
5. Ask your auditor which sampling and evidence formats they accept before you build.

Quick check

Sources

• Safeguard docs, SOC 2 Type 2 framework
• Safeguard docs, How framework coverage works
• Bastion, SOC 2 evidence collection guide
• AICPA, SOC suite of services

Last reviewed: 18 October 2026.