A large share of SOC 2 evidence can be collected directly from systems, with timestamps, instead of by screenshot: configuration state, user and permission lists, change records, vulnerability scans, logs and job results. Evidence that records a human decision, such as a review, an approval or a risk judgment, still needs a person.
Why are screenshots weak evidence?
A screenshot shows one moment on one screen, is easy to crop or redo, and is hard to repeat. A Type 2 report covers a period and includes tests of operating effectiveness, so an auditor needs proof across time. A system export with a date and a source answers that better. Your auditor decides what is acceptable, and may ask how an export was generated to be sure it is complete and accurate.
What can be collected from systems?
Map by criteria. The IDs below come from the AICPA Trust Services Criteria.
- CC6.1 and CC6.2: identity provider settings such as MFA enforcement and password policy, the list of users and their roles, and account creation records.
- CC6.3: access change logs, offboarding timestamps against HR termination dates, and group membership over time.
- CC6.6 and CC6.7: firewall and network rules, encryption settings for storage and transit, and cloud configuration checks.
- CC6.8: endpoint protection status and device management compliance reports.
- CC7.1: vulnerability scan results, open and closed findings with dates, and dependency and SBOM data from code.
- CC7.2: alert configurations and alert history, and log pipeline health.
- CC8.1: source control settings such as required reviews, pull request approval history, CI test results and deployment logs.
- A1.2 and A1.3: backup job results and restore test outputs, if Availability is in scope.
- C1.1: encryption configuration for data stores and retention settings.
- CC1.4 and CC2.2: training completion records and policy acknowledgment logs.
What still needs a human?
CC3.2 risk assessments, CC4.1 evaluations of whether controls work, CC7.4 incident response decisions and tabletop records, CC9.2 vendor risk reviews, and management approval of policies need judgment and signatures. Access reviews are a hybrid: the system produces the user list, a reviewer decides who keeps access and signs. Automate the list and keep the decision.
How do you make exports trustworthy?
Use a connected collection that reads from the source on a schedule and stamps the time. Keep the query or configuration that produced it. Include the full population when asked, such as every change or every leaver, not a sample picked by hand. Store results in a place that cannot be edited by the control owner. Check coverage: a collector that sees only some accounts or repositories gives false comfort.
What about gaps in automation?
Not every system has an integration. For those, set a recurring task with an owner and a defined export, and record the date. Treat manual exports with the same rules as automated ones.
What does continuous collection change?
You learn about drift while it is still fixable. A failed check in the middle of a period becomes an exception you can explain and correct, instead of a surprise during fieldwork. It also shortens audit prep, because population lists already exist.
What to do
- List your in scope systems and the criteria each supports.
- For each criterion, name the system export that proves it.
- Connect collection to the source systems and verify coverage.
- Set exports to run on a schedule with timestamps.
- Keep human decisions, such as access reviews, as signed records.
- Handle systems without integrations with owned recurring tasks.
- Review failed checks weekly and log the fix.
- Share the approach with your auditor early.
Quick check
Will an auditor accept automated evidence?
Often yes, but the auditor decides. Be ready to show how the data was produced and that the population is complete.
Can access reviews be fully automated?
The user lists can be. The decision to keep or remove access is a human judgment that needs a signed record.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs between audits, which saves the team time to focus on other work. Technical evidence comes from your real code and dependencies, using scans, SBOMs and reachability, not just policies. Autonomous remediation is available too: the agent can open tested fix pull requests for vulnerable dependencies and other findings. It is off by default, every category starts on Manual, and you choose which categories run automatically and at what approval level. Safeguard helps prepare and keep evidence ready; the audit is done by an independent CPA firm. Book a call.
Open the framework mapping demo
Sources
- AICPA, 2017 Trust Services Criteria with revised points of focus (2022): AICPA Trust Services Criteria
Last reviewed: 18 October 2026.
