Organize SOC 2 evidence by control, then by period, and name every file so that someone who has never seen it can tell what it is and when it was produced. A predictable structure cuts the time spent answering requests and makes repeat audits much easier.
Organize by control, not by audit request
Auditor request lists change from year to year. Your controls change more slowly. If the folders follow your control IDs, you can reuse them. Map each request to a control and put the file in that control's folder.
A workable layout:
- 00 Index and request log
- 01 Governance and policies
- 02 Access control
- 03 Change management
- 04 Monitoring and incident response
- 05 Vendor management
- 06 People: onboarding, training, offboarding
- 07 Risk assessment
Add a subfolder per audit period inside each, for example 2026 H1.
Naming convention
Use a pattern that sorts well: control ID, short description, date in year-month-day form, and a version if needed. Example: ACC-03 quarterly access review 2026-09-30 v1.
Avoid names such as final, final2 or screenshot. Do not put customer names or personal data in file names.
Add a one page index
Keep an index in the top folder that lists each control, what evidence you hold, who owns it and how it was produced. When an auditor asks for something, the index is the first place to look. It also exposes gaps early.
Keep the source system link
Where evidence comes from a system, add a note with the system name, the report or query used and the date. An export with no provenance is harder to defend than one with a short note.
Control who can edit
Evidence should not change after you collect it. Use a location with version history and limited write access. Auditors may ask how you know a file was not altered.
A worked retrieval example
The auditor asks for proof that a terminated user lost access on time. You open the people folder, find the offboarding subfolder, and see the roster export, the removal ticket and the identity provider log for that person, each named with a date. You attach three files and a one line note. Without a structure the same request can take half a day and a chat with three people. Multiply that by two hundred requests and you see why this is worth an afternoon of setup.
Routines that keep it tidy
Once a week, move loose exports into the right folder. Once a month, check that every control with a monthly frequency has a file for the month. At period end, run a count of files per control and look for empty folders. Empty folders are the controls most likely to cause an exception. Give the repository an owner and a backup, like any other control.
Retention of the structure itself
Do not rename folders mid period. If you must reorganize, keep a mapping note so earlier references still resolve. Back up the evidence store and test restoring it, because losing a quarter of evidence cannot be fixed afterward.
A short sample tree
Under 02 Access control you might hold a subfolder for 2026 H1 with a quarterly access review export for each quarter, an approver sign off, and a note listing the systems reviewed. Under 03 Change management you might keep a sample query of production deployments and the branch protection settings. Under 06 People you might keep the new hire checklist template and the training completion report.
Keep the structure shallow. Three levels is usually enough. Deep nesting makes files hard to find and hard to review.
Quick check
Should the auditor get access to the whole folder?
Usually no. Share what each request needs, through the auditor's portal or a controlled share, and keep the rest private.
Safeguard's compliance and evidence automation can collect and organize evidence by control. A folder convention still helps for anything gathered by hand.
Last reviewed: 19 October 2026.
