For SOC 2, show that your incident response plan exists, that people know it, and that you used or exercised it. Keep the plan, a record of a tabletop exercise at least once in the period, tickets for real incidents with timelines, and the follow up actions you closed.
What the auditor wants to see
The auditor tests whether you identify, respond to and learn from incidents. If you had no real incidents, they will look for evidence that you practiced. If you had incidents, they will sample them and check each for the steps your plan describes.
Evidence for a tabletop exercise
Run a scenario discussion with the people who would respond. Keep:
- The date, attendees and scenario.
- The decisions made and questions that came up.
- Gaps found, such as a missing contact or unclear decision rights.
- Actions with owners and due dates.
A one page record is enough. The follow up actions matter more than the length of the notes.
Evidence for real incidents
Each incident ticket should show detection time, who responded, severity, containment, communication, resolution and root cause. Add a post incident review for anything meaningful. If customers were notified, keep the notice and the date.
Define what counts as an incident in your plan. Auditors will compare your definition with your ticket history, and a large gap between them raises questions.
Common gaps
- The plan names people who left.
- Severity levels are defined but never used in tickets.
- Reviews are held but actions are never closed.
- Security events handled in chat with no ticket.
Keep the plan current
Review the plan at least yearly and after any major incident. Record the review date and who approved the changes.
Scenarios worth practicing
Pick scenarios that fit your business. Examples: a leaked access key in a public repository, a ransomware message on an employee laptop, a customer reporting that they can see another customer's data, a vendor telling you they were breached. Each tests different people and decisions.
Include a non-technical participant, such as someone from support or legal, so communication and decision rights get tested too.
Run a short exercise
Thirty to sixty minutes is enough. Read the scenario in stages, ask what each person would do at each stage, and write down the questions nobody could answer. Those questions become your action list. Close the actions and keep the closure records, since auditors often ask what happened to them.
Link detection to response
Auditors also check that alerts lead somewhere. Keep an example of an alert that became a ticket, was triaged and was closed with a reason. If many alerts are closed with no note, expect questions. A short closing comment such as "benign, scheduled scan from the vulnerability tool" is enough to show a human looked.
Quick check
If we had no incidents, are we fine?
Not on that basis alone. Show the plan and a tabletop exercise, plus evidence that alerts are monitored and triaged.
Last reviewed: 19 October 2026.
