Yes, a small team can run a first SOC 2 on spreadsheets and shared folders, especially a Type 1 report. It starts to break when evidence must be collected over a Type 2 period, when systems multiply, or when each audit cycle takes weeks of manual collection. Those are the signs to automate.
Why do spreadsheets work at first?
SOC 2 is built on the AICPA Trust Services Criteria, which describe objectives and points of focus, not tools. A Type 1 report covers the design of controls at a point in time, so a one time collection of policies, exports and lists can be enough. Most small companies have under twenty systems in scope and a security owner who knows each one. A workbook is cheap, transparent and educational.
What should the workbook look like?
Use a single file with these tabs, each with owner, date and status.
- Scope. Systems, categories (Security always, plus any of Availability, Confidentiality, Processing Integrity or Privacy) and boundaries.
- Control matrix. One row per control, mapped to criteria IDs such as CC6.1 or CC8.1, with owner, frequency and evidence location.
- Risk register. Risks, scores, treatments, owners, review dates.
- Policies. Each policy with version, approval date and the acknowledgment count.
- Access reviews. System, reviewer, date, changes made.
- Joiners and leavers. Ticket links and dates for each.
- Vendors. Tier, purpose, report held, report date, review date.
- Changes. Sample or full list with ticket, reviewer, release.
- Incidents and exercises. Severity, timeline, lessons.
- Evidence index. Folder links by criteria ID.
Pair it with a shared folder structured the same way and a monthly calendar of tasks.
Where does it break?
- Type 2 periods. A Type 2 report covers a period and includes tests of operating effectiveness. The auditor samples across that period, so you need dated evidence from every quarter. Rebuilding it afterwards is how people fabricate by accident, and rebuilt evidence is not evidence.
- Evidence by screenshot. Each one takes minutes, and a hundred take days.
- Population completeness. Auditors ask for the full list of changes or users for a period and sample from it. Typed lists miss entries.
- Ownership drift. The sheet shows a control owner who left last quarter.
- More than one framework. A second report means mapping the same evidence again.
- No alerting. A missed quarterly review is only noticed at year end.
What are the clear signs to automate?
Move when you can answer yes to several: a Type 2 period is starting, you add vendors or systems monthly, evidence collection takes more than a few days per quarter, you must satisfy ISO 27001 or another framework with the same evidence, customer questionnaires arrive weekly, or the security owner is the bottleneck for everything.
How do you keep spreadsheets honest?
Pull lists from the source system, not memory. Date every export. Never edit a record after the fact. If a control failed, log the exception and the fix date. Rotate review of the workbook to someone other than the owner.
What mistakes are common?
- Building the workbook before deciding scope.
- Writing policies that are stricter than practice.
- Starting the observation period without a working evidence process.
- Believing automation removes the need to understand the controls.
What to do
- Decide scope and categories first.
- Build the ten tab workbook with owners and dates.
- Pull lists from source systems with timestamps.
- Calendar every recurring control.
- Track hours spent on evidence each quarter.
- Choose your automation trigger and write it down before the Type 2 period starts.
Quick check
Is a spreadsheet acceptable for SOC 2 evidence?
SOC 2 does not require a tool. The auditor needs accurate, dated evidence and complete populations, however you keep them.
Why is Type 2 harder on spreadsheets?
It covers a period and tests operating effectiveness, so you need evidence from across the whole period, not a snapshot.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires. Evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between audits, which saves the team time for other work. Technical evidence comes from your real code and dependencies through scans, SBOMs and reachability. Safeguard's agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. The audit is done by an independent CPA firm. Safeguard helps you prepare and keep evidence ready. Book a call to see it.
Sources
- AICPA 2017 Trust Services Criteria with 2022 points of focus, report type descriptions and criteria IDs, read from the AICPA publication
Last reviewed: 18 October 2026.
