SOC 2 Evidence (Engineering View)

SOC 2 isn't a prescriptive standard — auditors evaluate whether your controls as designed and as operating meet the Trust Services Criteria. The art is mapping abstract criteria (CC6.1, CC7.4, etc.) to concrete code/CI artifacts. This skill is that mapping.

When to use

• Starting SOC 2 Type 1 or Type 2 prep (typically 6–12 months out from audit).
• Working with Vanta / Drata / Secureframe / Sprinto and they ask "what evidence do you have for control X?"
• Sales-driven: customer asks "are you SOC 2 compliant?" and you need to articulate posture.
• Pre-audit gap assessment.

When NOT to use

• Looking for legal advice — work with an auditor.
• ISO 27001 — overlaps but distinct framework; mapping is different.
• Pure compliance "checkbox" mode — SOC 2 done well changes how engineering operates.

Trust Services Criteria you'll actually face