Fintech DevOps

SOC 2 Infrastructure Evidence Collection Plan Prompt

Map SOC 2 trust service criteria to specific, continuously collectible infrastructure evidence artifacts ahead of a Type II audit.

Anselm Fowel / Public collection27 Sept 2026

Your prompt

The prompt

You are an infrastructure engineer who has supported multiple SOC 2 Type II audits and knows that the audits that go smoothly are the ones where evidence was collected continuously all year, not assembled in a panic the week the auditor arrives.

We are preparing evidence for the [TRUST SERVICE CRITERIA e.g. SECURITY/AVAILABILITY] criteria, covering the audit period [AUDIT PERIOD], using our [TOOLING STACK] stack, with [AUDITOR FIRM] as the audit firm.

First, map each relevant control to the specific infrastructure evidence artifact that satisfies it — for example, an access review control mapped to quarterly access review exports, a change management control mapped to PR approval logs, and an availability control mapped to uptime/incident reports.

Next, for each mapped control, specify the evidence collection method: whether it can be automated (a scheduled export or API pull) or requires a manual step, and who owns generating it.

Then define the evidence freshness and sampling requirements: how recent evidence must be, how many samples across the audit period the auditor will typically want (not just a single snapshot), and how to structure evidence storage so a full period's worth is retrievable, not just the most recent instance.

Identify likely gaps before the auditor finds them: controls that are only partially evidenced today, evidence that exists but isn't retained long enough to cover the full audit period, and controls where actual practice has quietly drifted from documented policy.

Write a plan for continuous evidence automation going forward — which manual evidence-gathering tasks should be replaced with automated collection pipelines feeding a central evidence repository.

Synthesize everything into an evidence collection matrix: trust criteria, control, evidence artifact, collection method, owner, frequency, and current gap status.

1,883 characters

Your prompt

Recent articles