PW-SOC2-007
SOC 2 Security-only vs Availability / Confidentiality
How seed startups choose Security (Common Criteria) alone versus adding Availability or Confidentiality.
PW-SOC2-008 SOC 2 readiness spoke · Operate · 4/7
SOC 2 evidence pack starter for Type 1
TL;DR. Start with policies that match how you actually work, identity evidence (MFA, access reviews, joiner-mover-leaver), change and vulnerability tickets, vendor due diligence, and backup/restore tests. Name owners and a weekly pull rhythm—auditors sample systems, not intention.
Claim ladder Material statements on this page are labeled Verified, Inferred, or Unknown per editorial standards.
Key terms: evidence pack, control owner.
Educational inventory only — completing squares does not mean you are audit-ready. No localStorage.
WEEK 0 · EMPTY
No evidence folder yet. Create a dated folder and pull the inventory below when you start — educational, not an auditor PBC list.
On this page
Starter evidence inventory
- Policy set with owners and review dates.
- IdP MFA screenshots / export; break-glass procedure.
- Quarterly (or monthly) access review artifacts with tickets for removals.
- JML (joiner-mover-leaver) samples.
- Change tickets linking PR → deploy for production.
- Vulnerability scan + remediation samples.
- Vendor inventory + due-diligence notes for material subprocessors.
- Backup configuration + restore test record.
- Security awareness completion report.
- Incident response tabletop notes (even a lightweight one).
Weekly evidence rhythm beats volume
Label folders by control ID and month. Assign a human who checks completeness every week. Auditors would rather see twelve tidy months than a dump of unsorted PDFs the night before fieldwork.
Print evidence squares
Mark what you have when printing. No progress is stored in this browser.
- Policies index (security, access, change, incident, vendor)
- Access / MFA evidence
- Change / ticket samples
- Logging / monitoring samples
- Vendor due diligence
- Backups / restore test
Questions founders ask
How many samples do auditors need?
Enough to support the opinion for the period/point—your auditor sets the request list.
Are screenshots enough?
Often as part of a set; pair with tickets, configs, and exports where possible.
Who stores the pack?
A durable shared drive or GRC system with access control—not a laptop folder.
Sources
Cost and timeline figures on this site are educational planning ranges, not quotes from AICPA, CSA, Shared Assessments, or any auditor.
- primary SOC 2 — SOC for Service Organizations: Trust Services Criteria — AICPA & CIMA — Official SOC 2 topic landing; defines SOC 2 as examination of controls relevant to TSC categories.
- practitioner ProofWindow educational planning ranges — ProofWindow Editorial — Internal: cost/timeline bands are editorial planning language, not a surveyed dataset. Label Unknown for hard dollars; never attribute invented figures to AICPA/CSA/SA.
Linear path
← Path: 90-day SOC 2 Type 1 checklist for SaaS founders
Next in path: SOC 2 auditor engagement letter before the report →