FAQ: Can one piece of evidence support more than one control?

Yes, where the record genuinely supports each control and the auditor can follow the connection. Keep one controlled copy and link it from the relevant control or request entries rather than uploading slightly different versions everywhere. Explain which part of the record supports which activity. An access review might inform more than one control, but that does not mean it proves every access-related requirement. Check the period, scope, and review details each time. Reuse should reduce administrative duplication while preserving a clear explanation of why the evidence is relevant to every control that references it.

Related: User access reviews.

Further reading: NIST control-assessment guidance.

Additional FAQs

How much review does a low-risk vendor need?

A low-risk vendor may need only a brief documented assessment. First, check: A supplier with no system access and little operational impact may need limited review. A low-cost service with

How can we share audit evidence without exposing unnecessary sensitive data?

Agree on a secure sharing method and limit access to the people who need the evidence. Before uploading, check for credentials, customer content, personal information, and unrelated records. Ask the

Can employees put customer data into an AI tool?

Only after the organization has approved that use and confirmed the relevant data, contractual, security, and privacy requirements. Check the provider's applicable terms and settings, including retention, training use, access,

Can we scope SOC 2 to one product rather than the whole company?

Often, yes, provided the scope accurately describes the service and the systems supporting it. Start with the customer-facing product, then trace its data, infrastructure, people, and supporting processes. Shared identity

What if we change a major system during the SOC 2 period?

Tell the auditor early and keep a dated change record. Explain what changed, which controls were affected, when the new process began, and where evidence from both versions is stored.

We have a small company, how do we segregate Board of Directors from Management, and then, also the Internal Audit function?

Map three roles: who runs controls, who oversees management, and who independently evaluates the results. Mark where the same person fills more than one role. For example, a suitably independent

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide