FAQ: How should we organize SOC 2 evidence folders?

Choose a structure the whole team can explain, such as reporting period, control identifier, and activity date. Keep an index linking each requested item to its location and owner. Separate working drafts from final evidence, and retain original exports where possible. Avoid renaming files repeatedly after sharing them with the auditor because that can break references. Restrict access based on sensitivity and review sharing permissions before fieldwork. The exact folder names are not prescribed by SOC 2.

Related: SOC 2 audit and compliance hub.

Further reading: NIST control-assessment guidance.

Additional FAQs

Are the proposed 2027 SOC 2 criteria final requirements?

No. As of October 30, 2026, the AICPA's proposed 2027 Trust Services Criteria and Description Criteria are exposure drafts, not final requirements. The announced comment deadline is January 15, 2027.

Do changes to compliance scripts and automation rules need review?

Treat changes according to their risk and the role the automation plays. A script that prepares an audit population or a rule that disables accounts can materially affect records or

Can we scope SOC 2 to one product rather than the whole company?

Often, yes, provided the scope accurately describes the service and the systems supporting it. Start with the customer-facing product, then trace its data, infrastructure, people, and supporting processes. Shared identity

How can we share audit evidence without exposing unnecessary sensitive data?

Agree on a secure sharing method and limit access to the people who need the evidence. Before uploading, check for credentials, customer content, personal information, and unrelated records. Ask the

How can we spot AI being added to a product we already use?

Have the product owner check for AI changes in: Ask the vendor and internal users whether AI has been added, whether it is enabled by default, and what information it

What are the SOC 2 criteria?

The five SOC 2 categories are Security, Availability, Processing Integrity, Confidentiality, and Privacy. Not every SOC 2 report covers all five categories. Read the report to see which categories and

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide