FAQ: Are screenshots enough for SOC 2 evidence?

Sometimes, but not for every purpose. A screenshot may show a setting at a point in time while leaving out the system identity, date, full population, or change history. An export or source record may provide better coverage for a recurring activity. Ask what the auditor needs to establish before collecting hundreds of images. When screenshots are appropriate, retain the relevant context and avoid cropping away information needed to interpret them. Protect sensitive data during sharing. Choose the evidence format that supports the question being tested rather than assuming one format is always acceptable.

Related: SOC 2 audit and compliance hub.

Further reading: NIST control-assessment guidance.

Additional FAQs

What if we change a major system during the SOC 2 period?

Tell the auditor early and keep a dated change record. Explain what changed, which controls were affected, when the new process began, and where evidence from both versions is stored.

SOC1 vs SOC2: Differences?

SOC 1 asks whether a service organization’s controls support reliable financial reporting by its customers. For example, a payroll provider’s processing can affect a customer’s payroll expense figures. SOC 2

What if no employee left or no incident occurred during the period?

Do not manufacture an event to fill an evidence request. Confirm that there really were no relevant occurrences and retain the records supporting that conclusion. For departures, that might involve

How should AI-related mistakes fit into incident response?

Use the existing reporting route, but make sure it recognizes AI-specific problems such as unintended disclosure, unsupported customer-facing statements, or an agent taking an unauthorized action. Record the use case,

What is SSAE 18 (formerly SSAE 16)?

SSAE No. 18, Attestation Standards: Clarification and Recodification, clarified and recodified the AICPA attestation standards. It superseded SSAE No. 16 and other earlier standards, with specified exceptions. It covered more

What records should we keep from AI model evaluations?

Keep the purpose of the evaluation, the system and version tested, the relevant configuration, the approved test set or its controlled reference, results, and the reviewer’s decision. Explain the intended

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide