This document pre-answers common auditor evidence requests for SOC 2 Type II. Each section maps to a control and provides what we can demonstrate from automated code-level analysis, what requires additional organizational evidence, and supporting data.
Auditor may ask: "Demonstrate management commitment to integrity and ethics."
Evidence provided:
Additional evidence needed: This control requires organizational evidence: Policy docs, governance records, training evidence.
Auditor may ask: "How is internal information communicated?"
Evidence provided:
Additional evidence needed: This control requires organizational evidence: Policy docs, governance records, training evidence.
Auditor may ask: "Show me your risk assessment process."
Evidence provided:
Additional evidence needed: This control requires organizational evidence: Policy docs, governance records, training evidence.
Auditor may ask: "How do you monitor the effectiveness of controls?"
Evidence provided:
Additional evidence needed: This control requires organizational evidence: Policy docs, governance records, training evidence.
Auditor may ask: "Show me your technology general controls."
Evidence provided:
Additional evidence needed: Remediation in progress — see the Gap & Remediation Plan. Expected closure: [ORG TO COMPLETE: Target remediation date].
Auditor may ask: "Demonstrate logical access security controls."
Evidence provided:
Additional evidence needed: No additional code-level evidence needed. Organizational evidence may still be required.
Auditor may ask: "How are credentials and secrets managed?"
Evidence provided:
Additional evidence needed: No additional code-level evidence needed. Organizational evidence may still be required.
Auditor may ask: "Show me your access removal process."
Evidence provided:
Additional evidence needed: This control requires organizational evidence: Organizational policy / process documentation.
Auditor may ask: "How do you protect system boundaries?"
Evidence provided:
Additional evidence needed: Remediation in progress — see the Gap & Remediation Plan. Expected closure: [ORG TO COMPLETE: Target remediation date].
Auditor may ask: "Show me software security controls."
Evidence provided:
Additional evidence needed: No additional code-level evidence needed. Organizational evidence may still be required.
Auditor may ask: "How do you monitor system operations?"
Evidence provided:
Additional evidence needed: This control requires organizational evidence: Organizational policy / process documentation.
Auditor may ask: "Describe your change management process."
Evidence provided:
Additional evidence needed: This control requires organizational evidence: Organizational policy / process documentation.
Auditor may ask: "Show me your risk mitigation procedures."
Evidence provided:
Additional evidence needed: No additional code-level evidence needed. Organizational evidence may still be required.
Disclaimer: Code-level controls only. Coverage percentages reflect how many framework controls have matching RepoScope detectors. This is a development aid, not a certification tool — auditors make the final determination.