FAQ: How can we share audit evidence without exposing unnecessary sensitive data?

Agree on a secure sharing method and limit access to the people who need the evidence. Before uploading, check for credentials, customer content, personal information, and unrelated records. Ask the auditor whether a reduced export or redacted copy will meet the testing purpose. Keep enough identifiers and context to make the evidence understandable, and document meaningful redactions. Do not alter the source record to hide an exception. Establish retention and access-removal responsibilities for the evidence workspace. A well-organized, restricted evidence package is easier to review than a broad export containing information the audit never needed.

Related: SOC 2 audit and compliance hub.

Further reading: NIST control-assessment guidance.

Additional FAQs

Are Third Party Vendor reviews required for SOC 1 and SOC 2?

Review outsourced services that can affect the in-scope system or controls. The extent of review should reflect the service and its risks. Where a vendor supplies an assurance report, assess

Are screenshots enough for SOC 2 evidence?

Sometimes, but not for every purpose. A screenshot may show a setting at a point in time while leaving out the system identity, date, full population, or change history. An

When is SSAE-18 Effective?

SSAE-18 became effective for practitioners’ reports dated on or after May 1, 2017.

What is SSAE 18 (formerly SSAE 16)?

SSAE No. 18, Attestation Standards: Clarification and Recodification, is an AICPA standard that clarified and recodified the attestation standards. It superseded SSAE No. 16 and other earlier standards, with specified

What if no employee left or no incident occurred during the period?

Do not manufacture an event to fill an evidence request. Confirm that there really were no relevant occurrences and retain the records supporting that conclusion. For departures, that might involve

SOC 1 or HITRUST?

The SOC 1 has a completely different purpose than HITRUST. Typically a company would perform both if they are a TPA processing medical claims and other claims, where, there is

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide