FAQ: What should we ask a compliance software vendor to demonstrate?

Use your own workflow as the demo script. Ask the vendor to collect an example record, show its source and date, assign an owner, record a review, handle an exception, and export the complete history. Check your actual systems rather than relying on a long integration list. Ask what is manual, what requires extra fees, and what happens when an integration fails. Include the auditor in evidence-format discussions before purchase where practical. A polished dashboard is useful only if the underlying records can support your controls and remain available when the auditor needs them.

Related: SOC 2 audit and compliance hub.

Further reading: AICPA SOC resources; NIST automated control-assessment guidance.

Additional FAQs

Are screenshots enough for SOC 2 evidence?

Sometimes, but not for every purpose. A screenshot may show a setting at a point in time while leaving out the system identity, date, full population, or change history. An

How many updates to SOC 1 have there been?

SSAE numbers identify attestation standards, not SOC 1 report versions. The major historical changes were SSAE 16 replacing SAS 70 for service-auditor reporting in 2011, followed by SSAE 18 in

How do we decide which trust services categories belong in our SOC 2?

Begin with what you promise customers and how the service could fail to meet those promises. Security is the foundation; discuss additional categories with the auditor based on the system,

What belongs in a practical employee AI-use policy?

Tell employees which tools and uses are approved, which information they may enter, and which outputs need review before use. Include a clear route for requesting a new use case

What is fourth-party risk?

Fourth-party risk is the risk to your organization from a supplier your vendor relies on. For example, your payroll provider may use a separate hosting company. An outage or security

Should we ask vendors how they manage their own third parties?

Yes, especially when the service supports important operations or gives others access to sensitive information. Ask how the vendor: For an important dependency, request a recent review example and its

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide