Can DAST findings mapped to SOC 2 controls be used as audit evidence?
I’m trying to understand how DAST evidence is treated during a SOC 2 audit.
Suppose a DAST tool identifies a vulnerability and maps it to a relevant SOC 2 control/criterion. The tool provides evidence of the vulnerability, such as the affected endpoint, request/response, severity, and remediation status.
For example:
DAST finding → vulnerability → SOC 2 control mapping → remediation → retest
Would that DAST evidence itself be considered valid evidence for the relevant SOC 2 control?
Or would the auditor generally expect additional evidence beyond the DAST finding, such as policies, scan schedules, tickets, remediation history, etc.?
I’m specifically asking about whether the DAST finding + SOC 2 mapping can serve as evidence for the mapped control, not whether a DAST report alone is enough to demonstrate overall SOC 2 compliance.
Would appreciate input from anyone who has been involved in SOC 2 audits or reviewed vulnerability-management evidence.
What about autonomous pentesting tools
I'm learning SOC 2 out of curiosity and im having this doubt for a very long time