▲ 1 r/soc2
How much SOC 2 evidence do you actually need to hold onto during the audit period?
I'm trying to get a better handle on the evidence side of SOC 2.
For controls that happen on a regular basis, such as access reviews, do you usually keep records of every time the control is performed, or just the samples that the auditor asks for later on?
Not sure what the normal approach is here.
u/RynMitchell — 12 days ago