SOC 2 Type II readiness: 42 evidence requests, with vendor risk and offshore contractors as the two weak spots

Scope summary

Assumptions: The audit period (1 January to 31 December 2024) and fieldwork start (10 February 2025) are already past as of 6 October 2026. I kept them as the anchor and give each due date as an offset from fieldwork plus the calendar date. Where a system is not named (HRIS, ticketing, CI/CD, endpoint management, backup tooling, background checks) the row is tool-neutral and Notes says to confirm the system. The AICPA origin PDF needs a free login and I did not open it. Criterion IDs and wording were checked against a public mirror of the AICPA Trust Services Criteria and against the AICPA download page for the 2017 TSC with revised points of focus (2022), which describes the five categories and is dated 30 September 2023.

Framework: SOC 2 Type II, 2017 Trust Services Criteria (revised points of focus, 2022). In scope: the Common Criteria (Security, CC1 to CC9) and Availability (A1.1 to A1.3). Confidentiality, Processing Integrity and Privacy are out of scope, so no C, PI or P rows appear.
Company: 60-person B2B SaaS, one US entity, so no intercompany or consolidation rows. Systems: AWS, Okta, GitHub, Stripe (billing).
Period and anchor: period testing for 12 months; fieldwork 10 February 2025. Populations are due before samples.
Extra emphasis: vendor risk (rows 28 to 33) and offshore contractors (rows 34 to 36), plus a short top-risk list.

Sample sizes are the auditor's call. SSAE 18 and AT-C 205 set no required sample number. The same page says about 25 to 60 samples are commonly observed for higher-frequency controls and that quarterly controls are often tested nearly in full. That is observed practice, not a rule, so confirm sampling with your auditor.

PBC request and control-evidence table

All samples must be redacted or masked. Do not send credentials, secrets, cardholder data, or personal or health data. Every Criterion link goes to the TSC mirror unless a different page is shown.

#	Area	Request / evidence item	Criterion reference	Period or point-in-time	Suggested owner	Due date	Format	Notes / common auditor pitfalls
1	System description	Draft section III system description: services, infrastructure (AWS accounts and regions), software, people (employees and offshore contractors), data flows, boundaries, subservice orgs (AWS, Stripe)	CC2.1, CC2.3	Point-in-time	Compliance Lead	Fieldwork −8 wks (16 Dec 2024)	PDF or Word draft	Suggested: describe offshore contractors as part of "people". Description must match actual architecture diagrams.
2	Governance	Org chart and role descriptions, including contractor roles and reporting lines	CC1.3	Point-in-time	Head of People	Fieldwork −8 wks (16 Dec 2024)	PDF	CC1.3 covers structures, reporting lines and authorities. Show contractors on the chart.
3	Governance	Code of conduct and signed acknowledgments (employees and contractors)	CC1.1	Population → sample	Head of People	Population Fieldwork −4 wks (13 Jan 2025)	CSV of acknowledgments plus redacted samples	Auditors commonly test that acknowledgments exist for people hired in the period. Contractors are often missed.
4	Governance	Board or management meeting minutes showing security and risk oversight	CC1.2	Period	CEO	Fieldwork −4 wks (13 Jan 2025)	PDF minutes, redacted	Suggested: quarterly cadence; one missing quarter is a likely exception.
5	Policies	Information security policy, access control, change management, incident response, backup and DR, vendor management and acceptable use policies, each with approval date and version history	CC5.3	Point-in-time	Compliance Lead	Fieldwork −8 wks (16 Dec 2024)	PDF with version log	Policies approved after 1 Jan 2024 need proof of prior-version review. Policy must say what you actually do.
6	Risk assessment	Annual risk assessment and risk register, including vendor and business-partner risk, fraud and change-related risks	CC3.2, CC3.4	Period	Compliance Lead	Fieldwork −6 wks (30 Dec 2024)	XLSX or PDF, with approval record	Must be dated inside the period. Also supports the vendor compensating control (row 31).
7	Monitoring	Internal control self-assessment or compliance-platform control-status export, and management review notes	CC4.1	Period	Compliance Lead	Fieldwork −4 wks (13 Jan 2025)	CSV or PDF export	Suggested: tool-neutral; confirm which compliance platform is used.
8	HR	New-hire population for 2024 (employees and contractors) with start dates	CC1.4	Population → sample	Head of People	Fieldwork −4 wks (13 Jan 2025)	CSV from HRIS (system to confirm)	Population must be complete and tie to Okta accounts. Auditor draws sample from it.
9	HR	Background-check completion and signed confidentiality/NDA for sampled new hires	CC1.4	Population → sample	Head of People	Fieldwork −2 wks (27 Jan 2025)	Redacted PDF confirmations	Suggested: sample 25 or fewer new hires at 60 headcount; auditor decides. Do not send reports with personal data.
10	HR	Security awareness training completion list and training content	CC1.4	Period	Head of People	Fieldwork −4 wks (13 Jan 2025)	CSV from training tool	Late completions and missing contractors are common exceptions.
11	HR	Annual performance or accountability review records (redacted)	CC1.5	Population → sample	Head of People	Fieldwork −2 wks (27 Jan 2025)	Redacted PDF	Suggested: a completion summary is usually enough; avoid full reviews.
12	HR	Termination population for 2024 (employees and contractors) with last-day and access-removal dates	CC6.5	Population → sample	Head of People	Fieldwork −4 wks (13 Jan 2025)	CSV from HRIS	Completeness is the usual weakness. Contractors who leave rarely appear in the HRIS.
13	Access (Okta)	Okta user list with status at period end, plus last-login and MFA enrollment evidence. Okta documents a Usage report, MFA Usage report and Password Health report (CSV) that can support the last-login and MFA parts	CC6.1	Point-in-time	IT/Security Admin	Fieldwork −4 wks (13 Jan 2025)	CSV export with timestamp	Export date matters: a Dec 2024 pull is more useful than a Jan 2025 pull. Include a note on whether each field maps to the Okta report.
14	Access (Okta)	Authentication policy settings: MFA requirement, password policy, session lifetime, shown by timestamped screenshot	CC6.1, CC6.6	Point-in-time	IT/Security Admin	Fieldwork −4 wks (13 Jan 2025)	Timestamped screenshots	Auditors check that MFA covers contractors, not only employees.
15	Access (AWS)	AWS IAM credential report for each in-scope account. AWS documents that it lists users and the status of passwords, access keys and MFA devices	CC6.1, CC6.3	Point-in-time	Head of Engineering	Fieldwork −4 wks (13 Jan 2025)	CSV, redacted	A snapshot only. Root-account MFA and old access keys draw questions.
16	Access (GitHub)	GitHub organization member and outside-collaborator list with roles, and 2FA requirement setting	CC6.2, CC6.3	Point-in-time	Head of Engineering	Fieldwork −4 wks (13 Jan 2025)	CSV or screenshot	Outside collaborators are where offshore contractors usually sit. Reconcile with HR list.
17	Access	Access-provisioning population (Okta, AWS, GitHub) for 2024 and approval tickets for sampled grants	CC6.2	Population → sample	IT/Security Admin	Population Fieldwork −4 wks; samples −2 wks	CSV plus redacted ticket exports	Approval must come before access. Suggested: ticket system to be confirmed.
18	Access	Access-change and role-change population, with manager approval for sampled changes	CC6.3	Population → sample	IT/Security Admin	Population Fieldwork −4 wks; samples −2 wks	CSV plus tickets	Privilege increases without approval are a frequent exception.
19	Access	Terminated-user access removal evidence for sampled leavers. Okta documents a Deprovision Details report	CC6.5	Population → sample	IT/Security Admin	Fieldwork −2 wks (27 Jan 2025)	Redacted logs and screenshots	Compare HR last day to Okta, AWS and GitHub removal dates. Check separately for GitHub and AWS keys.
20	Access	Quarterly or semiannual user access review for Okta, AWS, GitHub and Stripe Dashboard with reviewer sign-off	CC6.3	Period	Compliance Lead	Fieldwork −4 wks (13 Jan 2025)	PDF or signed export	Review must show completeness of the user list and changes made. A quarterly control often gets tested nearly in full.
21	Network	AWS security group and network configuration summary, plus WAF or perimeter controls if used	CC6.6	Point-in-time	Head of Engineering	Fieldwork −4 wks (13 Jan 2025)	Config export or screenshot	Open management ports are a common finding.
22	Encryption	Evidence of encryption in transit and at rest for production data stores (AWS settings), key management	CC6.1, CC6.7	Point-in-time	Head of Engineering	Fieldwork −4 wks (13 Jan 2025)	Timestamped config screenshots	Suggested: mention only Security-category data since Confidentiality is not in scope.
23	Endpoints	Endpoint inventory and malware protection or device management status for company laptops, and the contractor-device approach	CC6.8	Point-in-time	IT/Security Admin	Fieldwork −4 wks (13 Jan 2025)	CSV from endpoint tool (to confirm)	Contractor devices are often unmanaged. State the compensating approach.
24	Physical	Statement that AWS hosts the production environment, and office or remote-work physical access approach	CC6.4	Point-in-time	Compliance Lead	Fieldwork −6 wks (30 Dec 2024)	PDF memo plus AWS SOC report	Physical access to AWS data centers is typically carved out as a subservice org control. Confirm with auditor.
25	Operations	Vulnerability scan results and remediation tracking; penetration test report	CC7.1	Period	Head of Engineering	Fieldwork −4 wks (13 Jan 2025)	PDF reports, CSV	Open critical findings with no ticket are a standard exception.
26	Operations	Monitoring and alerting configuration; CloudTrail trail settings. CloudTrail event history keeps only the past 90 days of management events, so a full-year record needs a trail or equivalent	CC7.2	Period	Head of Engineering	Fieldwork −4 wks (13 Jan 2025)	Config screenshots, sample log extracts	If no trail existed in early 2024, tell the auditor now.
27	Incidents	Incident population for 2024 (including none, if true), tickets, post-incident reviews, and one tabletop or test record	CC7.3, CC7.4, CC7.5	Population → sample	Head of Engineering	Fieldwork −4 wks (13 Jan 2025)	Redacted tickets and PDF	If there were no incidents, expect the auditor to inquire and test the process by walkthrough.
28	Vendor risk (gap)	Complete vendor inventory with owner, data access and criticality tier (AWS, Okta, GitHub, Stripe, offshore contractor firms, others)	CC9.2	Point-in-time	Controller	Fieldwork −6 wks (30 Dec 2024)	XLSX	Auditsuisse lists inventory, tiering, due diligence, contracts and monitoring as the steps of a CC9.2 program. With no process in 2024, state this plainly.
29	Vendor risk (gap)	Vendor SOC 2 reports or assessments for critical vendors, with coverage period and complementary user entity controls. Stripe states SOC 1 and SOC 2 Type II reports are produced annually and available on request, plus a public SOC 3	CC9.2	Population → sample	Controller	Fieldwork −4 wks (13 Jan 2025)	PDF reports plus review memo	K Financial notes that vendor SOC report reviews and risk assessments must be performed during the audit period. Suggested (inference): a review done after 31 Dec 2024 likely will not count for the period.
30	Vendor risk (gap)	Remediation evidence: vendor risk policy approval date, onboarding checklist and any retroactive reviews, each dated	CC9.2	Point-in-time	Compliance Lead	Fieldwork −4 wks (13 Jan 2025)	PDF with dates	Suggested: show that the process started inside the period, even late. Backdating is a serious risk.
31	Vendor risk (gap)	Compensating control: annual risk assessment covering vendors and a management review of supplier risk. K Financial gives two example compensating controls: a vendor risk tool, or vendor risk evaluated in the annual risk assessment plus executive review	CC9.2	Period	CEO	Fieldwork −4 wks (13 Jan 2025)	PDF minutes and risk register extract	The same page says management and the auditor should discuss compensating controls to avoid a qualified opinion. Auditor decides if sufficient.
32	Vendor risk (gap)	Management response to the CC9.2 gap: root cause, remediation plan with owner and dates	CC9.2	Point-in-time	CEO	Fieldwork −2 wks (27 Jan 2025)	Signed PDF	Suggested: auditors usually include management's response in the report if an exception is noted.
33	Vendor risk (gap)	Subservice org monitoring for AWS and Stripe: SOC report review, coverage dates, bridge letter if the report ends before 31 Dec 2024	CC9.2	Period	Controller	Fieldwork −4 wks (13 Jan 2025)	PDF reports and review memo	Auditsuisse states a bridge letter is not a report and covers a short gap, roughly up to three months in common auditor practice, not a codified AICPA limit.
34	Offshore contractors (gap)	Contractor roster with firm, country, role, start and end dates, systems accessed and sponsor	CC6.2	Population → sample	Head of People	Fieldwork −4 wks (13 Jan 2025)	CSV	Roster must tie to Okta, AWS and GitHub accounts. Unknown contractor accounts are a likely exception.
35	Offshore contractors (gap)	Contractor agreements with confidentiality, security obligations and return-of-assets terms, and background-check or equivalent evidence	CC1.4, CC9.2	Population → sample	Legal/Procurement	Fieldwork −2 wks (27 Jan 2025)	Redacted PDFs	Suggested: legal review of local-law limits on background checks; treat as an open item.
36	Offshore contractors (gap)	Contractor access controls: MFA, least-privilege roles, device approach, and approval tickets for sampled grants and removals	CC6.2, CC6.3	Population → sample	IT/Security Admin	Population Fieldwork −4 wks; samples −2 wks	CSV, tickets, screenshots	Auditors typically sample contractor items separately from employee items. Suggested: expect extra testing in a first year.
37	Change management	Population of production changes in 2024 from GitHub (merged pull requests), with approval and test evidence for samples. GitHub branch protection can require pull request reviews and status checks before merging	CC8.1	Population → sample	Head of Engineering	Population Fieldwork −4 wks; samples −2 wks	CSV of merges, redacted PR exports	Branch protection by default does not apply to admins or custom roles with the bypass permission unless that option is enabled, so show whether admin bypass was possible. Samples for high-frequency controls are commonly 25 to 60.
38	Change management	Emergency or out-of-band change list and post-hoc approvals; rollback procedure	CC8.1	Population → sample	Head of Engineering	Fieldwork −2 wks (27 Jan 2025)	CSV, redacted tickets	Direct pushes to the main branch are the usual exception.
39	Availability	Capacity and performance monitoring: AWS dashboards, alert thresholds, and records of capacity reviews	A1.1	Period	Head of Engineering	Fieldwork −4 wks (13 Jan 2025)	Screenshots, alert export	Evidence of someone acting on alerts matters more than the dashboard.
40	Availability	Backup configuration (AWS backup or database snapshot settings), backup job success logs for 2024, and a sampled restore test	A1.2	Population → sample	Head of Engineering	Population Fieldwork −4 wks; samples −2 wks	Log export, screenshots	Suggested: backup tooling to be confirmed. Failed jobs without follow-up tickets are a common exception.
41	Availability	Disaster recovery and business continuity plan, plus the DR or failover test record and results	A1.3, CC9.1	Period	Head of Engineering	Fieldwork −4 wks (13 Jan 2025)	PDF plan, test report	A plan with no test in the period fails A1.3. Annual controls usually have only 1 to 2 instances, so the whole population is often tested.
42	Availability	Uptime and status-page record, outage list and customer communications for 2024	A1.2, CC2.3	Period	Head of Engineering	Fieldwork −4 wks (13 Jan 2025)	PDF or CSV	Outages should tie to the incident population in row 27. Suggested: confirm the status tool.

Timeline works backward from 10 February 2025

Milestone	Date (offset from fieldwork)	What happens
Kickoff and scoping call	2 Dec 2024 (−10 wks), Suggested	Confirm criteria, entities, subservice orgs, sampling approach and contractor treatment with the auditor.
Policies and system description final	16 Dec 2024 (−8 wks)	Rows 1, 2, 5. Approved and versioned.
Risk assessment and vendor inventory	30 Dec 2024 (−6 wks)	Rows 6, 24, 28.
Population lists delivered	13 Jan 2025 (−4 wks)	HR, access, change, incident, backup and contractor populations, so the auditor can draw samples.
Samples and vendor package delivered	27 Jan 2025 (−2 wks)	Redacted sample evidence, vendor reports, management response (row 32).
Walkthroughs and evidence gap closure	3 Feb 2025 (−1 wk)	Walkthrough support for access, change, incident and backup.
Fieldwork starts	10 Feb 2025	Auditor testing begins.
Management representation letter	Near report issue; date set by auditor	Management signs the representation letter. Date is the auditor's to set.

Top-risk items

Vendor risk process missing for 2024 (rows 28 to 33): CC9.2 controls must operate during the audit period; a process started after 31 December 2024 does not cover the period.
Compensating control may not be accepted (row 31): the auditor decides whether the annual risk assessment and management review are enough, so ask early.
Offshore contractor access untracked (rows 34 to 36): contractors in Okta, GitHub or AWS but not in the HR list create a population gap.
Termination completeness (rows 12, 19): contractor offboarding often lives outside the HRIS.
Change approval enforcement (row 37): admins can bypass branch protection by default.
Logging history (row 26): event history alone keeps 90 days, so a full-year record needs a trail.
DR and restore tests not done in 2024 (rows 40, 41): Availability testing needs evidence inside the period.

Do next

Send the auditor the scope questions in Open items and agree sampling and carve-out treatment of AWS and Stripe.
Build the vendor inventory (row 28) and write down the compensating-control argument (row 31) with the CEO.
Reconcile the contractor roster with Okta, GitHub and AWS accounts (rows 34 and 36).
Export population lists (rows 8, 12, 17, 18, 27, 37, 40) with timestamps before the auditor selects samples.
Check CloudTrail, backup and DR test coverage for the full year and tell the auditor about any gap.

Open items

AICPA origin text not opened: the PDF needs a free login. Criterion IDs and wording come from a public mirror; verify against the official document.
Systems to confirm: HRIS, ticketing, endpoint management, backup tooling, training and background-check providers.
Scope decisions: whether Stripe is treated as a subservice org (carve-out) or a vendor; whether AWS physical controls are carved out; GitHub plan and audit-log availability (the export docs I read are for GitHub Enterprise Cloud); whether offshore contractor devices are in scope.
Sample sizes are not set by the standards; all counts above are Suggested or reported as observed practice.
Legal: local-law limits on contractor background checks are not researched.

Coverage note

I could not read the AICPA origin PDF (login required) or the Deloitte DART version (paywalled), and the Okta log-export support page failed to load. Evidence is drawn from vendor documentation and CPA-firm and directory articles, which are practitioner views, not AICPA guidance.

This is a preparation aid, not assurance, an audit opinion, or legal or regulatory advice. Confirm scope with your auditor.