TL;DR
Stop taking screenshots for SOC 2 evidence. AWS, Azure, GitHub, and Google Workspace all have APIs and audit logs that can be exported automatically. Set up scheduled exports and your auditor gets consistent, timestamped evidence without anyone taking screenshots in December.
The December Panic
Every year, the same story. Audit period ends December 31st. Someone remembers in mid-December that evidence needs to be collected. Cue two weeks of frantic screenshot-taking, digging through emails, and bothering everyone for "proof" of things that happened months ago.
Screenshots are terrible evidence anyway. They're easy to fabricate, lack timestamps, and require manual effort to collect. Auditors know this—which is why they ask follow-up questions that consume even more time.
There's a better way. Most of the evidence SOC 2 auditors need is already being logged by tools you're using. You just need to export it.
What You Can Automate
AWS CloudTrail + Config
CloudTrail logs every API call. AWS Config tracks resource configurations over time. Together, they prove who did what, when, and what your infrastructure looked like at any point.
GitHub / GitLab Audit Logs
Repository audit logs show code changes, branch protection enforcement, PR approvals, and access modifications. Export via API monthly.
Google Workspace / M365 Admin
Admin audit logs cover user provisioning, deprovisioning, MFA enrollment, and security settings. The Reports API makes this exportable.
Jira / Linear / Ticketing System
Change management evidence: tickets linked to deployments, approval workflows, incident tracking. Export via API or built-in reports.
The Time Savings
| Evidence Type | Manual | Automated |
|---|---|---|
| Access review (quarterly) | 4 hours | 15 min export |
| Change management samples | 6 hours | API query |
| Infrastructure configuration | 8 hours | Config snapshot |
| User provisioning proof | 3 hours | Audit log export |
| Total (annual) | 80+ hours | ~8 hours |
How To Start
You don't need to automate everything at once. Start with the highest-volume evidence:
- Week 1: Enable CloudTrail (if not already) and set up S3 export with lifecycle policies
- Week 2: Create a monthly scheduled export from your identity provider
- Week 3: Build a simple script to pull GitHub audit logs monthly
- Week 4: Document the export locations for your auditor
Pro tip: Share your export schedule with your auditor upfront. Most prefer API exports over screenshots—it makes their job easier and reduces back-and-forth.
The 20% That Still Needs Humans
Some evidence can't be automated: policy document reviews, risk assessments, vendor due diligence, security awareness training completion. Focus automation on the repetitive technical evidence so you have time for the judgment-based items.
