Guides · SOC 2 · Security
The SOC 2 Infrastructure Checklist Auditors Actually Use
· 4 min read
When an enterprise customer asks for SOC 2, your compliance platform (Vanta, Drata, or similar) makes the policies easy — and then leaves you staring at a wall of failing infrastructure checks. Those checks map to six control areas: access, logging, encryption, backups/DR, change management, and monitoring. Here’s the actual checklist, so you can gap-assess your own cloud in an afternoon.
What infrastructure controls does a SOC 2 audit check?
Auditors verify the technical controls behind the Security trust criterion (the one every SOC 2 includes). In practice, on AWS/GCP/Azure, that means demonstrating six things: only the right people can access systems (least privilege + MFA), you can reconstruct what happened (centralized logs with retention), data is encrypted at rest and in transit, you can recover from disaster (tested backups), changes are controlled (IaC + reviewed deploys), and you’d notice a problem (monitoring + alerting).
The checklist
1. Access control
- SSO for every system that supports it; no shared logins anywhere
- MFA enforced on cloud console, VCS, and email — not optional, enforced
- Least-privilege IAM roles; nobody routinely operates as admin/root
- Offboarding process that provably revokes all access within 24 hours
- Quarterly access reviews, recorded
2. Logging & audit trails
- CloudTrail / Cloud Audit Logs / Activity Log enabled in every account and region
- Application and infrastructure logs centralized, not scattered per-server
- Retention meets your policy (12 months is the common bar) and logs are tamper-resistant
- Log access is itself logged
3. Encryption
- At rest: databases, object storage, volumes, snapshots — including the forgotten ones
- In transit: TLS everywhere, including service-to-service inside your VPC
- Key management documented (KMS, rotation policy, who can use which key)
4. Backups & disaster recovery
- Automated backups on every data store, with defined retention
- A restore you have actually performed — “backups enabled” without a tested restore fails the spirit and often the audit
- Documented RTO/RPO and a written DR runbook
5. Change management
- Infrastructure as code (Terraform or equivalent), changed via reviewed pull requests
- CI/CD with approvals — no SSH-and-edit production changes
- Rollback path that’s been exercised
6. Monitoring & alerting
- Availability and error-rate monitoring with alerts that page a human
- Alert-to-incident process written down (even one page)
- Evidence flows automatically into Vanta/Drata via integrations
Does passing these checks get you the SOC 2 certificate?
No — and be suspicious of anyone who sells it that way. The certificate comes from a CPA firm’s audit. What the checklist gets you is the infrastructure side passing: green checks in your compliance platform and evidence collecting automatically, which is the hard technical 60% of the work. Policies, HR controls, and the audit engagement sit on top.
How long does the infrastructure work take?
For a typical seed-to-Series-A cloud setup: 3–4 weeks of focused work — a gap assessment against the failing checks (week 1), implementation as Terraform (weeks 2–3), then evidence wiring and auditor-ready documentation (week 4). Most teams run the policy work in parallel and can start a Type I audit within the same quarter. Type II just observes the same controls operating over 3–12 months, which is where keeping checks green month after month matters.
Type I vs Type II — does the infrastructure differ?
The controls are identical. Type I is a snapshot (“controls exist and are designed properly today”); Type II verifies they operated over an observation window. Build once, then keep it green — access reviews recorded, restores re-tested, drift caught. That maintenance is a standing item in our fractional DevOps retainer.
If the deal is waiting and you’d rather have this done than read about it: our SOC 2-Ready Infrastructure package implements this whole checklist in your cloud accounts for a fixed $6,900, scoped against your Vanta or Drata checks.
ByteDel builds SOC 2-ready infrastructure for funded startups — fixed price, 3–4 weeks, everything as code in your repos.