evidence requests

AWS evidence, listed by SOC 2 criterion.

Each SOC 2 criterion ID that our public test library maps, with the AWS services and the library tests that touch it, and whether the scan's library tests collect evidence for it. The same rows download as CSV, with no email.

Start discovery Download the CSV

by criterion

Each criterion, its AWS services, and the tests that touch it.

A criterion is listed only when a test in our public library maps to it; that is what Yes means in the last column. Each test links to its row in the library, which says what it checks and when it passes or fails.

SOC 2 criterion	AWS services	Library tests	Evidence from the scan's library tests
CC1.3	Tagging	Critical resources carry an Owner tag	Yes
CC2.1	CloudTrail, CloudWatch Logs, VPC	A CloudTrail trail records activity in every Region CloudWatch log groups have a retention period VPCs capture Flow Logs	Yes
CC2.3	AWS Account	The account has a security alternate contact	Yes
CC5.1	AWS Organizations	The organization applies service control policy guardrails	Yes
CC6.1	AWS Organizations, Cognito, EBS, EC2, IAM, KMS, RDS, S3, SSM, Tagging	IAM users with console access have MFA The root user has MFA enabled Active IAM access keys are rotated within 90 days Cognito user pools define a password policy Security groups do not expose SSH to the internet S3 buckets block public access at the bucket level RDS instances are not publicly accessible RDS DB instances encrypt storage at rest EBS encryption by default is on in each scoped Region Customer-managed KMS keys rotate automatically S3 buckets encrypt objects by default EC2 instances require IMDSv2 Running EC2 instances report to Systems Manager The organization applies service control policy guardrails Critical resources carry an Owner tag	Yes
CC6.2	Cognito, IAM	Active IAM access keys are rotated within 90 days Cognito user pools define a password policy	Yes
CC6.6	CloudFront, EC2, ELBv2, GuardDuty, IAM, RDS, S3	IAM users with console access have MFA The root user has MFA enabled Security groups do not expose SSH to the internet S3 buckets block public access at the bucket level RDS instances are not publicly accessible S3 bucket policies deny requests that are not over TLS Load balancer HTTP listeners redirect to HTTPS Load balancers terminate TLS with an ACM certificate CloudFront distributions require HTTPS from viewers GuardDuty has an enabled detector in each scoped Region EC2 instances require IMDSv2	Yes
CC6.7	CloudFront, EBS, ELBv2, KMS, RDS, S3	S3 bucket policies deny requests that are not over TLS Load balancer HTTP listeners redirect to HTTPS Load balancers terminate TLS with an ACM certificate CloudFront distributions require HTTPS from viewers RDS DB instances encrypt storage at rest EBS encryption by default is on in each scoped Region Customer-managed KMS keys rotate automatically S3 buckets encrypt objects by default	Yes
CC6.8	ECR	ECR repositories scan images on push or through Inspector	Yes
CC7.1	AWS Config, CloudTrail, ECR, SSM	CloudTrail trails validate log file integrity AWS Config recorders are actively recording ECR repositories scan images on push or through Inspector Running EC2 instances report to Systems Manager	Yes
CC7.2	AWS Config, CloudTrail, CloudWatch, CloudWatch Logs, GuardDuty, VPC	CloudTrail trails validate log file integrity A CloudTrail trail records activity in every Region CloudWatch log groups have a retention period VPCs capture Flow Logs The account has at least one CloudWatch alarm AWS Config recorders are actively recording GuardDuty has an enabled detector in each scoped Region	Yes
CC7.4	AWS Account	The account has a security alternate contact	Yes
CC8.1	AWS Config	AWS Config recorders are actively recording	Yes
A1.1	CloudWatch	The account has at least one CloudWatch alarm	Yes
A1.2	AWS Backup, DynamoDB	AWS Backup has at least one backup plan DynamoDB tables have point-in-time recovery	Yes
A1.3	AWS Backup, DynamoDB, GuardDuty	AWS Backup has at least one backup plan DynamoDB tables have point-in-time recovery GuardDuty has an enabled detector in each scoped Region	Yes

SOC 2, CIS and FSBP references are Vishcore's mapping guidance, not an auditor's determination; CIS references are shown only where verified against CIS Amazon Web Services Foundations Benchmark v3.0.0.

SOC 2 criteria are cited by ID only, never their text. This list does not replace your auditor's own request list and is not an audit opinion.

Use it your way

The same rows as CSV, for a spreadsheet, your compliance platform, or a review with your auditor. No email needed. In the CSV, each test link is a full URL and every row carries the mapping note.

Has a buyer or auditor asked for AWS evidence?

Send the pressure point and the timeline. We confirm fit before any access. No secrets, account IDs, or access in the first message.

Take the AWS foundations self-check

Start discovery