--- title: "AWS Evidence Request List | Vishcore Inc." description: "Each SOC 2 criterion ID our public AWS test library maps, with the AWS services and library tests that touch it. Criteria by ID only. Download the rows as CSV." canonical: https://vishcore.com/resources/evidence-requests --- 1. [Resources](https://vishcore.com/resources) 2. AWS Evidence Request List evidence requests # AWS evidence, listed by SOC 2 criterion. Each SOC 2 criterion ID that our public test library maps, with the AWS services and the library tests that touch it, and whether the scan's library tests collect evidence for it. The same rows download as CSV, with no email. [Start discovery](https://vishcore.com/start-discovery) [Download the CSV](https://vishcore.com/resources/evidence-requests.csv) This list - Restates our public test library and adds nothing to it - Names SOC 2 criteria by ID only, never their text - Links every test to its row in the library - Has a CSV download and a Markdown copy of the page by criterion ## Each criterion, its AWS services, and the tests that touch it. A criterion is listed only when a test in our public library maps to it; that is what Yes means in the last column. Each test links to its row in the library, which says what it checks and when it passes or fails. | SOC 2 criterion | AWS services | Library tests | Evidence from the scan's library tests | | --- | --- | --- | --- | | CC1.3 | Tagging | [Critical resources carry an Owner tag](https://vishcore.com/resources/test-library#test-critical-resources-carry-an-owner-tag) | Yes | | CC2.1 | CloudTrail, CloudWatch Logs, VPC | [A CloudTrail trail records activity in every Region](https://vishcore.com/resources/test-library#test-a-cloudtrail-trail-records-activity-in-every-region); [CloudWatch log groups have a retention period](https://vishcore.com/resources/test-library#test-cloudwatch-log-groups-have-a-retention-period); [VPCs capture Flow Logs](https://vishcore.com/resources/test-library#test-vpcs-capture-flow-logs) | Yes | | CC2.3 | AWS Account | [The account has a security alternate contact](https://vishcore.com/resources/test-library#test-the-account-has-a-security-alternate-contact) | Yes | | CC5.1 | AWS Organizations | [The organization applies service control policy guardrails](https://vishcore.com/resources/test-library#test-the-organization-applies-service-control-policy-guardrails) | Yes | | CC6.1 | AWS Organizations, Cognito, EBS, EC2, IAM, KMS, RDS, S3, SSM, Tagging | [IAM users with console access have MFA](https://vishcore.com/resources/test-library#test-iam-users-with-console-access-have-mfa); [The root user has MFA enabled](https://vishcore.com/resources/test-library#test-the-root-user-has-mfa-enabled); [Active IAM access keys are rotated within 90 days](https://vishcore.com/resources/test-library#test-active-iam-access-keys-are-rotated-within-90-days); [Cognito user pools define a password policy](https://vishcore.com/resources/test-library#test-cognito-user-pools-define-a-password-policy); [Security groups do not expose SSH to the internet](https://vishcore.com/resources/test-library#test-security-groups-do-not-expose-ssh-to-the-internet); [S3 buckets block public access at the bucket level](https://vishcore.com/resources/test-library#test-s3-buckets-block-public-access-at-the-bucket-level); [RDS instances are not publicly accessible](https://vishcore.com/resources/test-library#test-rds-instances-are-not-publicly-accessible); [RDS DB instances encrypt storage at rest](https://vishcore.com/resources/test-library#test-rds-db-instances-encrypt-storage-at-rest); [EBS encryption by default is on in each scoped Region](https://vishcore.com/resources/test-library#test-ebs-encryption-by-default-is-on-in-each-scoped-region); [Customer-managed KMS keys rotate automatically](https://vishcore.com/resources/test-library#test-customer-managed-kms-keys-rotate-automatically); [S3 buckets encrypt objects by default](https://vishcore.com/resources/test-library#test-s3-buckets-encrypt-objects-by-default); [EC2 instances require IMDSv2](https://vishcore.com/resources/test-library#test-ec2-instances-require-imdsv2); [Running EC2 instances report to Systems Manager](https://vishcore.com/resources/test-library#test-running-ec2-instances-report-to-systems-manager); [The organization applies service control policy guardrails](https://vishcore.com/resources/test-library#test-the-organization-applies-service-control-policy-guardrails); [Critical resources carry an Owner tag](https://vishcore.com/resources/test-library#test-critical-resources-carry-an-owner-tag) | Yes | | CC6.2 | Cognito, IAM | [Active IAM access keys are rotated within 90 days](https://vishcore.com/resources/test-library#test-active-iam-access-keys-are-rotated-within-90-days); [Cognito user pools define a password policy](https://vishcore.com/resources/test-library#test-cognito-user-pools-define-a-password-policy) | Yes | | CC6.6 | CloudFront, EC2, ELBv2, GuardDuty, IAM, RDS, S3 | [IAM users with console access have MFA](https://vishcore.com/resources/test-library#test-iam-users-with-console-access-have-mfa); [The root user has MFA enabled](https://vishcore.com/resources/test-library#test-the-root-user-has-mfa-enabled); [Security groups do not expose SSH to the internet](https://vishcore.com/resources/test-library#test-security-groups-do-not-expose-ssh-to-the-internet); [S3 buckets block public access at the bucket level](https://vishcore.com/resources/test-library#test-s3-buckets-block-public-access-at-the-bucket-level); [RDS instances are not publicly accessible](https://vishcore.com/resources/test-library#test-rds-instances-are-not-publicly-accessible); [S3 bucket policies deny requests that are not over TLS](https://vishcore.com/resources/test-library#test-s3-bucket-policies-deny-requests-that-are-not-over-tls); [Load balancer HTTP listeners redirect to HTTPS](https://vishcore.com/resources/test-library#test-load-balancer-http-listeners-redirect-to-https); [Load balancers terminate TLS with an ACM certificate](https://vishcore.com/resources/test-library#test-load-balancers-terminate-tls-with-an-acm-certificate); [CloudFront distributions require HTTPS from viewers](https://vishcore.com/resources/test-library#test-cloudfront-distributions-require-https-from-viewers); [GuardDuty has an enabled detector in each scoped Region](https://vishcore.com/resources/test-library#test-guardduty-has-an-enabled-detector-in-each-scoped-region); [EC2 instances require IMDSv2](https://vishcore.com/resources/test-library#test-ec2-instances-require-imdsv2) | Yes | | CC6.7 | CloudFront, EBS, ELBv2, KMS, RDS, S3 | [S3 bucket policies deny requests that are not over TLS](https://vishcore.com/resources/test-library#test-s3-bucket-policies-deny-requests-that-are-not-over-tls); [Load balancer HTTP listeners redirect to HTTPS](https://vishcore.com/resources/test-library#test-load-balancer-http-listeners-redirect-to-https); [Load balancers terminate TLS with an ACM certificate](https://vishcore.com/resources/test-library#test-load-balancers-terminate-tls-with-an-acm-certificate); [CloudFront distributions require HTTPS from viewers](https://vishcore.com/resources/test-library#test-cloudfront-distributions-require-https-from-viewers); [RDS DB instances encrypt storage at rest](https://vishcore.com/resources/test-library#test-rds-db-instances-encrypt-storage-at-rest); [EBS encryption by default is on in each scoped Region](https://vishcore.com/resources/test-library#test-ebs-encryption-by-default-is-on-in-each-scoped-region); [Customer-managed KMS keys rotate automatically](https://vishcore.com/resources/test-library#test-customer-managed-kms-keys-rotate-automatically); [S3 buckets encrypt objects by default](https://vishcore.com/resources/test-library#test-s3-buckets-encrypt-objects-by-default) | Yes | | CC6.8 | ECR | [ECR repositories scan images on push or through Inspector](https://vishcore.com/resources/test-library#test-ecr-repositories-scan-images-on-push-or-through-inspector) | Yes | | CC7.1 | AWS Config, CloudTrail, ECR, SSM | [CloudTrail trails validate log file integrity](https://vishcore.com/resources/test-library#test-cloudtrail-trails-validate-log-file-integrity); [AWS Config recorders are actively recording](https://vishcore.com/resources/test-library#test-aws-config-recorders-are-actively-recording); [ECR repositories scan images on push or through Inspector](https://vishcore.com/resources/test-library#test-ecr-repositories-scan-images-on-push-or-through-inspector); [Running EC2 instances report to Systems Manager](https://vishcore.com/resources/test-library#test-running-ec2-instances-report-to-systems-manager) | Yes | | CC7.2 | AWS Config, CloudTrail, CloudWatch, CloudWatch Logs, GuardDuty, VPC | [CloudTrail trails validate log file integrity](https://vishcore.com/resources/test-library#test-cloudtrail-trails-validate-log-file-integrity); [A CloudTrail trail records activity in every Region](https://vishcore.com/resources/test-library#test-a-cloudtrail-trail-records-activity-in-every-region); [CloudWatch log groups have a retention period](https://vishcore.com/resources/test-library#test-cloudwatch-log-groups-have-a-retention-period); [VPCs capture Flow Logs](https://vishcore.com/resources/test-library#test-vpcs-capture-flow-logs); [The account has at least one CloudWatch alarm](https://vishcore.com/resources/test-library#test-the-account-has-at-least-one-cloudwatch-alarm); [AWS Config recorders are actively recording](https://vishcore.com/resources/test-library#test-aws-config-recorders-are-actively-recording); [GuardDuty has an enabled detector in each scoped Region](https://vishcore.com/resources/test-library#test-guardduty-has-an-enabled-detector-in-each-scoped-region) | Yes | | CC7.4 | AWS Account | [The account has a security alternate contact](https://vishcore.com/resources/test-library#test-the-account-has-a-security-alternate-contact) | Yes | | CC8.1 | AWS Config | [AWS Config recorders are actively recording](https://vishcore.com/resources/test-library#test-aws-config-recorders-are-actively-recording) | Yes | | A1.1 | CloudWatch | [The account has at least one CloudWatch alarm](https://vishcore.com/resources/test-library#test-the-account-has-at-least-one-cloudwatch-alarm) | Yes | | A1.2 | AWS Backup, DynamoDB | [AWS Backup has at least one backup plan](https://vishcore.com/resources/test-library#test-aws-backup-has-at-least-one-backup-plan); [DynamoDB tables have point-in-time recovery](https://vishcore.com/resources/test-library#test-dynamodb-tables-have-point-in-time-recovery) | Yes | | A1.3 | AWS Backup, DynamoDB, GuardDuty | [AWS Backup has at least one backup plan](https://vishcore.com/resources/test-library#test-aws-backup-has-at-least-one-backup-plan); [DynamoDB tables have point-in-time recovery](https://vishcore.com/resources/test-library#test-dynamodb-tables-have-point-in-time-recovery); [GuardDuty has an enabled detector in each scoped Region](https://vishcore.com/resources/test-library#test-guardduty-has-an-enabled-detector-in-each-scoped-region) | Yes | SOC 2, CIS and FSBP references are Vishcore's mapping guidance, not an auditor's determination; CIS references are shown only where verified against CIS Amazon Web Services Foundations Benchmark v3.0.0. SOC 2 criteria are cited by ID only, never their text. This list does not replace your auditor's own request list and is not an audit opinion. Use it your way The same rows as CSV, for a spreadsheet, your compliance platform, or a review with your auditor. No email needed. In the CSV, each test link is a full URL and every row carries the mapping note. - [CSV /resources/evidence-requests.csv](https://vishcore.com/resources/evidence-requests.csv) - [Markdown /resources/evidence-requests.md](https://vishcore.com/resources/evidence-requests.md) - [Test library JSON /api/test-library.json](https://vishcore.com/api/test-library.json) ## Has a buyer or auditor asked for AWS evidence? Send the pressure point and the timeline. We confirm fit before any access. No secrets, account IDs, or access in the first message. [Take the AWS foundations self-check](https://vishcore.com/resources/self-check) [Start discovery](https://vishcore.com/start-discovery)