Topic starter
07/06/2026 9:09 pm
TL;DR: Auditability depends on how well access, change history, and resource scope are made queryable, not on manual evidence chasing, according to StrongDM. StrongDM describes how its SOC 2 audit workflow used audit logs, point-in-time snapshots, RBAC listings, and tagged scopes to answer evidence requests, and says it successfully submitted 100% of requests.
Editorial analysis by NHI Mgmt Group, based on content published by StrongDM: “Answering Auditors’ Questions in a SOC 2 Review”.
Key questions
Q: What breaks when evidence for SOC 2 controls is collected manually?
A: Manual evidence collection tends to break under volume and inconsistency.
Q: Why do tagged resources make SOC 2 access evidence easier to defend?
A: Tagged resources create a clear scope boundary for in-scope systems, which lets teams filter permissions, activities, and inventories to the exact environment under review.
Q: How should teams prove who could change production resources during an audit period?
A: Teams should combine historical role listings with resource-scoped permission views so they can show which users were authorised during the audit window.
Practitioner guidance
- Build point-in-time entitlement snapshots Preserve historical views of users, roles, targets, and resource permissions so auditor questions can be answered for any review date without manual reconstruction.
- Use tags to define audit scope Apply consistent tags to production, finance, analytics, and other sensitive resource sets so evidence requests can be filtered to the correct in-scope estate.
- Correlate activity streams with configuration state Link change events to the underlying resource and permission records so access changes can be proven with both event history and current or historical state.
Bottom line: SOC 2 evidence quality depends on whether access and change history can be reconstructed from the system itself, not assembled manually after the fact.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/06/2026 8:57 am
Auditability is a governance property of the access layer, not a paperwork outcome. The article shows that SOC 2 evidence becomes dependable only when the identity system preserves historical state for roles, resources, and permissions. That is the difference between proving control operation and manually reconstructing it after the fact. For NHI programmes, the same rule applies to service accounts and tagged infrastructure.
A question worth separating out:
Q: What is the difference between audit logs and point-in-time snapshots for SOC 2 evidence?
A: Audit logs show that an event occurred, while point-in-time snapshots show the state of the system at a specific moment. Both matter, but snapshots are what let teams prove historical access scope, entitlement mappings, and resource presence when an auditor asks what was true during the review period.
👉 Read our full editorial: SOC 2 audit evidence and access controls for NHI programs
This post was modified 4 days ago by NHI Mgmt Group