What operating systems should I include evidence for?
In the case of SOC 2 audits, the "operating system" evidence items refer to the operating systems running on your production servers, virtual machines, or instances. Auditors generally do not need to see operating system level evidence for laptops or employee workstations.
If your company does not host a specific platform or application for customers, and therefore does not really have production servers, then it is likely that you can deactivate the operating system evidence items. If you're unsure, you can always ask your Customer Success Manager for clarification.
What should my operating system evidence items look like?
Within your evidence repository, there are a few evidence items related to your network or cloud environment. Below are some examples of what your auditor may be looking for:
Administrator Access to Operating System
What your auditor is looking for: a screenshot or a system generated list of the administrative users to your production servers, instances, or virtual machines taken from the server OS itself. If you’re using AWS, this could be screenshots showing the privileged Linux users on a certain production instance. The screenshot or list must include a date/time stamp or other indication of when the screenshot was taken.
Related Control(s): Administrator Access
Operating System User List
What your auditor is looking for: a system generated list (or series of screenshots) of all users on your production servers, instances, or virtual machines taken from the server OS itself. The screenshot or list must include a date/time stamp or other indication of when the screenshot was taken.
Related Control(s): Role Based Access, User Access Review, Termination of Access, and Onboarding
Password Settings - Operating System
What your auditor is looking for: A screenshot of the password settings or other authentication method for the operating system on your production servers, instances, or virtual machines. If the only way to directly access the operating system on your servers is via SSH, provide screenshots showing SSH configurations, or images of someone using SSH to authenticate to a server rather than password settings. The screenshot must include a date/time stamp or other indication of when the screenshot was taken.
Related Control(s): Password Requirements
For more information on where to find evidence depending on your cloud provider, check out the “Where To Find Evidence” collection in our Help Center!