Strike Graph

High-level overview of networks, operating systems, databases, and applications

Infrastructure evidence overview

What we mean by “application” and how to satisfy the related evidence

Application

What we mean by “database” and how to satisfy the related evidence

Database

What we mean by “network/cloud” and how to satisfy the related evidence

Network/Cloud

What we mean by “operating system” and how to satisfy the related evidence

Operating System

What we mean by “VPN” and how to satisfy the related evidence

How to satisfy a control if sample evidence is not available

Attestation of non-occurrence

Use Terraform integrations to automatically collect evidence for user access controls

How to automatically collect evidence from AWS IAM for Administrator Access, User Access, and other evidence objects

Use Terraform to automatically collect evidence for redundancy and availability controls

How to automatically collect redundancy information for Availability Zones and other related controls

Cayla Marshall

Elliott Harnagel

Micah Spieler

Activate, document, and upload evidence items to prove operation of controls

Evidence Repository

Use this example to ensure that all elements of a solid asset inventory are addressed

Asset Inventory

AWS Network Diagram

Use this example to guide the creation of your data flow diagram

Data Flow Diagram

Use the following example to guide the creation of your employee handbook

Employee Handbook

The difference between a background check and reference check

Employee Screening

Use the following example to guide the creation of your offboarding checklist

Offboarding Checklist

Use the following example to guide the creation of your onboarding checklist

Onboarding Checklist

Use the following example to guide the creation of your organizational chart

Organizational Chart

Gain guidance regarding Bridge Letters and view a corresponding template

SOC 2 Report Bridge Letter

How to best satisfy the whistleblower hotline evidence item

Whistleblower Hotline

Stephanie Lorraine

View and learn from strong examples of common evidence items 

Evidence Examples 

Where to locate common evidence items on AWS, Azure, and GCP

Cloud Provider Evidence

AWS: Backup Schedule and Settings

AWS: Availability Monitoring Tool

AWS: Asset List, Server List

AWS: API Security

AWS: Role Access Management

AWS: Production System Restricted Access, Remote System Authentication

AWS: Password Policy and Settings, Password Policy Evidence

AWS: Patch Scan, Server Configuration

AWS: Network Admin Users

AWS: Network Access Log

AWS: Log Aggregation, Monitoring Tools Enabled

AWS: Multi-Factor Authentication Access, Multi Factor Authentication Evidence

AWS: IDS Screenshots

AWS: Hardening Configurations

AWS: Firewall Rules

AWS: Encryption Key Access, Key/Secrets Access

AWS: Encryption in Transit

AWS: Denial of Service

AWS: Cloud Service Access

AWS: Cloud Security Alerting

AWS: Cloud Monitoring Insights and Tools

AWS: Cloud Monitoring Dashboard

AWS: Application Firewall

AWS: Access to Production

AWS: Antivirus Install

Amazon Web Services

This article includes examples of where you can find common evidence items within your Azure environment.

Where to Find Common Azure Evidence Items

Microsoft Azure

GCP: Role Access Management

GCP: Production System Restricted Access, Remote System Authentication

GCP: Patch Scan, Server Configuration

GCP: Multi-Factor Authentication Access, Multi-Factor Authentication Evidence

GCP: IDS Screenshots

GCP: Hardening Configurations

GCP: Firewall Rules

GCP: Key & Secrets Access

GCP: Cloud Monitoring Dashboard, Cloud Security Alerting

GCP: Denial of Service

GCP: Cloud Key Evidence, Encryption Key Access

GCP: Change Network Infrastructure Evidence, Cloud Monitoring Insights and Tools, Log Aggregation, Monitoring Tools Enabled, Network Access Log

GCP: Breach Events, Security Alerts, Threat Detection Alerting

GCP: Backup Schedule and Settings

GCP: Availability Monitoring Tool

GCP: Asset List, Server List

GCP: Application Firewall

GCP: API Security

GCP: Antivirus Install

GCP: Access to Production, Cloud Service Access

Google Cloud Platform

SOC 2 Audit & Compliance Training

Resources to help your organization implement security awareness training

Security Awareness Training Resources

Use this guide to help you create a quiz to track who has completed your annual security training

Information Security Training Quiz and Attendance

Resources and links to security and compliance training modules

Security Training Resources

Find answers and get help from Intercom Support and Community Experts

This site employs cookies and other technologies that we and our third party vendors use to monitor and record personal information about you and your interactions with the site (including content viewed, cursor movements, screen recordings, and chat contents) for the purposes described in our Cookie Policy. By continuing to visit our site, you agree to our {websiteTermsLink}, {privacyPolicyLink} and {cookiePolicyLink}.

This site uses cookies and similar technologies ("cookies") as strictly necessary for site operation. We and our partners also would like to set additional cookies to enable site performance analytics, functionality, advertising and social media features. See our {cookiePolicyLink} for details. You can change your cookie preferences in our Cookie Settings.

We use cookies to make our site work and also for analytics and advertising purposes. You can enable or disable optional cookies as desired. See our {cookiePolicyLink} for more details.

Advertising cookies are set by our advertising partners to collect information about your use of the site, our communications, and other online services over time and with different browsers and devices. They use this information to show you ads online that they think will interest you and measure the ads' performance. Social media cookies are set by social media platforms to enable you to share content on those platforms, and are capable of tracking information about your activity across other online services for use as described in their privacy policies.

These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly.

These cookies are necessary for the website to function and cannot be switched off in our systems.

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site.

You have the right to opt out of the sale of your personal information. See our {cookiePolicyLink} for more details about how we use your data.

Your Privacy Choices

We use cookies to enhance your experience. You can customize your cookie preferences below. See our {cookiePolicyLink} for more details.

Cookie Settings

Link, Press control-option-right-arrow to exit

Empty Help Center

Uh oh. That page doesn’t exist.

Disappointed

Neutral

Smiley

Thinking...

Searching through sources...

Analyzing...

Tickets submitted through the messenger or by a support agent in your conversation will appear here.