Your organisation is preparing for its first SOC 2 audit. The security team is asking engineers for screenshots of configurations. What would you change, and what is the architectural argument?

What is wrong with screenshots

Three things, and each is worth naming separately.

They evidence a moment, not a period. The auditor is assessing whether controls operated throughout the observation window; a screenshot taken today says nothing about March.

They are not tamper-evident. An image is weak evidence, and an auditor who presses on it will say so.

They do not scale. This audit produces a scramble; the next one produces the same scramble, plus the customer questionnaires arriving in between.

The change: evidence as a by-product

Every control should emit a durable record as it operates, rather than having its state reconstructed later.

• Change control — the pipeline records commit, artifact digest, checks passed, approvals, and where it was deployed. That single record evidences several controls.
• Access — every grant, revocation, elevation and review recorded with timestamps and approver.
• Configuration — infrastructure in version control, so its history is the evidence, plus continuous compliance scanning for drift.
• Monitoring and response — alerts fired, acknowledged, resolved, with times.
• Vulnerability management — scan results and remediation timestamps against the SLA.

Three properties make these usable: append-only storage no operational role can delete; retention beyond the observation period; and queryability, because an auditor's request is a filter and if answering it needs a bespoke script each time, the burden has not moved.

Scope is the other lever

Scope is chosen by you, and everything inside it must meet the full control set and be evidenced. Narrowing it to the systems that genuinely process customer data — with demonstrable separation from everything else — is the largest single reduction in audit cost available.

That makes segregation an architectural requirement justified by audit cost as well as security: separate accounts, network isolation, distinct identity boundaries. Retrofitting it is the common and avoidable cost of a first certification.

The argument to make internally

This is not compliance work competing with engineering work. The same records serve incident investigation, change attribution and regulatory enquiry, and building them once replaces a recurring disruption to every engineer with a set of queries.

Frame the ask in those terms and quantify the current cost — engineer-days consumed per audit and per customer questionnaire — because that number is usually larger than anyone has added up, and it is what funds the change.

What to expect this time

The first audit will still involve manual effort; there is not time to automate everything before it. The realistic goal is to automate the highest-volume evidence now — change control and access — and leave the rest manual, with a documented plan to close the gap before the next cycle. Auditors respond well to a stated improvement plan; they respond badly to the same manual process two years running.