SOC 2 Integrations & Evidence Collection
Learn which systems to integrate for automated evidence collection. Modern compliance platforms like LowerPlane connect to 100+ tools to continuously gather audit evidence.
Why Integrations Matter for SOC 2
Manual Evidence Collection
- • Screenshots become outdated immediately
- • Takes 100+ hours per audit cycle
- • Error-prone and inconsistent
- • No continuous monitoring between audits
- • Last-minute scramble for evidence
Automated Evidence via Integrations
- • Real-time, always up-to-date evidence
- • 80% reduction in audit prep time
- • Consistent and accurate documentation
- • Continuous compliance monitoring
- • Instant alerts for compliance drift
Cloud Infrastructure
Amazon Web Services (AWS)
Monitor IAM policies, S3 bucket configurations, VPC security groups, CloudTrail logs, and encryption settings.
Evidence Collected:
- IAM policy documents and user access reviews
- S3 bucket policies and encryption status
- VPC security group rules and network ACLs
- CloudTrail audit logs and CloudWatch alerts
- AWS Config compliance snapshots
Microsoft Azure
Track Azure AD configurations, resource group policies, network security groups, and Key Vault access.
Evidence Collected:
- Azure AD user and group configurations
- RBAC role assignments and access reviews
- Network security group rules
- Azure Security Center recommendations
- Activity logs and diagnostic settings
Google Cloud Platform (GCP)
Monitor Cloud IAM, GCE firewall rules, Cloud Storage access, and Stackdriver logging.
Evidence Collected:
- Cloud IAM policies and service account keys
- VPC firewall rules and organization policies
- Cloud Storage bucket IAM and encryption
- Cloud Audit Logs and Security Command Center
- Asset inventory and configuration snapshots
Identity & Access Management
Google Workspace
Monitor user accounts, admin privileges, 2FA enrollment, and data sharing settings.
Evidence Collected:
- Admin console audit logs
- User 2-step verification status
- OAuth app access and third-party permissions
- Drive sharing settings and external access
- Security investigation tool reports
Okta
Track SSO configurations, MFA policies, user provisioning, and application access.
Evidence Collected:
- System log events and admin activities
- MFA factor enrollment reports
- Application assignment and access policies
- User provisioning and deprovisioning logs
- Password and authentication policies
Microsoft 365 / Azure AD
Monitor conditional access, security defaults, guest access, and compliance settings.
Evidence Collected:
- Sign-in and audit logs
- Conditional access policy configurations
- MFA registration and usage reports
- Guest user access reviews
- Microsoft Secure Score assessments
Development & DevOps
GitHub
Monitor repository access, branch protection rules, security scanning, and code review requirements.
Evidence Collected:
- Repository access permissions and collaborators
- Branch protection rule configurations
- Pull request and code review requirements
- Dependabot and security advisory alerts
- Audit log events and SAML SSO status
GitLab
Track merge request approvals, CI/CD pipeline security, and project access controls.
Evidence Collected:
- Project and group member access
- Merge request approval rules
- CI/CD pipeline configurations
- Container registry vulnerability scans
- Audit events and compliance reports
Jira
Track issue resolution, change requests, and project access for change management evidence.
Evidence Collected:
- Issue and change request workflows
- Project role and permission schemes
- Audit logs for configuration changes
- Sprint and release documentation
- User access and group memberships
Communication & Collaboration
Slack
Monitor workspace settings, app integrations, data retention, and external sharing.
Evidence Collected:
- Workspace audit logs and access logs
- App and integration permissions
- Data retention and export settings
- External sharing and guest access
- Enterprise Grid security settings
Microsoft Teams
Track team creation policies, guest access, app permissions, and meeting security.
Evidence Collected:
- Teams admin center audit logs
- Guest access and external sharing settings
- App permission policies and approvals
- Meeting policies and recording settings
- Sensitivity labels and information barriers
Zoom
Monitor meeting security settings, recording policies, and user access controls.
Evidence Collected:
- Account and admin activity reports
- Meeting security settings and defaults
- Recording storage and access controls
- SSO and authentication configurations
- User role and privilege assignments
Security & Monitoring
CrowdStrike
Track endpoint protection status, threat detections, and response actions.
Evidence Collected:
- Endpoint protection deployment status
- Detection and prevention events
- Sensor health and update compliance
- Incident investigation timelines
- Policy configurations and exceptions
Datadog
Monitor infrastructure metrics, APM traces, log aggregation, and security signals.
Evidence Collected:
- Dashboard and alert configurations
- Log retention and access policies
- Security monitoring rules and signals
- User access and API key management
- Compliance and audit trail reports
Splunk
Centralized log management, SIEM capabilities, and security event correlation.
Evidence Collected:
- Index and source type configurations
- Saved searches and alert actions
- User access and role-based permissions
- Data retention and archival policies
- Compliance and audit reports
Databases & Data
MongoDB Atlas
Monitor database access, encryption settings, network security, and audit logs.
Evidence Collected:
- Database user and role configurations
- Network access and IP whitelisting
- Encryption at rest and in transit settings
- Audit log configurations and exports
- Backup and point-in-time recovery settings
PostgreSQL (RDS/Cloud SQL)
Track database security groups, encryption, parameter groups, and access patterns.
Evidence Collected:
- Security group and network ACL rules
- Encryption configuration and key management
- Parameter group security settings
- IAM database authentication status
- Slow query and general logs
Snowflake
Monitor data warehouse access, sharing policies, and query history.
Evidence Collected:
- User and role configurations
- Data sharing and marketplace policies
- Network policies and private connectivity
- Query history and access patterns
- Masking and row access policies