SOC 2 evaluates an organization's controls around security, availability, and confidentiality of customer data. While SOC 2 itself is an organizational audit, not a server checklist, this guide covers the infrastructure-level controls auditors commonly expect to see.
Important Disclaimer
SOC 2 compliance involves organizational policies, procedures, and evidence collection well beyond server configuration. This article covers technical infrastructure practices relevant to common SOC 2 controls, not a complete compliance guide.
SOC 2 Trust Service Criteria Overview
- Security — protection against unauthorized access
- Availability — systems are available for operation as committed
- Confidentiality — confidential information is protected
Infrastructure Controls Commonly Expected
Access Control and Authentication
- SSH key-based authentication, not passwords — see SSH Hardening: Change the Port, Disable Root Login & Use SSH Keys
- Two-factor authentication on administrative access — see How to Enable Two-Factor Authentication (2FA) for SSH
- Individual named accounts rather than shared credentials, enabling accountability
Change Management
Document significant infrastructure changes — what changed, when, and why. Version-controlling configuration where possible supports this.
Monitoring and Logging
- Centralized, retained logs — see How to Set Up Centralized Logging Across Multiple VPS Instances
- Audit logging of privileged actions — see How to Install and Configure auditd for System Auditing
- Alerting for security-relevant events — see How to Set Up Effective Server Alerting
Vulnerability Management
- Regular security updates — see How to Enable Automatic Security Updates on Ubuntu & Debian
- Dependency vulnerability scanning — see How to Audit and Secure Your Application's Dependencies
- Documented patching cadence and evidence it's actually followed
Backup and Disaster Recovery
- Documented, tested backup procedures — see Backup Strategy 101: The 3-2-1 Rule Explained
- A written, tested disaster recovery plan — see How to Create a Disaster Recovery Plan for Your VPS
Network Security
- Firewall configuration restricting unnecessary access — see How to Configure UFW Firewall on a Linux VPS
- Encrypted data in transit (HTTPS) — see How to Install Let's Encrypt SSL with Certbot
Evidence Collection
SOC 2 auditors typically want evidence, not just policy documents — screenshots, logs, and configuration exports demonstrating controls are actually implemented and consistently followed, not just documented on paper.
Building a Controls Checklist
Map each SOC 2 control category to the specific technical implementation on your infrastructure, with a note on how you'd demonstrate it during an audit:
| Control Area | Technical Implementation | Evidence |
|---|---|---|
| Access control | SSH keys + 2FA, no shared accounts | SSH config, user list export |
| Encryption in transit | HTTPS enforced everywhere | SSL Labs scan results, Nginx config |
| Patch management | Automatic security updates enabled | Update logs, unattended-upgrades config |
Ongoing Compliance, Not a One-Time Checklist
SOC 2 (Type II specifically) evaluates controls over a period of time, not a single point-in-time snapshot — consistency of implementation matters as much as initial setup.
Continue Reading
- SSH Hardening: Change the Port, Disable Root Login & Use SSH Keys
- How to Install and Configure auditd for System Auditing
- How to Create a Disaster Recovery Plan for Your VPS
Browse more articles in Advanced Security & Compliance.
