Now that the November 3 midterm elections are over, counties across the country are auditing their results by hand-checking samples of paper ballots against the machine counts. Fulton County, Georgia, starts its audit today, November 13, and continues through the 17th, and Boulder County, Colorado, begins on November 17. Every state requires a post-election audit, regardless of the margin of victory.
Like an election office, a company also needs to confirm what happened inside its systems, and they do that using logs. Tools such as MFA, firewalls and endpoint protection lower the risk of a breach, while logs provide the evidence a SOC 2 auditor reviews to confirm those controls worked throughout the year. For companies planning a SOC 2 audit in 2027, the logging behind the evidence needs to be in place before the audit period begins.
Election audits and SOC 2 audits
In the 2024 general election, more than 98% of election jurisdictions used equipment that produced either a paper ballot or an auditable paper record, according to the U.S. Election Assistance Commission. After each election, officials draw a sample of those ballots, count it by hand and compare their count with the machine totals, and Colorado’s audit of its June 2026 primary, for example, confirmed that the results had been counted accurately.
A SOC 2 Type II audit works in a similar way. The auditor selects samples from across the audit period, such as access changes, alerts and incident tickets, and asks the company to produce evidence that each control operated as described. A company with complete, well-kept logs can answer those requests using its records.
The Scope of a SOC 2 Type II Audit
SOC 2 reports come in two types. A Type I report assesses whether a company’s controls are suitably designed at a single point in time, and a Type II report tests whether those controls operated effectively over an observation period, typically between three and twelve months. The AICPA, which sets the SOC 2 criteria, leaves the length to the company and its auditor, and most auditors look for at least three months.
Type I
Control design on a single date
Type II
Controls tested across an observation period
Three months is the shortest window most auditors accept. Each white dot is a record the auditor can sample, such as an access change, an alert or an incident ticket.
Six months is a common length for a first Type II report. Each white dot is a record the auditor can sample, such as an access change, an alert, or an incident ticket.
Twelve months is typical for renewals, so each report picks up where the last one ended. The auditor can sample a record from any point in the year.
Enterprise customers generally ask for a Type II report during security reviews and procurement. Every control in scope has to run through the observation period, and the evidence has to cover the full period from its first day to its last.
Monitoring and Incident Response
The SOC 2 criteria that rely most on logs sit in the CC7 series, which covers system operations. CC7.2 requires a company to monitor its systems for anomalies that could indicate malicious acts, natural disasters or errors, and CC7.3 requires it to evaluate security events to decide whether they amount to incidents. CC7.4 then requires the company to respond to identified incidents by following a defined incident response program.
Auditors testing these criteria look for records showing that the process ran during the observation period. A detected incident that the team investigated, contained and documented is a sign that the controls worked. An incident that went undetected, or a response that skipped the documented process, can lead the auditor to conclude that one or more criteria went unmet for the period, and the report would then carry a modified opinion that customers will see.
Select a step to see what the auditor asks for.
Evidence that monitoring ran for the whole period, such as the log sources in scope and the alerts raised on sampled dates.
Records showing how sampled security events were reviewed and how each one was classified.
Incident tickets showing that containment, remediation and communication followed the documented response plan.
A sample of alerts, investigations and incident records from across the observation period, matched to the controls in the report.
A missing record at any step can appear as an exception in the SOC 2 report.
The Importance of Logs to SOC 2
Every sign-in, permission change, and configuration update in a company’s systems leaves an entry in a log, and during an incident or an audit, those entries are the record the security team and the auditor work from. Guidance from CISA, the FBI, the NSA and international partners recommends that each entry record the type of event, the device involved, the source and destination IP addresses, and an accurate timestamp. For most growing companies, the most useful logs come from the following systems:
- Identity Providers such as Microsoft Entra ID, Okta and Google Workspace, for sign-ins, MFA changes and new administrator roles
- Cloud Platforms such as AWS, Azure and Google Cloud, for resources being created, changed or deleted
- Code Repositories such as GitHub and GitLab, for changes to access, branch protections and stored secrets
- Endpoint Tools on laptops and servers, for suspicious programs and changes to security settings
- Security Tools, for each alert and the team’s response
Logs also need to be stored outside the systems they record. Attackers who reach administrator level often delete logs to hide their activity, and MITRE ATT&CK lists log removal as a standard way to avoid detection. Windows records an event when its Security log is cleared, but an attacker can erase the event too unless a copy has already been sent to another system, and CISA’s logging guidance treats central collection and protection against tampering as basic requirements.
Each service also deletes its logs after a set period, and Microsoft Purview Audit (Standard), for example, keeps Microsoft 365 audit records for 180 days unless a company has Audit (Premium), which offers longer retention. Mandiant’s M-Trends 2026 report found that attackers in 2025 went undetected for a median of 14 days overall, rising to 122 days in cyber espionage cases and North Korean IT worker schemes, and a 180-day default leaves little margin for an investigation or a twelve-month audit window.
Preparing for a SOC 2 Audit in 2027
A first Type II report usually takes between six and fifteen months from start to finish, with one to three months of preparation, an observation period of three to twelve months and several weeks of fieldwork and reporting afterward. A company that wants a report covering the first half of 2027 needs its process running by January 1, and any control added partway through the window will only be tested from the date it started.
Observation period from January 1 to March 31, 2027, with fieldwork in April. Three months is the shortest window most auditors accept.
Observation period from January 1 to June 30, 2027, with fieldwork in July. Six months is a common length for a first Type II report.
Observation period from January 1 to December 31, 2027, with fieldwork in January 2028. Twelve months is typical for renewals.
1–3 monthsof preparation before the observation period
3–12 monthsof observation, with six common for a first report
6–15 monthsfor a first Type II report from start to finish
Typical ranges from Drata. Dates show example windows starting January 1, 2027.
Preparation is also the cheapest stage to fix gaps. Before the observation period begins, a company can confirm that each system in scope is sending logs to a separate location, that alerts reach someone who reviews them, and that every investigation leaves a record an auditor can sample.
For a step-by-step plan, our SOC 2 compliance checklist for startups walks through 24 steps from setting your scope to completing the audit, along with the evidence auditors typically request at each one.
How Jutsu Can Help
Jutsu monitors your connected cloud, identity, code and endpoint systems around the clock and logs every alert, investigation and response as it happens. When an account signs in from somewhere unexpected, a log is cleared or an app receives new permissions, your team can see it and respond, and the record stays in one place outside the systems being monitored. If you’re preparing for a SOC 2 audit in 2027, Jutsu keeps this record ready for your auditor across the whole observation period, so your team doesn’t have to compile screenshots and exports when the auditor asks for them.
Learn More About JutsuFAQ
What is the difference between SOC 2 Type I and Type II?
A Type I report assesses whether controls are suitably designed at a single point in time, while a Type II report tests whether those controls operated effectively over an observation period, typically three to twelve months. Most enterprise customers ask for a Type II report.
How long is a SOC 2 Type II observation period?
The AICPA leaves the length to the company and its auditor. Most auditors look for at least three months, and six months is common for a first report. Renewals usually cover twelve months so that each report picks up where the last one ended.
Does SOC 2 require logging?
SOC 2 doesn’t name specific logs, but criterion CC7.2 requires companies to monitor their systems for anomalies, and auditors expect logs and records of review as evidence. In a Type II audit, the evidence needs to cover the full observation period.
How should a company prepare for a SOC 2 audit in 2027?
A SOC 2 Type II audit tests controls over a set observation period, and logging, alerting and incident response need to be running from its first day. A SOC 2 readiness platform such as Jutsu monitors your systems around the clock and keeps every alert, investigation and response in one place as audit evidence. For the full set of steps, see our SOC 2 compliance checklist for startups.
Why should logs be stored in a separate system?
An attacker with administrator access to a system can often delete or change its logs. Copies stored in a separate system keep a record of the attacker’s activity even if the original logs are wiped.
Do all states audit their elections?
Yes. As of April 2026, every state has a post-election audit process in law, according to the National Conference of State Legislatures. The most common type is a traditional audit of a fixed share of machines or precincts, and seven states require risk-limiting audits.