Question

A financial services company must produce audit-ready evidence for a SOC 2 examination across 40 AWS accounts in an organization. The security team already uses AWS Config with organization conformance packs to continuously evaluate resource compliance. Auditors now require a consolidated package that maps collected evidence to specific SOC 2 control requirements, automatically gathers supporting data (Config rule results, CloudTrail activity, and resource configurations), and can be exported as an assessment report for the examiners. Which approach best meets this requirement with the least custom development?

Accepted Answer

Enable AWS Audit Manager, launch an assessment from the SOC 2 framework, and select the organization accounts and Config data sources as automated evidence collectors.

Answer

Create additional Config conformance packs mapped to SOC 2 controls and export the compliance dashboard from the Config console for each account.

Answer

Enable Security Hub with the AWS Foundational Security Best Practices standard and export the findings summary as the SOC 2 evidence package.

Answer

Configure an Athena query against centralized CloudTrail logs and build a QuickSight dashboard that maps API activity to SOC 2 control IDs.