Preparing for SOC 2
Show how your team handled vulnerabilities
Keep the decisions your team makes about dependency vulnerabilities. Export them for your SOC 2 review dates, with the names and reasons recorded at the time.
What this covers
Where vulnerability records fit
SOC 2 Trust Services Criteria CC7.1 and CC7.2
CC7.1 covers detecting configuration changes and newly discovered vulnerabilities. CC7.2 covers monitoring anomalies and assessing whether they are security events. Vulnerability records support part of this wider review.
Before the review
What your reviewer asks for, and where it lives in Proveta
Confirm the evidence you need with your reviewer.
01Findings from the repos in your review
Review findings from connected Dependabot alerts and Proveta scans. Check source coverage and scan warnings before you prepare your records.
02The owner, decision, reason, and date for each sample
Every recorded decision includes an owner, a reason, and a date. Earlier decisions stay available, so a reviewer can see what changed.
03Fix records or documented risk acceptances
Choose your review dates. The report shows which accepted risks were active or expired at the end of the period, with their owners and reasons.
04Decision history covering the review period
Decisions keep the names recorded at the time. A later GitHub name change doesn’t change who appears in the history.
Start now
Prepare for your SOC 2 review
Scan your dependencies, bring in your Dependabot alerts, and export the decision record for your SOC 2 review dates.
- Free for 1 repo
- Your team controls merging
- No password to create