Agent WranglersControls and evidence Required
Keep evidence where nobody can change it
Store evidence in write-once storage, in folders by date, and keep it for the audit period plus at least one year.
How to do it
Use object storage with a compliance-mode retention lock. A SOC 2 Type II audit looks at a period of 3 to 12 months, and the next auditor may ask about the last one. Give the collection jobs write access only, and auditors read access only.
How to check
A test tries to delete and to overwrite an evidence file and both fail. The bucket's lock period is at least the audit period plus 365 days.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/controls-and-evidence/evidence-store.