SOC 2 evidence that generates itself
The worst part of an audit is reconstructing what happened from logs that were never designed to be evidence. Build the ledger right and the evidence is a by-product.
Audits are archaeology
Most audit prep is archaeology: digging through logs that were written for debugging, not for proof, and stitching them into a story an auditor will accept. It is slow, it is manual, and it happens under deadline.
The reason it hurts is that access decisions and their evidence live in different places. The system decided one thing; the record of why is scattered or missing.
Make the decision and the evidence the same event
When every access decision is evaluated in one place and written to an attestation-ready ledger as it happens, evidence stops being a project. Who acted, who sponsored them, what scope, what the policy decided, and when — all captured at the moment of the decision.
SOC 2 and ISO 27001 evidence then generates itself, because the control and its proof are the same event. You are not reconstructing the past. You are exporting it.
- #SOC 2
- #audit
- #evidence
More field notes
The 80:1 problem: machine identity is now the perimeter
For every human on your team there are roughly eighty machine identities acting on their behalf. Almost none of them have an owner. That ratio is the whole security problem.
Daniel Osei · Security Engineer
6 min read
Short-lived credentials, in practice
Everyone agrees keys should expire. Then someone sets the TTL to a year so nothing breaks. Here is how we make minutes-long credentials survive contact with real workloads.
Priya Nandakumar · Head of Platform
7 min read
What we mean by a named human sponsor
Every agent in Mandavo is bound to an accountable person. Not a team, not a rotation, not a role. A person. Here is why we drew the line there.
Lena Fischer · Product Lead
5 min read