SOC 2 Compliance with a SIEM: Meeting the Trust Services Criteria

SOC 2 has become the de facto trust standard for SaaS and technology companies — and increasingly a prerequisite for closing enterprise deals. While SOC 2 covers far more than security monitoring, a SIEM is one of the most efficient ways to satisfy a cluster of its requirements and generate the evidence auditors demand.

What SOC 2 Is

SOC 2 is an AICPA auditing framework assessing how a service organisation protects customer data against five Trust Services Criteria: Security (the only mandatory one), Availability, Processing Integrity, Confidentiality, and Privacy. Type I assesses control design at a point in time; Type II assesses whether controls operated effectively over 3 to 12 months. Type II is what customers want — and where a SIEM proves its worth, generating continuous evidence over the period.

Where a SIEM Maps to the Criteria

The Security criterion rests on the Common Criteria, several of which a SIEM directly supports: CC6 (Logical Access) — monitors and logs access, detects unauthorised access; CC7 (System Operations) — detects and alerts on security events; CC7.2 (Monitoring) — continuous monitoring for anomalies; CC7.3 (Incident Evaluation) — data to evaluate events; CC7.4 (Incident Response) — alerting and forensic data driving response.

The Evidence Auditors Want

For Type II, the auditor asks "prove the SIEM operated effectively for the entire period". A SIEM produces continuous log collection records (no gaps), alert history, incident response records, access monitoring logs, and detection rule configuration.

Retention and SOC 2

Observation periods run 3 to 12 months. Your SIEM retention must comfortably exceed your audit period so evidence is available when the auditor arrives — making affordable long retention a practical SOC 2 enabler. See our log retention guide.

Why Self-Hosted Helps

The Confidentiality criterion concerns protecting confidential data. A self-hosted SIEM keeps your security telemetry — which itself contains sensitive access and configuration data — within your own environment, simplifying your data-flow story for the auditor and giving you complete control over the evidence with no cloud-vendor dependency during an audit.

Practical Steps

1. Deploy your SIEM before the observation window opens — it must run continuously across the whole Type II period
2. Cover access and operations logs to hit CC6 and CC7
3. Document your monitoring controls (auditors want policy plus evidence)
4. Enable continuous reporting so evidence accumulates automatically
5. Set retention beyond your audit period
6. Run incident response and keep records