Security playbook · AI Employee: Sig

SOC2 / Vanta Evidence Collection

Continuous audit-readiness; zero last-minute scrambling

Install this playbookBack to marketplace
The problem

Evidence collection for SOC 2 is a two-quarter grind. Someone at the company opens Vanta / Drata / Secureframe every day and chases the failing checks. Employees get pinged for laptop-security screenshots, engineers for repo permissions, IT for MFA screenshots. Everyone loathes it. The company passes audit because someone worked nights the last three weeks. Then it starts again next year.

At a glance
Trigger
Cron (per control)
Approvals
Owner attests per control
What it does
Writes to your systems
Systems
Vanta · Drata · Ticketing · Cloud APIs
How it feels in production

An hour-by-hour walkthrough.

Every morning at 06:00, Sig pulls the current state of every SOC 2 control from Vanta / Drata / Secureframe. For each control, it checks: - Is the automated check passing (Vanta's own connectors already cover 60-80% of controls) - Is the evidence current (SOC 2 requires evidence to be within a rolling window, typically 30-90 days) - Is a manual attestation needed (some controls require a signed human confirmation each period) For failing or aging evidence, Sig identifies the owner from the Context Graph: laptop-encryption checks → the affected employee, GitHub branch-protection checks → the repo maintainer, vendor DPA checks → legal + vendor manager. Sig sends the owner a specific, actionable ask: "Your laptop's encryption check is stale as of 2026-08-02. To refresh: Vanta Agent should re-verify on your next login. If you're seeing an issue, click here for the fix." or "Repo `payments-api` has main branch without required-reviews-before-merge. Suggested change: enable this setting; PR here." For manual attestations, Sig drafts the language and sends the acknowledgement form. Weekly digest to the security lead: control health, aging evidence, top-owners with open items, audit-readiness score. When the actual audit starts, the auditor sees a green board with fresh evidence rather than a two-week scramble.
How it works

Step by step.

  1. 01

    Pull the control state daily

    Read every control from Vanta / Drata / Secureframe / Tugboat / Thoropass. Automated checks + evidence-age + manual-attestation requirements. Normalise to a common control record.

    Vanta · Drata · Secureframe · Tugboat · Thoropass
  2. 02

    Detect failing + aging + missing evidence

    Failing: automated check is red. Aging: evidence older than the control's rolling window. Missing: manual attestation past its refresh deadline. Each maps to a different owner + remediation.

    Compliance policy · Evidence age matrix
  3. 03

    Route to the correct owner with the fix

    Context Graph resolves owner (individual, team, function). Owner DM has: the specific failing check, why it matters, the exact fix (not a link to a runbook), and often a one-click remediation.

    Slack · Teams · Context Graph · Runbook library
  4. 04

    Track responses + escalate

    Response tracker per control. Nudge at day 2, escalate to manager at day 4, security lead at day 7. Non-response is itself a signal — surfaces control ownership gaps for org planning.

    Approval tracker · Slack · Manager escalation
  5. 05

    Weekly digest + audit-readiness score

    Weekly digest to security lead: control health rollup, aging evidence trend, top owners with open items, audit-readiness score (0-100) with drivers. Auditor-facing dashboard when audit window opens.

    Analytics · Slack digest · Auditor portal
Systems and wiring

What you connect to make this run.

Vanta · Drata · Secureframe

read+write

Read control state, evidence age, connector status. Write remediation events, attestation acknowledgements, evidence uploads. The GRC platform stays the audit-facing system of record; Sig is the orchestration layer.

Okta · Google Workspace · Jamf · GitHub · AWS

read+write

Direct writes for automated remediations. Missing MFA → force enrollment. Missing branch protection → PR to enable. Unencrypted laptop → MDM policy push. Each verified before marking evidence current.

Slack · Teams · Email

read+write

Owner-specific DMs with the exact fix. Attestation acknowledgement forms embedded. Nudge + escalation ladder. Weekly digest to security lead + auditor.

Context Graph · Directory · CODEOWNERS

read

Owner resolution: repo → maintainer, vendor → vendor-manager, laptop → user. Escalation ladder from org chart. Non-response gaps surface owner-mapping issues.

What changes

Before and after, honestly.

Days to remediate a failing control
Before
14-45 days
After
1-5 days
Employee hours per year on SOC 2 evidence
Before
40-100 hours per person
After
8-15 hours
% of controls audit-ready at any time
Before
60-80%
After
95%+ (fresh evidence throughout the year)
Audit-prep sprint duration
Before
3-6 weeks
After
3-5 days (verification + narrative only)
Related

Playbooks that pair with this one.

Security

Vendor Security Review

Vendor DPA + posture checks are themselves SOC 2 controls this playbook watches.

Security

User Access Reviews (UAR)

Quarterly UAR is a control refreshed by the review flow; both live in the same GRC.

Frequently asked

Answers about this playbook.

How does this differ from what Vanta / Drata already do?

Vanta detects the failing check + emails the owner. Sig routes to the correct owner via Context Graph, drafts the actionable fix (not just "go fix this"), often executes the fix directly, chases non-responses, and rolls up owner-response patterns for planning. GRC platforms report; Sig acts.

What if we have multiple compliance frameworks (SOC 2 + ISO 27001 + HIPAA)?

Sig deduplicates controls across frameworks. Laptop encryption is one control satisfying multiple framework requirements — one evidence-refresh action, multiple framework check-ins. Reduces employee burden proportionally.

Can auditors interact with the system?

Read-only auditor view. Auditor sees the current state, evidence links, remediation history, control ownership. No writes; can request additional evidence which routes to owners the same way.

What about controls that require in-person or physical evidence?

Physical-security controls (badge access logs, camera positioning) still require human verification. Sig routes the request to the office manager or physical-security team with the specific evidence template.

How does it handle new employees mid-audit-period?

New employees added to owner-resolution automatically. Their evidence backfills as they complete onboarding checks (laptop enrolment, MFA setup, security training). Auditor sees a full picture including hires within the window.

See it run on your data.

Free plan, no credit card. Connect the systems this playbook needs and run it against a past event first.

Book a demoMore Security playbooks