SOC 2 Type II with Evidence Built into ServiceNow Change Records
An unqualified Type II report with zero exceptions, and change-management evidence that now collects itself.
Client name withheld by agreement- Client
- Construction project management software company, 4,200 customer firms
- Region
- Boston, Massachusetts
- Year
- 2024
- Duration
- 16 weeks
- Scope
- 88 controls · AWS, GitHub and ServiceNow ITSM · Security and Availability
- Practice
- AI, Cloud & Digital Trust
The challenge
What was at stake.
A construction project management platform holds drawings, bids and payment applications for 4,200 general contractors and owners. Large owners and public agencies had started requiring a SOC 2 Type II report before awarding platform contracts, and the company had never been audited.
Engineering shipped to production more than 120 times a week. Approvals happened in pull requests, deployments in a pipeline and incidents in ServiceNow, and nothing tied the three together in a way an auditor could sample.
What we did
The approach, step by step.
- 01
Criteria chosen around uptime
We scoped Security and Availability, because contractors bidding against a deadline care most that the platform is up and that one firm’s bid never reaches a competitor.
- 02
Change records generated by the pipeline
Every production deployment now opens a ServiceNow change record automatically, attaches the pull request, reviewer approval, test results and deploy log, and closes it once the release is verified.
- 03
Incidents linked to controls
Availability incidents, problem records and customer notifications in ServiceNow were mapped to the relevant criteria, so incident response evidence came straight from ticket history.
- 04
Access reviews on a schedule
Quarterly reviews for AWS, GitHub and the production database run as ServiceNow tasks assigned to each system owner, with approvals and removals recorded in one place.
- 05
Readiness test before the window
A sample-based readiness test across all 88 controls found five gaps, all closed before the six-month observation period began.
Outcomes
What changed, in numbers.
- 0
- exceptions in the Type II report
- 3,100+
- production changes with complete audit evidence
- 88
- controls mapped to ServiceNow records
- 5
- gaps closed before the observation period
Our engineers kept shipping the way they always do. The audit evidence just started showing up in ServiceNow.
Services delivered
Related engagements
More work in AI, Cloud & Digital Trust.
-
New York, New York · 20 weeks
AI, Cloud & Digital Trust · 2026 · OngoingISO/IEC 42001 and Adversarial Testing for a Commercial Underwriting AI PlatformDoctored broker submissions no longer steer risk rankings, and an AI management system is on track for its certification audit.
-
Pittsburgh, Pennsylvania · 22 weeks
AI, Cloud & Digital Trust · 2025Multi-Cloud Security Guardrails for a Regional Health SystemClinical imaging and analytics in two clouds under one set of guardrails, with no change to how radiologists read studies.
-
Cleveland, Ohio · 22 weeks
AI, Cloud & Digital Trust · 2025CMMC Level 2 Certification for a Precision Machining SupplierCertified at the C3PAO assessment, keeping the supplier on two prime contractors’ approved lists.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.