Service Commitments
Commitment approval records, registers, shared-responsibility matrices, customer-facing materials, and monitoring evidence are retained for SOC 2 support.
Use this guide to put the control into operation, decide what records to retain, and check that an auditor can trace the evidence back to the work your team performed.
Maintained by GreenHat Security · Reviewed August 21, 2026
Approvals, commitment versions, responsibility records, customer communications, monitoring results, and related decisions remain complete and retrievable for the period in which they mattered.
First SOC 2 program
Create a restricted evidence area organized by commitment or service, use consistent names and dates, preserve final versions and approvals, and keep a simple index so another person can retrieve records without relying on the original owner’s inbox.
As the company scales
Automate capture from contract, approval, monitoring, and communication systems into a governed repository with metadata, version history, retention rules, access logs, legal holds where applicable, and periodic retrieval checks.
List the records that demonstrate commitment identification, approval, ownership, operation, measurement, exception handling, change notification, and periodic review.
You should end up with: An evidence inventory mapping each commitment activity to its authoritative record source.
Choose retention periods based on applicable customer, legal, business, and assurance needs, and limit access according to contract and customer sensitivity.
You should end up with: Approved retention, disposal, access, and hold rules for commitment records.
Use stable identifiers and metadata for commitment, customer or service scope, record type, owner, event date, review period, and version.
You should end up with: A searchable evidence index that links to the authoritative stored records.
Retain the final content, approvals, timestamps, source data, calculation context, and prior versions needed to understand what was true at the relevant date.
You should end up with: Versioned, dated records that cannot be silently replaced by a newer state.
Assign owners or automated jobs to collect records at the time of approval, review, notification, measurement, or exception decision.
You should end up with: A complete evidence trail gathered during normal operation rather than reconstructed later.
Periodically sample commitments and have someone other than the record owner retrieve the expected records, verify access, and resolve missing or broken links.
You should end up with: A retrieval-check record with sampled items, findings, owners, and completed corrections.
Build the evidence set in three layers: what defines the control, who approved or reviewed it, and what proves it operated. Collect operating records when the work happens so they remain dated, attributable, correctly scoped, and traceable to the underlying activity.
Before sharing, remove unrelated personal or customer data, never expose passwords, tokens, or secret values, preserve enough source context to authenticate the record, and use the secure exchange approved for the engagement.
Documents that define the control, its scope, ownership, and expected way of working.
Confirm what the record proves
The company can reconstruct which service descriptions, responsibility statements, notices, and other assurance content customers received at relevant dates.
Include this context
content identifier and type
Include this context
customer or audience
Include this context
version
Include this context
published or delivered date
Include this context
retirement date
Include this context
archived content location
Weak evidence to avoid
Only the current trust-center page is retained, making the wording published before a material service change impossible to reconstruct.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
Confirm what the record proves
A reviewer tested whether expected commitment evidence was complete, readable, correctly scoped, and retrievable and ensured findings were corrected.
Include this context
review date and reviewer
Include this context
sample or population
Include this context
expected record types
Include this context
retrieval result
Include this context
finding and owner
Include this context
correction status
Weak evidence to avoid
An annual evidence complete attestation with no sampled commitments, expected artifacts, retrieval results, identified gaps, or correction evidence.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
Confirm what the record proves
The repository contains an indexed, retrievable population of commitment approvals, versions, reviews, monitoring, exceptions, and communications for the relevant period.
Include this context
record identifier and type
Include this context
commitment identifier
Include this context
customer or service scope
Include this context
event date and applicable period
Include this context
version
Include this context
stored record link or checksum
Weak evidence to avoid
A screenshot of folders labeled Contracts and Reviews without a record-level export, commitment IDs, dates, versions, or proof that the linked files are retrievable.
Confirm what the record proves
Configured retention, disposal, access, versioning, and hold rules protect commitment records for the intended duration and sensitivity.
Include this context
repository or record class
Include this context
retention period and trigger
Include this context
disposal behavior
Include this context
access roles
Include this context
versioning or immutability setting
Include this context
configuration review date
Weak evidence to avoid
A policy says keep records for several years, but the repository shows no configured rule, record class, trigger, version protection, or access restriction.
Type 1
Current evidence-repository configuration, retention and access settings, current evidence index, and the latest completed retrieval review as of the examination date.
Type 2
Every commitment evidence record created, revised, archived, disposed, placed on hold, or tested for retrieval during the review period, including every customer-facing content version retired in the period.
Reconcile repository exports to commitment-register evidence links and source-system events, verify retired content versions are archived, and retest all missing or unreadable records identified by the retrieval review.
Use this checklist to prepare for procedures an auditor may perform. The exact steps and sample selection depend on your engagement scope and the service auditor's professional judgment.
Determine whether the control is designed to achieve this result: Approvals, commitment versions, responsibility records, customer communications, monitoring results, and related decisions remain complete and retrievable for the period in which they mattered.
Compare the documented owner with the intended role (Service Owner / Legal / CISO), then compare dated records with the stated cadence: Ongoing; review at least annually.
Reconcile repository exports to commitment-register evidence links and source-system events, verify retired content versions are archived, and retest all missing or unreadable records identified by the retrieval review.
Current evidence-repository configuration, retention and access settings, current evidence index, and the latest completed retrieval review as of the examination date.
Every commitment evidence record created, revised, archived, disposed, placed on hold, or tested for retrieval during the review period, including every customer-facing content version retired in the period.
Documents that define the control, its scope, ownership, and expected way of working.
For each selected record, confirm it demonstrates The company can reconstruct which service descriptions, responsibility statements, notices, and other assurance content customers received at relevant dates.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
For each selected record, confirm it demonstrates A reviewer tested whether expected commitment evidence was complete, readable, correctly scoped, and retrievable and ensured findings were corrected.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
For each selected record, confirm it demonstrates The repository contains an indexed, retrievable population of commitment approvals, versions, reviews, monitoring, exceptions, and communications for the relevant period.
For each selected record, confirm it demonstrates Configured retention, disposal, access, versioning, and hold rules protect commitment records for the intended duration and sensitivity.
Use the categories that apply to this control: connect any policy or design artifact to its approval or review record, then trace a selected operating record through execution, result, and any exception or remediation.
These identifiers help you navigate related Trust Services Criteria. They do not reproduce the criteria or prove that this control fully addresses them in your environment.
Confirm final scope, mappings, and testing expectations with your service auditor. SOC 2® is an AICPA trademark; GreenHat Security is not affiliated with or endorsed by AICPA.