Asset, Data & Architecture
Assets supporting service delivery are inventoried with owner, environment, location, lifecycle status, classification, criticality, customer data role, and review date.
Use this guide to put the control into operation, decide what records to retain, and check that an auditor can trace the evidence back to the work your team performed.
Maintained by GreenHat Security · Reviewed August 21, 2026
The company knows which assets support its service, who owns them, where and in which environment they operate, their lifecycle state and criticality, whether they handle customer data, and when they were last reviewed.
First SOC 2 program
Begin with production cloud resources, code repositories, endpoints, business SaaS, data stores, and security services. Use provider exports and owner interviews to build one practical inventory with required fields rather than trying to catalog every low-risk object on day one.
As the company scales
Use cloud, device, SaaS, and infrastructure discovery to populate a governed inventory or configuration database. Enforce ownership and environment tags, reconcile discovered assets to approved records, and route stale or unowned entries for resolution.
Identify asset classes that support service delivery or security, including cloud services, hosts, endpoints, repositories, SaaS, data stores, networks, and security tooling.
You should end up with: A documented asset scope with inclusion rules and accountable owner.
Export or query each authoritative platform and combine the results using stable identifiers that can be refreshed later.
You should end up with: Dated source exports or query results for every scoped asset class.
Record owner, environment, location, lifecycle state, classification, criticality, customer-data role, and review date for each relevant asset.
You should end up with: A populated asset register with required fields and unresolved-field queue.
Have service or system owners review their assets, correct attributes, and accept responsibility for changes and retirement.
You should end up with: Owner confirmations with review date and corrections retained.
Compare live provider inventories with the governed register and investigate missing, duplicate, unmanaged, or retired entries.
You should end up with: A reconciliation report with discrepancies, owners, and resolutions.
Add inventory updates to provisioning, architecture change, acquisition, and decommission workflows, using more frequent review for production and customer-impacting assets.
You should end up with: Change records showing assets added, updated, or retired with approval.
Build the evidence set in three layers: what defines the control, who approved or reviewed it, and what proves it operated. Collect operating records when the work happens so they remain dated, attributable, correctly scoped, and traceable to the underlying activity.
Before sharing, remove unrelated personal or customer data, never expose passwords, tokens, or secret values, preserve enough source context to authenticate the record, and use the secure exchange approved for the engagement.
Documents that define the control, its scope, ownership, and expected way of working.
Confirm what the record proves
Shows the governed service-asset population and the operating context needed to assign responsibility, classification, criticality, and lifecycle decisions.
Include this context
stable asset identifier
Include this context
asset type and environment
Include this context
owner
Include this context
location and lifecycle status
Include this context
classification and criticality
Include this context
customer-data role and review date
Weak evidence to avoid
A list of host names with no owner, environment, lifecycle state, customer-data role, source, or review date.
Confirm what the record proves
Shows the live cloud resources discovered from provider accounts and regions, allowing the governed inventory to be challenged for missing or retired assets.
Include this context
provider resource identifier
Include this context
account, project, or subscription
Include this context
region
Include this context
resource type
Include this context
state and creation date
Include this context
owner or service tags
Weak evidence to avoid
A screenshot of one cloud console page that omits accounts, regions, pagination, export time, and stable resource identifiers.
Confirm what the record proves
Shows laptops, workstations, servers, or mobile devices enrolled for management and identifies their assigned user, management state, and lifecycle status.
Include this context
device identifier or serial number
Include this context
assigned user or owner
Include this context
device type and operating system
Include this context
management and compliance state
Include this context
last check-in
Include this context
lifecycle status
Weak evidence to avoid
A purchase ledger listing devices without assigned users, management enrollment, last check-in, or retirement status.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
Confirm what the record proves
Shows that accountable owners examined their asset population, corrected attributes, and resolved or accepted identified discrepancies on the applicable cadence.
Include this context
review scope and snapshot date
Include this context
owner and reviewer
Include this context
assets reviewed
Include this context
discrepancies found
Include this context
decision or correction
Include this context
completion date
Weak evidence to avoid
An email saying inventory looks good without the reviewed population, snapshot date, exceptions, or resulting corrections.
Type 1
The governed asset register and live cloud, endpoint, SaaS, code, and service inventories as of the examination date, including unowned, stale, duplicate, and decommissioning exceptions.
Type 2
Every scheduled quarterly review of production or customer-impacting asset classes, every scheduled annual review of supporting asset classes, and every asset addition, material attribute change, ownership change, or retirement recorded during the review period.
Export each authoritative asset source for all accounts, regions, tenants, and managed-device groups; normalize stable identifiers and reconcile them to the governed register in both directions, then trace every unmatched, unowned, stale, or retired item to a documented resolution.
Use this checklist to prepare for procedures an auditor may perform. The exact steps and sample selection depend on your engagement scope and the service auditor's professional judgment.
Determine whether the control is designed to achieve this result: The company knows which assets support its service, who owns them, where and in which environment they operate, their lifecycle state and criticality, whether they handle customer data, and when they were last reviewed.
Compare the documented owner with the intended role (Engineering / Infrastructure / Data Owner), then compare dated records with the stated cadence: Quarterly for production/customer-impacting; annually for supporting assets.
Export each authoritative asset source for all accounts, regions, tenants, and managed-device groups; normalize stable identifiers and reconcile them to the governed register in both directions, then trace every unmatched, unowned, stale, or retired item to a documented resolution.
The governed asset register and live cloud, endpoint, SaaS, code, and service inventories as of the examination date, including unowned, stale, duplicate, and decommissioning exceptions.
Every scheduled quarterly review of production or customer-impacting asset classes, every scheduled annual review of supporting asset classes, and every asset addition, material attribute change, ownership change, or retirement recorded during the review period.
Documents that define the control, its scope, ownership, and expected way of working.
For each selected record, confirm it demonstrates Shows the governed service-asset population and the operating context needed to assign responsibility, classification, criticality, and lifecycle decisions.
For each selected record, confirm it demonstrates Shows the live cloud resources discovered from provider accounts and regions, allowing the governed inventory to be challenged for missing or retired assets.
For each selected record, confirm it demonstrates Shows laptops, workstations, servers, or mobile devices enrolled for management and identifies their assigned user, management state, and lifecycle status.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
For each selected record, confirm it demonstrates Shows that accountable owners examined their asset population, corrected attributes, and resolved or accepted identified discrepancies on the applicable cadence.
Use the categories that apply to this control: connect any policy or design artifact to its approval or review record, then trace a selected operating record through execution, result, and any exception or remediation.
These identifiers help you navigate related Trust Services Criteria. They do not reproduce the criteria or prove that this control fully addresses them in your environment.
Confirm final scope, mappings, and testing expectations with your service auditor. SOC 2® is an AICPA trademark; GreenHat Security is not affiliated with or endorsed by AICPA.