SOC 2 file integrity monitoring
Your auditor samples dates. Every one has an answer.
The Trust Services Criteria give file integrity monitoring as an example of a change-detection mechanism. Alertica is one a small team can run: it checks your critical files from outside your servers, alerts the people you choose, and records who reviewed each alert and why. There's a free plan that never expires.
- Agentless, nothing to install
- Evidence for CC6.8, CC7.1 and A1.2
Who it's for
Companies getting ready for a SOC 2 report, with servers and file exchanges outside their cloud provider's managed services.
Built for
- SaaS companies preparing a first Type I or Type II report because a customer asked for it
- Service providers whose readiness assessment found no change detection
- Servers, file drops and backup targets reachable over SFTP
What Alertica covers in SOC 2
Six criteria Alertica gives you evidence for, with what stays with you in the last column.
| Criterion | What it asks | What Alertica does | What you still do |
|---|---|---|---|
| CC7.1 Detect configuration changes | Detect configuration changes that introduce vulnerabilities. A point of focus names change-detection mechanisms such as file integrity monitoring. | Is that mechanism. Compares your critical system, config and content files on every scan, contents included. | Scan for vulnerabilities, which the same criterion asks for. |
| CC6.8 Unauthorized software | Prevent or detect unauthorized or malicious software, and act on it. A point of focus is detecting changes to software and configuration. | Alerts when code or config files change, appear or disappear on the servers you watch. | Control who can install software, and run anti-malware. |
| CC7.2 Monitor for anomalies | Monitor system components for anomalies that could be attacks or errors, and analyze them. | Alerts on mass deletion, suspicious file names and files that stay in a folder too long. | Monitor networks, logins and cloud services. |
| CC7.3 Evaluate security events | Evaluate security events to decide whether they are incidents, and act on them. | Each alert is acknowledged with who, when and a required note saying what they found. | Escalate real incidents through your response plan. |
| A1.2 Backups | Run and monitor backup processes. A point of focus is detecting backup failures and fixing them. | Alerts when the backup file doesn't arrive or shrinks sharply since the last scan. The note records the fix. | Test restores (A1.3). |
| CC8.1 Change management | Authorize, design, test, approve and implement changes to systems. | Every change to watched files shows up, so you can match it to an approved ticket and put the ticket in the note. | Run the change process, and approve each change. |
What your auditor sees
A Type II report tests a period, usually 6 to 12 months. The auditor picks dates and asks what happened on each one. Alertica keeps the answer for every date.
-
Every alert, with who reviewed it
Each alert is acknowledged with a name, a time and a required note. That note is your record for CC7.3, and the place to match a change to its ticket for CC8.1.
-
Twelve months of history
Pro keeps a year of alerts and scans, which covers a 12-month audit period. Any date your auditor picks has its record.
-
Proof it ran every week
Every Monday, a health email per rule: scans that ran, scans that failed, alerts, and what is still open. It shows the control operated through the whole period, week by week.
-
Audit-ready evidence in one download
Pick the audit period and download every alert with who reviewed it, when and the note. A PDF to hand over, or a spreadsheet to filter. If your auditor would rather look, give them a Viewer seat: they see everything and can change nothing.
Why from outside the server
-
Nothing to install
No agent to roll out or patch, and no change request on the server. Alertica logs in over SFTP with a read-only login.
-
Nothing to switch off
An attacker on the server can stop an agent. Alertica runs on our servers, out of their reach.
-
Only fingerprints leave
Alertica works out a fingerprint of each file on your server. File contents never leave it.
-
Set up with you
On Pro and Enterprise our team sets the rules to match CC7.1 with you, server by server.
Live in three steps
-
Connect a server
Add a server with an SFTP, FTPS or FTP login. A read-only login is enough.
-
Set your rules
Pick a folder and say what matters. We set up the rules to match CC7.1 with you on Pro.
-
Choose who hears about it
Add the people who should get alerts, by email, SMS or Slack. Each one is kept for your auditor.
Questions about SOC 2
What Alertica covers in the Trust Services Criteria.
-
Does SOC 2 require file integrity monitoring?
The criteria give it as an example of a change-detection mechanism under CC7.1. It is a clear way to show your auditor you would notice a changed config or system file.
-
Will Alertica make us SOC 2 compliant?
SOC 2 is your auditor's report on your whole program. Alertica gives you evidence for the criteria in the table above, for the whole audit period.
-
What do I hand the auditor?
One download for the audit period, as a PDF or a spreadsheet, with every alert, who acknowledged it, when and why. Add the weekly health emails to show the monitoring ran every week.
-
What does Alertica record for each change?
What changed and when it was found, who was told, and who reviewed it, with their note. Who made the change is in your server's own logs, and the note is the place to record it.
-
Do you copy our files?
No. Alertica works out a fingerprint of each file on your server and reads back only that, with the file's name, size and date. File contents never leave the server.
Set up CC7.1 with our team
Tell us what your auditor asked for. We'll set up the rules to match it with you and go through the first scan together.