What SOC 2 and ISO 27001 Auditors Actually Ask For Before You Move Regulated Workloads to AWS, GCP, Azure or Scaleway

SOC 2 Type II and ISO 27001 Stage 2 auditors assess an organization’s controls over cloud workloads rather than the underlying cloud provider, focusing on system-generated evidence for access management, approved production changes, encryption and key custody, centralized retained logging, and risk and supplier reviews. Under the shared-responsibility model, providers such as AWS, GCP, Azure, and Scaleway handle physical infrastructure and certain managed services, while customers remain responsible for IAM, network settings, patching, encryption configuration, backups, and application security; provider reports and complementary user entity controls help define these obligations. Auditors test complete populations of events over an observation period, so dated records tying access grants, removals, deployments, approvals, logs, and restore tests to named individuals are more important than policies or isolated screenshots. The article recommends migrating before a SOC 2 observation window where possible, using one enforced deployment pipeline, infrastructure as code, environment-specific RBAC, immutable deployment histories, and nonproduction environments without live sensitive data to reduce evidence gaps. It also notes that compliance automation tools can collect evidence but cannot replace operating controls, and presents Qovery as a platform intended to provide governed deployments within an organization’s own cloud account while retaining control of data, keys, regions, and audit logs.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.