Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Authentication-provider event history can support SOC 2 evidence, but it is not automatically your organization’s complete audit log. A provider records and exposes only the events within its product scope and retention and export rules. To use that history responsibly, map it to the systems, events, controls, and evidence period in your organization’s system description, then document what the source captures, what it omits, and how records are retained and protected.
Provider event history and an organizational audit log are different things
An authentication provider’s event history is a source record: it shows events the provider records and makes available through its interfaces. Your organization’s audit record has a broader job. It should cover the systems and event types relevant to the controls in scope, including activity that may occur outside the identity provider.
As an Amazon Associate I earn from qualifying purchases.
For each control, identify the evidence needed and determine whether the provider record actually supports it. Record the service, covered systems, required and captured event types, documented exceptions, relevant dates, and retrieval method. A provider log can be useful evidence for part of a control without proving that all related activity was captured across the organization.
What to verify before using provider history as evidence
- Scope: Which systems, accounts, identities, and event types are included? Which events occur in other systems or are not recorded by this provider?
- Coverage and exceptions: Compare the control’s required events with the provider’s documented event coverage. Note known omissions and determine how gaps are addressed.
- Time period: Confirm the source retains the dates needed and that the exported time range covers the evidence period being presented.
- Export and delivery: Record whether evidence came from a console, API, streaming integration, or another supported route. For automated delivery, establish how failures or missing events are detected.
- Access and storage: Document who can access the records, where they are stored, and what protects them from unauthorized alteration or deletion.
- Control linkage: Tie each export to the specific control and period it supports. A configuration screenshot can show a setting; by itself, it does not establish continuous event capture or retention throughout an observation window.
Assess a centralized logging pipeline against the same questions. It may make records from multiple systems easier to search and correlate, and may support longer retention, but it does not make an incomplete source complete. Preserve the original source’s scope, filtering choices, and any delivery gaps in the evidence record.
#1 Best Overall
- Standard OATH compliant TOTP token (time based)
- 6-digit OTP code with countdown time bar
- Zero footprint: no need for the end user to install any software
- Secure, sturdy, and long-life hardware design
- Easy to use - Portable key chain design. These tokens will only work with Symantec VIP Access. These tokens will not work for any other Multi-Factor Authentication services, besides Symantec VIP Access.
Retention and export depend on the product
Retention and retrieval are product-specific; there is no universal period to assume for all authentication providers. Okta Support’s “Access and Export Okta System Log Events,” updated June 19, 2026, says Okta retains System Log events for 90 days. The same page describes console, API, log streaming, and third-party integration routes for access and export. This is an Okta-specific product statement, not an industry benchmark or a SOC 2 retention mandate. Check the current documentation and your product configuration when establishing whether the dates needed for an engagement are available. Okta: Access and Export Okta System Log Events
What CloudTrail can—and cannot—show about AWS identity activity
AWS documents that CloudTrail logs IAM and AWS STS API calls, and discusses federated identity information for some unauthenticated AssumeRoleWithSAML and AssumeRoleWithWebIdentity requests. AWS also warns that some requests may not be logged because they are not sufficiently valid to be trusted, and describes further exceptions. Therefore, do not treat CloudTrail as a record of every authentication or federated-identity event. Check the event reference and the configuration of the actual account and trail against the control’s needs. AWS: Logging IAM and AWS STS API calls with AWS CloudTrail
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
An ongoing CloudTrail trail can deliver log files to an S3 bucket. Enabling log-file integrity validation causes CloudTrail to deliver digest files, but that is not the same as completing validation. AWS states: “Enabling log file integrity validation allows CloudTrail to deliver digest log files to your Amazon S3 bucket, but does not validate the integrity of the files.” CloudTrail creates a hash for each delivered log file and hourly digest files that reference files from the prior hour; digest signatures form a chain. You must run a validation step, for example with the AWS CLI, to check whether files changed or were deleted after delivery. Storage and digest delivery alone do not prove that validation occurred. AWS CloudTrail: Validating CloudTrail log file integrity
SOC 2 evidence depends on the engagement and controls in scope
SOC is a suite of services CPAs may provide in connection with system-level controls of a service organization or entity-level controls of other organizations. The AICPA & CIMA resource page identifies the Trust Services Criteria and SOC 2 Description Criteria as relevant official resources. The Trust Services Criteria address controls over security, availability, processing integrity, confidentiality, or privacy; exact criterion wording and evidence sufficiency should be checked against the applicable criteria and the engagement’s auditor guidance. AICPA & CIMA: System and Organization Controls: SOC Suite of Services AICPA & CIMA: 2017 Trust Services Criteria, with revised points of focus (2022)
Rank #3
- OTP token that provides secure remote access with strong authentication
- Easy to use and easy to carry
- Expected battery life is approximately 7 years
These sources do not establish a universal rule that every company must retain every authentication event for a fixed number of days. The relevant evidence depends on the controls and system in scope and on the auditor’s request for the engagement. No single provider log, archive, or product by itself earns SOC 2 compliance.
Quick Recap
Rank #4
- Works with authentication systems that support TOTP tokens: Google, Facebook, Coinbase, GDAX, Dropbox, GitHub, Kickstarter, Microsoft, TeamViewer, etc.
- Programmable an unlimited number of times. Features syncable clock to prevent issues with drift
- About half the size of a credit card and just as thick-easily keep multiple cards in wallet
- Works with "Token2 Token Burner" or "Protectimus TOTP Burner", both available in the Google Play Store. Now also iOS compatible (iPhone 7 and later)
- More secure than software token as your codes cannot be intercepted by malware on your phone.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
