Anyone using Wiz for SOC2 audit evidence collection?

Having recently completed the evidence-gathering phase for our own SOC 2 Type II audit, I wanted to share our team's experience leveraging the Wiz platform as a primary data source. The promise is compelling: a single, cloud-native platform with deep visibility into cloud security posture, vulnerability management, and compliance. The reality, however, involves significant integration and transformation work to mold Wiz outputs into auditor-acceptable evidence packages.

Our approach centered on using the Wiz GraphQL API to programmatically extract data, which we then normalized and presented in a structured format. The key evidence categories we targeted included:

* **User Access Reviews:** Pulling `User` and `Role` objects, then mapping them to cloud resources to demonstrate periodic review of access controls.
* **Vulnerability Management:** Using `VulnerabilityFinding` nodes with temporal filters to prove regular scanning and remediation workflows over the audit period.
* **Configuration Compliance:** Exporting results from Wiz Security Graph queries related to specific CIS Benchmark controls (e.g., "Ensure Cloud Storage is encrypted") as snapshots in time.
* **Alert & Incident Response:** Querying `Issue` and `Alert` objects to demonstrate monitoring and ticketing system integration.

The primary challenge was not data collection, but curation. Raw API payloads are too voluminous and lack the narrative context auditors require. We built a middleware layer (Node.js) to orchestrate these calls, filter to the relevant timeframes, and generate summary reports. A simplified example of fetching critical vulnerabilities for a specific period:

```graphql
query SOC2EvidenceVulnerabilities($first: Int, $filter: VulnerabilityFindingFilters) {
vulnerabilityFindings(first: $first, filter: $filter) {
nodes {
id
name
severity
status
createdAt
updatedAt
resource {
id
name
cloudPlatform
}
}
}
}
```

Variables:
```json
{
"first": 500,
"filter": {
"severity": ["CRITICAL", "HIGH"],
"updatedAt": {
"after": "2024-01-01T00:00:00Z",
"before": "2024-06-30T23:59:59Z"
}
}
}
```

We then transformed this data into a CSV timeline linked to our internal ticketing system (via Zapier webhooks) to show the lifecycle of each finding.

**Pitfalls to Consider:**
* **Control Mapping Gap:** Wiz's built-in compliance frameworks (CIS, etc.) don't map 1:1 to SOC 2 Trust Services Criteria. You must manually align the evidence.
* **Data Locality:** Ensure your API calls and data processing adhere to the same geographic compliance requirements as your audit.
* **Evidence Integrity:** Auditors often require immutable logs. We had to supplement API data with exported, timestamped PDFs from the Wiz UI to serve as "unalterable" snapshots.

Ultimately, Wiz served as a powerful *source* of truth, but not a *presentation* of truth for audit purposes. The effort to build the integration was justified by the automation and scale it provided across multiple cloud accounts. I'm keen to hear if others have taken a different approach, perhaps using Wiz's newer reporting features or integrating directly with GRC platforms.

API first.