SOC 2 is a customer story. Israeli privacy law is a regulator story. The same log pipeline has to satisfy both without turning your engineers into part-time lawyers.
Israeli B2B startups often land their first US enterprise customer before they have a full-time security hire. The customer asks for SOC 2. Legal asks about data export. Engineering is already shipping features.
This checklist is intentionally narrow: logs, access, vendors, and evidence—the places where startups most often fail audits or privacy reviews.
Before you touch a checklist
| Decision | Why it matters |
|---|---|
| Where primary data lives | Drives subprocessor list and cross-border transfer analysis |
| Who is “data owner” for security logs | Determines lawful basis documentation and retention arguments |
| What is in scope for SOC 2 | Stops you from over-promising controls you cannot operate |
If you have not written a one-page data map, do that first. Checklists without scope become theater.
Technical controls (what auditors actually sample)
- Identity — MFA enforced for cloud admin, break-glass documented, joiner/mover/leaver process evidenced.
- Logging — Management plane (e.g. CloudTrail) and critical SaaS (Okta, Google Workspace) retained long enough to investigate incidents—not just 7 days because it was the default.
- Access reviews — Quarterly (or faster for privileged roles) with named reviewers and exceptions tracked.
- Change management — Production changes traceable to a ticket or approved pipeline; emergency changes post-reviewed.
- Vendor risk — Subprocessors listed for customers; security reviews on file for anything that touches production or customer data.
For how Israeli law intersects with what you keep in logs, read What the Israeli Privacy Protection Law Means for Your Logs.
Evidence you should be able to export in 24 hours
- Last 90 days of admin logins (success and failure) for cloud and IdP.
- List of users with production access, last access time, and MFA status.
- Sample change tickets tied to infrastructure changes.
- Incident runbooks and postmortem template (even if you have not had a major incident yet).
If your SIEM cannot produce those slices, you will pay consultants to grep CSV exports under deadline pressure.
Final thought
Compliance is not a certificate on the wall—it is a repeatable way to answer uncomfortable questions. If you want a second pair of eyes on your log retention and evidence story before the next enterprise security review, book a discovery call.