An infrastructure move during a SOC 2 Type 2 audit period, which covers months, touches access, change management, operations, and availability controls at once. SOC 2 evidence from a move is the record showing those controls held, captured as the move happens. Your auditor will see the move in change tickets, access logs, and availability metrics either way.
The problem is rarely that the controls failed. It is that nobody captured the evidence while the move was happening, and reconstructing it afterward from email threads and memory produces exceptions that did not need to exist. The move is planned. The evidence can be too.
Which SOC 2 Criteria Does a Move Touch?
Usually four areas: CC6, CC7, CC8, and, where in scope, A1. SOC 2 reports are built on the AICPA Trust Services Criteria. The common criteria apply to every report, and additional categories apply depending on what the organization has put in scope. The four areas look like this.
CC6, logical and physical access. Equipment leaving a controlled data center is the clearest physical access event you will have all year. Auditors want to see that only authorized people handled in-scope hardware, that physical access to both sites was restricted and logged, and that any media leaving your control was protected or sanitized to a recognized standard such as NIST SP 800-88. Temporary access for movers and contractors is provisioning like any other, and it needs to be removed afterward.
CC7, system operations. This is monitoring and incident handling. A move generates alerts, anomalies, and sometimes real incidents. The evidence shows that monitoring stayed in place or was deliberately suspended with approval, that alerts during the window were triaged, and that anything classified as an incident followed your incident process.
CC8, change management. The move is a change, usually a large set of them. Auditors will look for authorization, testing or validation, and approval before implementation, applied consistently to the infrastructure changes the move required.
A1, availability. If availability is in scope, the move tests your commitments directly. Environmental protections at the new site, capacity, recovery arrangements during the transition, and whether any downtime stayed within what you committed to customers are all fair questions.
CC9 can come in as well, where it addresses vendor and business partner risk. Movers, carriers, and colocation providers are vendors handling in-scope assets, and the due diligence you did on them is evidence.
What Do Auditors Actually Ask For?
For access: the list of people with physical access to both facilities during the move, with approvals; badge or visitor logs for the move window; the date temporary access was revoked; and background check or vetting evidence for the moving crew, where your policy requires it.
For asset handling: the inventory of in-scope equipment that moved, reconciled at origin and destination; custody records showing continuous control in transit; and sanitization or destruction records for anything retired rather than reinstalled.
For change management: the change record or records for the move, the approvals attached to them, the implementation plan, the rollback plan, and post-implementation review. If an emergency change was raised during the window, expect questions about why and whether it was reviewed after the fact.
For operations and availability: monitoring configuration at the new site, alert logs from the window, incident tickets, and uptime reporting against your commitments.
Auditors sample. If the move involved two hundred change tickets, they will pick some of them, and every sampled ticket needs the complete set of approvals. A move where most tickets were approved properly and a handful were rushed through is a move with a sampling risk.
How Do You Collect Evidence During the Move?
The cheapest evidence is evidence produced as a side effect of doing the work properly.
Assign an owner for compliance evidence on the project team, separate from the person running the move. On move night the command center is focused on getting systems up, and evidence capture is the first thing dropped when things run late.
Decide in advance what each artifact is and where it lives. A shared folder structured by criterion, with the expected artifacts listed in each, lets the owner see gaps during the move rather than during fieldwork. The migration workbook can carry a column linking each asset to its custody record and change ticket.
Export anything that will not persist, such as temporary badge lists, colocation portal access grants, and monitoring maintenance windows, with a timestamp before it is purged.
Make approvals happen in the ticketing system, not in chat. An approval given in a messaging thread at 3 a.m. is real, but it is not evidence until someone attaches it to the change record.
Close It Out Properly
Most exceptions come from the end of the move, not the middle.
Temporary access gets left in place because nobody owns revoking it. Old-site badges stay active after the lease ends. Retired hardware sits in a storage room without a disposal record. Monitoring maintenance windows are extended "for a few days" and forgotten.
Run a formal closeout checklist within a week of the final move event: revoke temporary access and record the date, reconcile the asset inventory against the pre-move baseline, confirm retired equipment has a disposition record, end maintenance windows, and attach post-move validation results to the change record as evidence the change worked.
Then write a one- or two-page narrative for the auditor: what moved, when, the controls applied, and where the evidence is kept.
What Evidence Comes From Your Move Provider?
When relocating a data center with an outside provider, their records become part of your evidence. Custody forms, crew rosters, and drive destruction certificates come from them (wiping certificates come from the licensed contractor that performed the wiping), and their completeness is outside your control unless the contract specifies it.
Name the artifacts you need in the statement of work. A provider offering compliance documentation as a defined deliverable should be able to show a sample package. Ask whether the provider holds its own SOC 2 report, and if it does, read the scope section and the complementary user entity controls. Those tell you which controls the provider expects you to operate yourself.
Review the provider's evidence as it arrives, not at the end. A missing signature is easy to fix the morning after a move and nearly impossible to fix six months later in fieldwork.