ISO 27001 and SOC 2 audits: what to mask in the evidence you hand over

Mask what does not prove the control, and keep what does. An auditor needs to see that an access review happened, who approved it and when. They rarely need the salary, the home address or the password that sits next to it. Agree the approach with your auditor before the audit starts.

Take Jane Example, who runs security at a small software company. Her auditor asks for ten leaver tickets, the latest access review and a screenshot of the firewall settings. Each file will leave her company. This guide is general information as of October 2026, not legal advice.

What do auditors sample, and where does your evidence go?

An audit does not read every record. It checks a sample. In Germany, the federal office BSI publishes an audit scheme for ISO 27001 certification based on IT-Grundschutz. It says a certification audit checks requirements on a sample of topic modules. The audit team lead picks them by risk and justifies the choice. ISO 19011, the guideline for auditing management systems, also covers sampling, according to ISO and the IAF.

Evidence then moves. Depending on your set-up, it may travel by email, through the audit firm's portal or through your compliance platform. In the BSI scheme, the finished audit report reaches the certification body in encrypted form. How long a firm keeps its working papers is not stated in the sources we checked, so ask in the engagement letter.

Do ISO 27001 and SOC 2 ask you to mask data?

ISO/IEC 27002:2022 lists data masking as control 8.11. ISACA's guide to the 2022 update says it limits the exposure of sensitive data. It quotes the wording: masking should follow your access control policy and business needs, taking applicable legislation into consideration. That wording does not mention audit evidence, but the logic is the same.

SOC 2 reports use the AICPA's Trust Services Criteria. A report covers one or more of five categories: security, availability, processing integrity, confidentiality and privacy. If it includes confidentiality, criterion C1.1 asks the organization to identify and maintain confidential information. If it includes privacy, criterion P4.1 limits the use of personal information to the purposes the organization has identified. Masking your evidence follows the same logic.

Data protection law points the same way. EU: Article 5(1)(c) GDPR requires personal data to be adequate, relevant and limited to what is necessary for the purpose. UK: the ICO states the same test, and its page is under review as of October 2026. Masking reduces exposure. It does not make you compliant by itself.

What should stay visible, and what should you mask?

Use this table as a starting point. Your auditor decides what proves each control.

How do you handle screenshots, secrets and population lists?

• Secrets: API keys, tokens, passwords and private keys must never appear in a screenshot or export. If one was visible in a file you already shared, change it.
• Customer data: tickets, logs and exports often hold customer names, emails and IP addresses. The auditor rarely needs them.
• Screenshot edges: check the browser tabs, the address bar, the account menu and open notifications. Personal emails hide there.
• File names: a file named after a person still names that person. Rename it.

Auditors pick samples from a population list, such as all employees or all admin accounts. Send only the columns needed to choose and trace a sample: an ID, a date, a role, a status. In Excel, delete the other columns instead of hiding them. Microsoft's documentation says Document Inspector finds hidden rows, columns and sheets, and document properties such as the author name.

ONYRI Sanitize masks a copy of a PDF, Word (.docx) or image file inside your browser, without uploading it. On every plan it finds emails, names, IPv4 addresses and ID numbers. On Pro it adds API keys, cloud tokens and SSH private keys. On-device OCR reads image files and scanned pages, not screenshots inside a page with text. “Draw an area” covers any region. It cannot judge what your auditor needs, and its export is not searchable text.

How do you agree the approach with your auditor?

1. Ask, before the audit starts, which evidence will contain personal data and what the auditor must see in each file.
2. Write the rule on one page and send it. A short email thread can serve as the record.
3. Mask copies, review the preview and keep the originals untouched, with the same ticket numbers, so the auditor can compare.
4. Offer to show the original on screen for sensitive samples. The BSI scheme itself says some documents can only be viewed on site for confidentiality reasons.
5. Note what you handed over, when and how. Ask what the firm does with the files after the audit.

How you send the files matters too. France: the CNIL's security guide says to encrypt sensitive files and use a protocol such as SFTP or HTTPS. It also says to plan the deletion of files left on a transfer platform. It warns against sending unencrypted personal data through consumer messaging.

Start small. Pick one type of evidence, mask a copy and ask your auditor to confirm it works before you do the rest. The first sample that passes becomes your template.

Frequently asked questions

Sources & references