Does Datadog help with SOC 2?

Yes. Datadog is evidence for several SOC 2 controls in the Availability (A1) and Common Criteria (CC7) categories. Monitors, alert configurations, and uptime metrics are all directly usable as audit evidence.

What SOC 2 controls does Datadog cover?

Datadog primarily covers CC7.1 (system monitoring), CC7.2 (anomaly detection), A1.2 (capacity monitoring), and CC6.8 (unauthorized software detection) when used with the agent. It does not cover access controls or personnel controls.

Do auditors accept Datadog dashboards as evidence?

Screenshots and exports are accepted. The stronger evidence is API-collected data showing alert configurations are active, thresholds are set, and the monitoring coverage is continuous, not a one-time snapshot.

What Datadog configuration gaps commonly cause SOC 2 findings?

The most common finding is monitors configured but not alerting anywhere actionable. An alert that goes to a silent Slack channel or an unmonitored email inbox does not satisfy CC7.2. Auditors check that alerts route to on-call workflows.

Is Datadog a complete SOC 2 solution on its own?

No. Datadog covers monitoring and availability controls. You still need identity management evidence, access review logs, vulnerability scan results, and policy documents for a complete SOC 2 picture.

Datadog SOC 2 Compliance Guide

Datadog is one of the most common tools in the stack of companies pursuing SOC 2. It generates continuous evidence across monitoring, alerting, and availability controls. But having Datadog in your stack does not automatically mean you are covered. What matters is how it is configured and how that configuration is captured as evidence.

This guide covers which SOC 2 controls Datadog maps to, what auditors look for, and the configuration gaps that most commonly cause findings.

Datadog SOC 2 compliance checklist: 5 configuration items auditors look for

Which SOC 2 Controls Datadog Covers

Datadog evidence is relevant to several Trust Service Criteria, concentrated in the Availability and Common Criteria categories.

CC7.1: System Monitoring

CC7.1 requires that your organization monitors its systems to detect anomalies. Datadog is direct evidence for this control. Auditors want to see:

Active monitors on production services
Alert thresholds configured and documented
Evidence that monitoring has been continuous, not just enabled before the audit window

CC7.2: Anomaly Detection and Response

CC7.2 requires that anomalies are identified and responded to. Datadog satisfies the detection half. The response half requires that alerts route to an on-call process with documented escalation. An alert that fires into a silent channel fails this control even if the monitor itself is configured correctly.

A1.2: Capacity and Performance Monitoring

The Availability category requires monitoring for capacity and performance thresholds. CPU, memory, disk, and network metrics in Datadog with alert thresholds cover this directly. Auditors look for evidence that you would know before your customers if a resource constraint was approaching.

CC6.8: Unauthorized Software

When running the Datadog agent on hosts, process monitoring can be configured to flag unexpected processes. This provides evidence toward CC6.8. It is not the primary control mechanism for most companies, but it is a useful secondary signal.

What Datadog Does Not Cover

Datadog does not generate evidence for:

Access management controls (CC6.1, CC6.2, CC6.3): requires your identity provider
Personnel controls (CC1.x): requires HR and training records
Change management (CC8.1): requires your version control or deployment pipeline
Vulnerability management (CC7.1 in part): requires a dedicated scanner like Tenable or Snyk

The Configuration Gaps Auditors Find Most Often

Alerts with no actionable routing

The most common finding is monitors that alert to a dead-end destination. An alert that emails a shared inbox nobody checks, or posts to a Slack channel without an on-call integration, does not satisfy CC7.2. Auditors read the alert routing configuration, not just whether monitors exist. Fix: route all production alerts to PagerDuty, OpsGenie, or another on-call system with documented escalation paths.

Monitors without documented thresholds

Auditors want to understand the logic behind your alert thresholds. A CPU alert set at 95% with no documented rationale is harder to defend than one tied to a stated capacity policy. Document why thresholds are set where they are.

No evidence of monitor review

SOC 2 is about ongoing processes, not point-in-time configurations. Auditors sometimes ask for evidence that monitors are reviewed periodically. A recurring review in your compliance calendar with a logged output is the clearest way to satisfy this.

Agent coverage gaps

If you run the Datadog agent for host-level monitoring, auditors may ask about coverage. Hosts not running the agent represent a gap in your monitoring posture. Know your coverage percentage before the audit.

What Good Datadog Evidence Looks Like

The strongest Datadog evidence is API-collected rather than screenshots. A snapshot of your current dashboard shows the state today. An API export showing alert history, uptime percentages, and configuration state across the audit period is far more useful to an auditor.

For each relevant control, you want to be able to show:

The monitor exists and has been active throughout the audit period
Alerts route to a documented on-call process
There is a record of at least one alert being triggered and responded to

SOC 2 Configuration Checklist for Datadog

Tip

All production services have active monitors
Alert thresholds are documented in your runbooks or control descriptions
Alerts route to PagerDuty, OpsGenie, or another on-call system
Datadog agent is deployed on all production hosts
Uptime SLOs are configured and tracked for A1.2
Monitor review is on your compliance calendar with a logged output
API tokens for Datadog are scoped to read-only for evidence collection integrations

Mapping Datadog's alert configuration and uptime evidence to CC7.1, CC7.2, and A1.2, and keeping it current, is the kind of monitoring-control work a fractional CISO owns for you. Book a call to walk through your monitoring controls.

Want a security leader to run this?

Xorabyte is a fractional CISO for startups who can own your SOC 2 readiness end to end, so a blocked deal or an audit stops being your problem to carry alone. Book a call and you will leave with a clear path, not a sales pitch.