How do I prove feature flag changes for SOC 2 change management?
Why Feature Flags Matter for SOC 2
Feature flags modify application behavior without deploying new code. From a SOC 2 perspective, flipping a flag in production is equivalent to a code change — it alters how the system operates. Your change management policy (CC8.1) should cover flag changes.
Auditors are increasingly aware of feature flags. If they ask "how do changes reach production?" and you only describe your GitHub PR workflow, they'll ask about other change vectors — including feature flags.
Evidence to Provide
| Evidence | Source |
|---|---|
| Flag change audit log | LaunchDarkly audit log, Unleash event log, or custom logging |
| Approval workflow | Screenshots showing approval requirements for production flags |
| Flag inventory | List of active production flags with owners |
| Change history | Sample flag changes showing who, what, when |
| Rollback capability | Evidence that flags can be quickly reverted |
Change Management Controls for Flags
Minimum Controls
- Audit logging: Every flag change is logged with timestamp, user, old value, new value
- Access control: Not everyone can change production flags — limit to specific roles
- Documentation: Significant flag changes have a description or ticket reference
Recommended Controls
- Approval workflow: Production flag changes require peer approval (LaunchDarkly supports this)
- Staged rollout: Flags are toggled in staging before production
- Review cadence: Stale flags are reviewed and removed quarterly
Platform-Specific Evidence
LaunchDarkly: Export the audit log showing flag changes during the observation period. Screenshot approval workflows and role-based access settings.
Custom flags (database or config file): Treat flag changes like code changes — require a PR for configuration file changes, or log database updates to an audit table.
Common Gap
Feature flag platforms often have weaker access controls than your code repository. While your GitHub requires PR reviews, your LaunchDarkly might let any team member toggle production flags. Address this asymmetry before the audit.