Evidencing Phone-Possession Controls in a SOC 2 or PSD2 Audit

A carrier verification response satisfies one of NIST AU-3’s six audit-record items. What PSD2 RTS Article 29 still needs, and the log record that closes the gap.