How to assemble a defensible SOC 2 change audit trail for network changes from TACACS+, syslog, config archives, CI pipelines, and cloud control-plane APIs.