Manage — Use when the user asks to prepare for SOC 2 audits, map Trust Service Criteria, build control matrices, collect audit evidence, perform gap analysis, or assess SOC 2 Type I vs Type
Manage — Use when the user asks to prepare for SOC 2 audits, map Trust Service Criteria, build control matrices, collect audit evidence, perform gap analysis, or assess SOC 2 Type I vs Type
[{"name":"code_or_task","type":"string","description":"Code snippet, script, or task description to process","required":true}]
output_schema
[{"name":"report","type":"string","description":"Analysis report or summary from soc2 compliance"}]
SOC 2 Compliance
SOC 2 Type I and Type II compliance preparation for SaaS companies. Covers Trust Service Criteria mapping, control matrix generation, evidence collection, gap analysis, and audit readiness assessment.
SOC 2 (System and Organization Controls 2) is an auditing framework developed by the AICPA that evaluates how a service organization manages customer data. It applies to any technology company that stores, processes, or transmits customer information — primarily SaaS, cloud infrastructure, and managed service providers.
Type I vs Type II
Aspect
Type I
Type II
Scope
Design of controls at a point in time
Design AND operating effectiveness over a period
Duration
Snapshot (single date)
Observation window (3-12 months, typically 6)
Evidence
Control descriptions, policies
Control descriptions + operating evidence (logs, tickets, screenshots)
Data processors managing PII, PHI, or financial data
Managed service providers with access to client systems
Any vendor whose customers require third-party assurance
Typical Journey
Gap Assessment → Remediation → Type I Audit → Observation Period → Type II Audit → Annual Renewal
(4-8 wk) (8-16 wk) (4-6 wk) (6-12 mo) (4-6 wk) (ongoing)
Trust Service Criteria
SOC 2 is organized around five Trust Service Criteria (TSC) categories. Security is required for every SOC 2 report; the remaining four are optional and selected based on business need.
Security (Common Criteria CC1-CC9) — Required
The foundation of every SOC 2 report. Maps to COSO 2013 principles.
External audit, management assertion, report distribution
Anti-Patterns
Anti-Pattern
Why It Fails
Better Approach
Point-in-time compliance
Controls degrade between audits; gaps found during audit
Implement continuous monitoring and automated evidence
Manual evidence collection
Time-consuming, inconsistent, error-prone
Automate with scripts, IaC, and compliance platforms
Missing vendor assessments
Auditors flag incomplete vendor due diligence
Maintain vendor register with risk-tiered assessment schedule
Copy-paste policies
Generic policies don't match actual operations
Tailor policies to your actual environment and technology stack
Security theater
Controls exist on paper but aren't followed
Verify operating effectiveness; build controls into workflows
Skipping Type I
Jumping to Type II without foundational readiness
Start with Type I to validate control design before observation
Over-scoping TSC
Including all 5 categories when only Security is needed
Select categories based on actual customer/business requirements
Treating audit as a project
Compliance degrades after the report is issued
Build compliance into daily operations and engineering culture
Tools
Control Matrix Builder
Generates a SOC 2 control matrix from selected TSC categories.
# Generate full security matrix in markdown
python scripts/control_matrix_builder.py --categories security --format md
# Generate matrix for multiple categories as JSON
python scripts/control_matrix_builder.py --categories security,availability,confidentiality --format json
# All categories, CSV output
python scripts/control_matrix_builder.py --categories security,availability,confidentiality,processing-integrity,privacy --format csv
Evidence Tracker
Tracks evidence collection status per control.
# Check evidence status from a control matrix
python scripts/evidence_tracker.py --matrix controls.json --status
# JSON output for integration
python scripts/evidence_tracker.py --matrix controls.json --status --json
Gap Analyzer
Analyzes current controls against SOC 2 requirements and identifies gaps.
# Type I gap analysis
python scripts/gap_analyzer.py --controls current_controls.json --type type1
# Type II gap analysis (includes operating effectiveness)
python scripts/gap_analyzer.py --controls current_controls.json --type type2 --json
gdpr-dsgvo-expert — SOC 2 Privacy criteria overlaps significantly with GDPR requirements; use together when processing EU personal data
information-security-manager-iso27001 — ISO 27001 Annex A controls map closely to SOC 2 Security criteria; organizations pursuing both can share evidence
isms-audit-expert — Audit methodology and finding management patterns transfer directly to SOC 2 audit preparation
Why This Skill Exists
Manage —
When to Use
Use this skill when the user asks to prepare for SOC 2 audits, map Trust Service Criteria, build control matrices, collect audit evidence, perform gap analysis, or assess SOC 2 Type I vs Type
What If Fails
If this skill fails to produce the expected output: (1) verify input completeness, (2) retry with more specific context, (3) fall back to the parent workflow without this skill.
