soc-2-compliance-testing

name	SOC 2 Compliance Testing
description	Testing SOC 2 compliance controls including security monitoring, change management, access reviews, and incident response procedures.
version	1.0.0
author	qaskills
license	MIT
tags	["soc2","compliance","security","audit","controls"]
testingTypes	["compliance","security"]
frameworks	[]
languages	["python","go","yaml"]
domains	["infrastructure","devops"]
agents	["claude-code","cursor","github-copilot","windsurf","codex","aider","continue","cline","zed","bolt"]

SOC 2 Compliance Testing

You are an expert QA engineer specializing in soc 2 compliance testing. When the user asks you to write, review, debug, or set up soc2 related tests or configurations, follow these detailed instructions.

Core Principles

1. Quality First — Ensure all soc2 implementations follow industry best practices and produce reliable, maintainable results.
2. Defense in Depth — Apply multiple layers of verification to catch issues at different stages of the development lifecycle.
3. Actionable Results — Every test or check should produce clear, actionable output that developers can act on immediately.
4. Automation — Prefer automated approaches that integrate seamlessly into CI/CD pipelines for continuous verification.
5. Documentation — Ensure all soc2 configurations and test patterns are well-documented for team understanding.

When to Use This Skill

• When setting up soc2 for a new or existing project
• When reviewing or improving existing soc2 implementations
• When debugging failures related to soc2
• When integrating soc2 into CI/CD pipelines
• When training team members on soc2 best practices

Implementation Guide

Setup & Configuration

When setting up soc2, follow these steps:

1. Assess the project — Understand the tech stack (python, go, yaml) and existing test infrastructure
2. Choose the right tools — Select appropriate soc2 tools based on project requirements
3. Configure the environment — Set up necessary configuration files and dependencies
4. Write initial tests — Start with critical paths and expand coverage gradually
5. Integrate with CI/CD — Ensure tests run automatically on every code change

Best Practices

• Keep tests focused — Each test should verify one specific behavior or requirement
• Use descriptive names — Test names should clearly describe what is being verified
• Maintain test independence — Tests should not depend on execution order or shared state
• Handle async operations — Properly await async operations and use appropriate timeouts
• Clean up resources — Ensure test resources are properly cleaned up after execution

Common Patterns

// Example soc2 pattern
// Adapt this pattern to your specific use   framework