Manage — Use when the user asks to prepare for SOC 2 audits, map Trust Service Criteria, build control matrices, collect audit evidence, perform gap analysis, or assess SOC 2 Type I vs Type
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Manage — Use when the user asks to prepare for SOC 2 audits, map Trust Service Criteria, build control matrices, collect audit evidence, perform gap analysis, or assess SOC 2 Type I vs Type
[{"name":"code_or_task","type":"string","description":"Code snippet, script, or task description to process","required":true}]
output_schema
[{"name":"report","type":"string","description":"Analysis report or summary from soc2 compliance"}]
SOC 2 Compliance
SOC 2 Type I and Type II compliance preparation for SaaS companies. Covers Trust Service Criteria mapping, control matrix generation, evidence collection, gap analysis, and audit readiness assessment.
SOC 2 (System and Organization Controls 2) is an auditing framework developed by the AICPA that evaluates how a service organization manages customer data. It applies to any technology company that stores, processes, or transmits customer information — primarily SaaS, cloud infrastructure, and managed service providers.
Type I vs Type II
Aspect
Type I
Type II
Scope
Design of controls at a point in time
Design AND operating effectiveness over a period
Duration
Snapshot (single date)
Observation window (3-12 months, typically 6)
Evidence
Control descriptions, policies
Control descriptions + operating evidence (logs, tickets, screenshots)
Data processors managing PII, PHI, or financial data
Managed service providers with access to client systems
Any vendor whose customers require third-party assurance
Typical Journey
Gap Assessment → Remediation → Type I Audit → Observation Period → Type II Audit → Annual Renewal
(4-8 wk) (8-16 wk) (4-6 wk) (6-12 mo) (4-6 wk) (ongoing)
Trust Service Criteria
SOC 2 is organized around five Trust Service Criteria (TSC) categories. Security is required for every SOC 2 report; the remaining four are optional and selected based on business need.
Security (Common Criteria CC1-CC9) — Required
The foundation of every SOC 2 report. Maps to COSO 2013 principles.
External audit, management assertion, report distribution
Anti-Patterns
Anti-Pattern
Why It Fails
Better Approach
Point-in-time compliance
Controls degrade between audits; gaps found during audit
Implement continuous monitoring and automated evidence
Manual evidence collection
Time-consuming, inconsistent, error-prone
Automate with scripts, IaC, and compliance platforms
Missing vendor assessments
Auditors flag incomplete vendor due diligence
Maintain vendor register with risk-tiered assessment schedule
Copy-paste policies
Generic policies don't match actual operations
Tailor policies to your actual environment and technology stack
Security theater
Controls exist on paper but aren't followed
Verify operating effectiveness; build controls into workflows
Skipping Type I
Jumping to Type II without foundational readiness
Start with Type I to validate control design before observation
Over-scoping TSC
Including all 5 categories when only Security is needed
Select categories based on actual customer/business requirements
Treating audit as a project
Compliance degrades after the report is issued
Build compliance into daily operations and engineering culture
Tools
Control Matrix Builder
Generates a SOC 2 control matrix from selected TSC categories.
# Generate full security matrix in markdown
python scripts/control_matrix_builder.py --categories security --format md
# Generate matrix for multiple categories as JSON
python scripts/control_matrix_builder.py --categories security,availability,confidentiality --format json
# All categories, CSV output
python scripts/control_matrix_builder.py --categories security,availability,confidentiality,processing-integrity,privacy --format csv
Evidence Tracker
Tracks evidence collection status per control.
# Check evidence status from a control matrix
python scripts/evidence_tracker.py --matrix controls.json --status
# JSON output for integration
python scripts/evidence_tracker.py --matrix controls.json --status --json
Gap Analyzer
Analyzes current controls against SOC 2 requirements and identifies gaps.
# Type I gap analysis
python scripts/gap_analyzer.py --controls current_controls.json --type type1
# Type II gap analysis (includes operating effectiveness)
python scripts/gap_analyzer.py --controls current_controls.json --type type2 --json
gdpr-dsgvo-expert — SOC 2 Privacy criteria overlaps significantly with GDPR requirements; use together when processing EU personal data
information-security-manager-iso27001 — ISO 27001 Annex A controls map closely to SOC 2 Security criteria; organizations pursuing both can share evidence
isms-audit-expert — Audit methodology and finding management patterns transfer directly to SOC 2 audit preparation
Why This Skill Exists
Manage —
When to Use
Use this skill when the user asks to prepare for SOC 2 audits, map Trust Service Criteria, build control matrices, collect audit evidence, perform gap analysis, or assess SOC 2 Type I vs Type
What If Fails
If this skill fails to produce the expected output: (1) verify input completeness, (2) retry with more specific context, (3) fall back to the parent workflow without this skill.
