performing-soc2-type2-audit-preparation

name	performing-soc2-type2-audit-preparation
description	Use when automating SOC 2 Type II audit preparation including gap assessment against AICPA Trust Services Criteria (CC1-CC9), evidence collection from cloud providers and identity systems, control testing validation, remediation tracking, and continuous compliance monitoring. Covers all five TSC categories (Security, Availability, Processing Integrity, Confidentiality, Privacy) with automated evidence gathering from AWS, Azure, GCP, Okta, GitHub, and Jira.
domain	cybersecurity
tags	["performing","soc2","type2","audit","preparation","compliance","grc"]
subdomain	governance-risk-compliance
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["GV.OC-01","GV.RM-01","GV.PO-01","GV.OV-01"]

Performing Soc2 Type2 Audit Preparation

Overview

Cybersecurity skill for performing soc2 type2 audit preparation. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "performing soc2 type2 audit preparation"

• "Automates SOC 2 Type II audit preparation including gap assessment against AICPA"

• When preparing for a SOC 2 Type II audit engagement with a CPA firm

• When conducting a gap assessment against AICPA Trust Services Criteria

• When automating evidence collection across cloud infrastructure and identity providers

• When validating that controls have operated effectively over the audit period (3-12 months)

• When building continuous compliance monitoring to maintain SOC 2 posture between audits

• When remediating control gaps identified during readiness assessment

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Familiarity with AICPA Trust Services Criteria (CC1-CC9)
• Access to cloud provider APIs (AWS, Azure, or GCP) with read-only permissions
• Access to identity provider (Okta, Azure AD, Google Workspace)
• Access to version control system (GitHub, GitLab)
• Access to ticketing system (Jira, Linear, ServiceNow)
• Python 3.8+ with boto3, requests, pyyaml dependencies
• Appropriate authorization to collect compliance evidence

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: ) -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}