Automate SOC 2 audit preparation including evidence gathering, control assessment, and compliance gap identification. Use when you need to prepare for SOC 2 audits, assess Trust Service Criteria...
Before using this skill, ensure:
Evaluate controls across five categories:
Security (Common Criteria) - Required for all SOC 2 audits:
Additional Criteria (Optional):
Security Controls Evidence:
Operational Evidence:
Policy and Procedure Evidence:
System Evidence:
For each control point:
Compare current state against SOC 2 requirements:
Organize evidence by Trust Service Criteria:
{baseDir}/soc2-audit/
├── CC1-control-environment/
│ ├── org-chart.pdf
│ ├── security-policy.md
│ └── training-records.xlsx
├── CC6-access-controls/
│ ├── iam-policies.json
│ ├── mfa-config.yaml
│ └── access-review-logs.csv
├── CC7-system-operations/
│ ├── monitoring-configs/
│ ├── backup-procedures.md
│ └── incident-logs/
└── readiness-report.md
Create comprehensive SOC 2 readiness assessment with:
The skill produces:
Primary Output: SOC 2 readiness report saved to {baseDir}/soc2-audit/readiness-report-YYYYMMDD.md
Report Structure:
# SOC 2 Readiness Assessment
Assessment Date: 2024-01-15
Organization: TechCorp Inc.
Audit Type: SOC 2 Type II (Security + Availability)
## Executive Summary
- Overall Readiness: 75% (Needs Improvement)
- Controls Implemented: 28/40 (70%)
- Critical Gaps: 3
- High Priority Items: 8
- Estimated Remediation Time: 8-12 weeks
## Readiness by Trust Service Category
### CC1: Control Environment (80%)
✅ Implemented (4):
- Organizational structure documented
- Security policy established
- Risk assessment framework in place
- Board oversight of security
⚠️ Gaps (1):
- Security role and responsibility matrix incomplete
### CC6: Logical and Physical Access Controls (60%)
✅ Implemented (5):
- Multi-factor authentication enabled
- Role-based access control (RBAC) implemented
- Password policy enforced
- Access review process established
- Visitor access controls in place
❌ Critical Gaps (2):
- No automated user deprovisioning
- Privileged access not logged/monitored
⚠️ High Priority (3):
- Access logs retention < 1 year
- No formal access request workflow
- Physical security cameras not monitored 24/7
### CC7: System Operations (70%)
[Similar breakdown...]
## Critical Gaps Requiring Immediate Action
### 1. Automated User Deprovisioning (CC6.2)
**Current State**: Manual offboarding process
**Risk**: Terminated employees retain system access
**Evidence**: {baseDir}/hr/offboarding-checklist.pdf
**Remediation**:
- Implement automated deprovisioning tied to HR system
- Set up alerts for access not removed within 24 hours
- Estimated effort: 2-3 weeks
**Priority**: CRITICAL
### 2. Privileged Access Monitoring (CC6.7)
**Current State**: No logging of admin actions
**Risk**: Insider threats undetected
**Remediation**:
- Enable audit logging for all admin accounts
- Set up SIEM alerts for privileged actions
- Implement session recording for production access
**Priority**: CRITICAL
### 3. Disaster Recovery Testing (CC7.4)
**Current State**: DR plan exists but never tested
**Risk**: Recovery time objectives may not be achievable
**Remediation**:
- Schedule quarterly DR tests
- Document test results
- Update plan based on test findings
**Priority**: CRITICAL
## Evidence Collection Status
| Control | Evidence Type | Status | Location |
|---------|--------------|--------|----------|
| CC1.1 | Org Chart | ✅ Complete | {baseDir}/soc2-audit/CC1/ |
| CC6.1 | MFA Config | ✅ Complete | {baseDir}/soc2-audit/CC6/ |
| CC6.2 | Offboarding Logs | ❌ Missing | N/A |
| CC7.1 | Monitoring Dashboards | ⚠️ Partial | Need 90-day history |
## Remediation Roadmap
**Weeks 1-2 (Critical Fixes)**:
- Implement automated deprovisioning
- Enable privileged access monitoring
- Begin DR test planning
**Weeks 3-6 (High Priority)**:
- Extend log retention to 1 year
- Implement access request workflow
- Complete initial DR test
**Weeks 7-12 (Medium Priority)**:
- Enhance physical security monitoring
- Improve change management documentation
- Complete second DR test cycle
## Auditor Preparation
**Key Interview Topics**:
- Control environment and tone from the top
- Incident response capabilities
- Change management process
- Access control procedures
- Monitoring and alerting effectiveness
**Suggested Interviewees**:
- CTO/CISO (control environment)
- Security Engineer (technical controls)
- HR Manager (employee lifecycle)
- Operations Lead (monitoring, DR)
## Next Steps
1. Review and approve remediation roadmap
2. Assign owners to each gap remediation
3. Begin evidence collection for completed controls
4. Schedule monthly progress reviews
5. Engage SOC 2 auditor for scoping discussion
Secondary Outputs:
Common Issues and Resolutions:
Missing Evidence Files
Incomplete Access Logs
Undocumented Procedures
Cloud Provider Access Required
Multiple Environments Not Distinguished
SOC 2 Framework References:
Control Implementation Guides:
Compliance Automation Tools:
Template Documents:
Auditor Resources:
Evidence Examples:
