When SOC 2 audit is 6 months out and your enterprise pipeline depends on the report, walk every TSC control with infrastructure evidence ready. — Claude Skill

SOC 2 Compliance Expert

SOC 2 Type I and Type II compliance management covering all Trust Services Criteria (TSC), infrastructure security validation, evidence collection, and end-to-end audit preparation.

SOC 2 Overview

Type I vs Type II

Start with Type I to validate control design, then transition to Type II within 6 months.

Trust Services Criteria Summary

For detailed control requirements per category, see REFERENCE.md.

Readiness Assessment Workflow

The agent guides organizations through SOC 2 readiness from gap analysis through audit completion.

Workflow: Phase 1 -- Gap Analysis (Weeks 1-4)

1. Define scope -- determine which TSC categories to include (Security is mandatory), define system boundaries, identify subservice organizations (carve-out vs. inclusive), document principal service commitments.
2. Assess current state -- inventory existing policies and procedures, map current controls to TSC requirements, interview process owners and control operators.
3. Run automated gap analysis using scripts/soc2_readiness_checker.py.
4. Document gaps -- missing controls, controls lacking evidence, controls not operating effectively.
5. Prioritize gaps by risk level and remediation effort.
6. Validation checkpoint: Gap analysis covers all in-scope TSC categories; each gap has severity rating and remediation owner assigned.

Workflow: Phase 2 -- Remediation (Weeks 5-16)

1. Develop/update policies -- information security policy, supporting procedures per control domain, policy review and approval workflows.
2. Implement technical controls -- configure IdP with SSO/MFA enforcement, deploy endpoint security (MDM, EDR, disk encryption), implement SIEM logging and monitoring, configure backup and DR, harden cloud infrastructure.
3. Establish processes -- access review procedures, change management workflow, incident response procedures, vendor management program, security awareness training.
4. Set up evidence collection -- configure automated collection, establish repository structure, define refresh cadence per TSC category.
5. Validation checkpoint: All identified gaps remediated; technical controls verified via scripts/soc2_infrastructure_auditor.py; evidence collection producing artifacts.

Workflow: Phase 3 -- Pre-Audit (Weeks 17-20)

1. Conduct internal readiness assessment -- mock audit against all in-scope TSC, validate evidence completeness and quality, run infrastructure auditor for technical validation.
2. Remediate pre-audit findings -- address remaining gaps, strengthen evidence.
3. Select and engage CPA firm -- negotiate scope, timeline, fees; schedule kickoff; prepare system description draft.
4. Validation checkpoint: Mock audit passes with no critical gaps; system description reviewed; auditor engaged.

Workflow: Phase 4 -- Audit Execution

1. Type I audit (if applicable) -- auditor reviews control design; management provides assertions; address findings before Type II.
2. Type II observation period (3-12 months) -- controls operate consistently, evidence collected continuously, quarterly self-assessments, regular auditor check-ins.
3. Fieldwork (2-4 weeks) -- auditor selects samples, tests controls, interviews personnel; draft report review; final report issuance.
4. Validation checkpoint: Clean opinion received; any findings have management response and remediation plan.

Evidence Collection Framework

Evidence by TSC Category

Example: Evidence Collection Command

# Generate evidence checklist for all TSC categories
python scripts/evidence_collector.py --generate-checklist --categories all

# Track evidence status
python scripts/evidence_collector.py --status evidence-tracker.json

# Update specific evidence item
python scripts/evidence_collector.py --update evidence-tracker.json \
  --item CC6.1-MFA --status collected

# Generate readiness dashboard
python scripts/evidence_collector.py --dashboard evidence-tracker.json

# Export for auditor review
python scripts/evidence_collector.py --export evidence-tracker.json --format json

Automation Strategies

GRC Platforms: Vanta, Drata, Secureframe, Laika, AuditBoard -- automated evidence collection via API integrations, continuous control monitoring, auditor collaboration portals.

Infrastructure-as-Evidence: Cloud configuration snapshots (AWS Config, Azure Policy, GCP Org Policies), Terraform state as configuration evidence, Git history as change management evidence, CI/CD pipeline logs as deployment control evidence.

Infrastructure Security Validation

The agent validates infrastructure configurations against SOC 2 requirements.

Quick Reference: Infrastructure Checks

For detailed per-provider control mappings, see REFERENCE.md.

Example: Infrastructure Audit Command

# Full infrastructure audit
python scripts/soc2_infrastructure_auditor.py --config infra-config.json

# Audit specific domains only
python scripts/soc2_infrastructure_auditor.py --config infra-config.json \
  --domains dns tls cloud

# JSON output with severity ratings
python scripts/soc2_infrastructure_auditor.py --config infra-config.json --format json

# Generate sample configuration template
python scripts/soc2_infrastructure_auditor.py --generate-template

Audit Timeline

Typical Timeline (First SOC 2)

Annual Renewal

• Begin renewal planning 3 months before observation period ends
• Maintain continuous compliance between audit periods
• Address prior-year findings before new observation period
• Bridge letters available for gaps between reports

Incident Response Requirements

IRP Structure

1. Preparation -- IR team defined, communication channels established, runbooks for common incidents, legal/PR contacts on retainer.
2. Detection and Analysis -- monitoring/alerting coverage, severity classification (SEV1-SEV4), triage procedures, escalation matrix.
3. Containment, Eradication, Recovery -- isolate affected systems, preserve evidence, identify root cause, restore and validate.
4. Post-Incident -- blameless post-mortem within 5 business days, lessons learned, control improvements, notification assessment (MTTD, MTTR, MTTC tracking).

For severity level definitions and breach notification timelines, see REFERENCE.md.

Tools

SOC 2 Readiness Checker

# Full readiness assessment
python scripts/soc2_readiness_checker.py --config org-controls.json

# JSON output for programmatic use
python scripts/soc2_readiness_checker.py --config org-controls.json --format json

# Check specific TSC categories
python scripts/soc2_readiness_checker.py --config org-controls.json \
  --categories security availability

# Include cloud provider control mapping
python scripts/soc2_readiness_checker.py --config org-controls.json --cloud-mapping

Evidence Collector

# Generate checklist and track status
python scripts/evidence_collector.py --generate-checklist --categories all
python scripts/evidence_collector.py --status evidence-tracker.json
python scripts/evidence_collector.py --dashboard evidence-tracker.json

Infrastructure Auditor

# Validate infrastructure against SOC 2 requirements
python scripts/soc2_infrastructure_auditor.py --config infra-config.json
python scripts/soc2_infrastructure_auditor.py --config infra-config.json --format json

References

Troubleshooting

Success Criteria

• SOC 2 scope defined with all applicable TSC categories selected, system boundaries documented, and subservice organizations identified (carve-out vs inclusive)
• Gap analysis completed with every identified gap assigned a severity rating, remediation owner, and target completion date
• Readiness score of 80%+ across all in-scope TSC categories before engaging the CPA firm, trending to 95%+ before Type II fieldwork
• Evidence collection framework operational with centralized repository, defined refresh cadence per TSC category, and automated collection where possible
• Infrastructure audit passes with no critical or high-severity findings in DNS, TLS, cloud, endpoint, or access control domains
• Type II observation period of at least 6 months with continuous control operation, quarterly self-assessments, and no significant control failures
• Clean SOC 2 Type II opinion received with any findings addressed by management response and documented remediation plans

Scope & Limitations

In Scope:

• SOC 2 Type I and Type II readiness assessment against all TSC categories (CC1-CC9, A1, PI1, C1, P1)
• Infrastructure security validation (DNS, TLS, cloud, endpoint, network, container, CI/CD, secrets)
• Evidence collection framework generation and tracking
• Gap analysis with severity-rated findings and remediation guidance
• Audit timeline planning and CPA firm engagement preparation
• Incident response plan structure and requirements
• Continuous compliance program design

Out of Scope:

• CPA firm audit execution (the tools prepare for audit; the actual Type I/II report requires an independent CPA firm)
• SOC 1 (ICFR) assessment (SOC 1 covers financial reporting controls, not security/availability/privacy)
• SOC 3 report generation (SOC 3 is a public-facing summary derived from SOC 2; it requires a completed SOC 2 audit)
• Penetration testing execution (use infrastructure-compliance-auditor or engage a third-party pentest firm)
• GRC platform selection or implementation (the skill is compatible with Vanta, Drata, Secureframe, etc., but does not implement them)
• Legal advice on customer contractual requirements for SOC 2 reports
• Physical security assessments (the infrastructure auditor covers logical controls; physical data center audits require on-site assessment)

Integration Points

Tool Reference

soc2_readiness_checker.py

Evaluates organizational controls against SOC 2 Trust Services Criteria with per-category scoring.

evidence_collector.py

Generates evidence collection checklists and tracks evidence gathering status.

soc2_infrastructure_auditor.py

Audits infrastructure configurations against SOC 2 requirements with severity-rated findings.