[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M73AS2YABTWN2EYK52ERA504":3,"skill-same:01M73AS2YABTWN2EYK52ERA504":74},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":24,"commitSha":25,"skillDirectory":26,"forksCount":14,"repositoryHtmlUrl":27,"repositoryHomepageUrl":6,"ownerHtmlUrl":28,"ownerBlogUrl":29,"ownerDescription":30,"updatedAt":31,"install":32,"resources":45},"01M73AS2YABTWN2EYK52ERA504","soc2-compliance",null,"Use when the user asks to prepare for SOC 2 audits, map Trust Service Criteria, build control matrices, collect audit evidence, perform gap analysis, or assess SOC 2 Type I vs Type II readiness.","kalash33\u002Fkstack","kalash33","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F90259149?v=4","01M7365X8Q0B73NYHA730SMZWN","Kalash Poddar","01M7365X9D0JK47C3Q0YCCK9Z2",0,"MIT","https:\u002F\u002Fgithub.com\u002Fkalash33\u002Fkstack\u002Fblob\u002Fmain\u002Fskills\u002Fnginity-ra-qm-team\u002Fsoc2-compliance\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: \"soc2-compliance\"\ndescription: \"Use when the user asks to prepare for SOC 2 audits, map Trust Service Criteria, build control matrices, collect audit evidence, perform gap analysis, or assess SOC 2 Type I vs Type II readiness.\"\n---\n\n# SOC 2 Compliance\n\nSOC 2 Type I and Type II compliance preparation for SaaS companies. Covers Trust Service Criteria mapping, control matrix generation, evidence collection, gap analysis, and audit readiness assessment.\n\n## Table of Contents\n\n- [Overview](#overview)\n- [Trust Service Criteria](#trust-service-criteria)\n- [Control Matrix Generation](#control-matrix-generation)\n- [Gap Analysis Workflow](#gap-analysis-workflow)\n- [Evidence Collection](#evidence-collection)\n- [Audit Readiness Checklist](#audit-readiness-checklist)\n- [Vendor Management](#vendor-management)\n- [Continuous Compliance](#continuous-compliance)\n- [Anti-Patterns](#anti-patterns)\n- [Tools](#tools)\n- [References](#references)\n- [Cross-References](#cross-references)\n\n---\n\n## Overview\n\n### What Is SOC 2?\n\nSOC 2 (System and Organization Controls 2) is an auditing framework developed by the AICPA that evaluates how a service organization manages customer data. It applies to any technology company that stores, processes, or transmits customer information — primarily SaaS, cloud infrastructure, and managed service providers.\n\n### Type I vs Type II\n\n| Aspect | Type I | Type II |\n|--------|--------|---------|\n| **Scope** | Design of controls at a point in time | Design AND operating effectiveness over a period |\n| **Duration** | Snapshot (single date) | Observation window (3-12 months, typically 6) |\n| **Evidence** | Control descriptions, policies | Control descriptions + operating evidence (logs, tickets, screenshots) |\n| **Cost** | $20K-$50K (audit fees) | $30K-$100K+ (audit fees) |\n| **Timeline** | 1-2 months (audit phase) | 6-12 months (observation + audit) |\n| **Best For** | First-time compliance, rapid market need | Mature organizations, enterprise customers |\n\n### Who Needs SOC 2?\n\n- **SaaS companies** selling to enterprise customers\n- **Cloud infrastructure providers** handling customer workloads\n- **Data processors** managing PII, PHI, or financial data\n- **Managed service providers** with access to client systems\n- **Any vendor** whose customers require third-party assurance\n\n### Typical Journey\n\n```\nGap Assessment → Remediation → Type I Audit → Observation Period → Type II Audit → Annual Renewal\n    (4-8 wk)      (8-16 wk)     (4-6 wk)       (6-12 mo)          (4-6 wk)       (ongoing)\n```\n\n---\n\n## Trust Service Criteria\n\nSOC 2 is organized around five Trust Service Criteria (TSC) categories. **Security** is required for every SOC 2 report; the remaining four are optional and selected based on business need.\n\n### Security (Common Criteria CC1-CC9) — Required\n\nThe foundation of every SOC 2 report. Maps to COSO 2013 principles.\n\n| Criteria | Domain | Key Controls |\n|----------|--------|-------------|\n| **CC1** | Control Environment | Integrity\u002Fethics, board oversight, org structure, competence, accountability |\n| **CC2** | Communication & Information | Internal\u002Fexternal communication, information quality |\n| **CC3** | Risk Assessment | Risk identification, fraud risk, change impact analysis |\n| **CC4** | Monitoring Activities | Ongoing monitoring, deficiency evaluation, corrective actions |\n| **CC5** | Control Activities | Policies\u002Fprocedures, technology controls, deployment through policies |\n| **CC6** | Logical & Physical Access | Access provisioning, authentication, encryption, physical restrictions |\n| **CC7** | System Operations | Vulnerability management, anomaly detection, incident response |\n| **CC8** | Change Management | Change authorization, testing, approval, emergency changes |\n| **CC9** | Risk Mitigation | Vendor\u002Fbusiness partner risk management |\n\n### Availability (A1) — Optional\n\n| Criteria | Focus | Key Controls |\n|----------|-------|-------------|\n| **A1.1** | Capacity management | Infrastructure scaling, resource monitoring, capacity planning |\n| **A1.2** | Recovery operations | Backup procedures, disaster recovery, BCP testing |\n| **A1.3** | Recovery testing | DR drills, failover testing, RTO\u002FRPO validation |\n\n**Select when:** Customers depend on your uptime; you have SLAs; downtime causes direct business impact.\n\n### Confidentiality (C1) — Optional\n\n| Criteria | Focus | Key Controls |\n|----------|-------|-------------|\n| **C1.1** | Identification | Data classification policy, confidential data inventory |\n| **C1.2** | Protection | Encryption at rest and in transit, DLP, access restrictions |\n| **C1.3** | Disposal | Secure deletion procedures, media sanitization, retention enforcement |\n\n**Select when:** You handle trade secrets, proprietary data, or contractually confidential information.\n\n### Processing Integrity (PI1) — Optional\n\n| Criteria | Focus | Key Controls |\n|----------|-------|-------------|\n| **PI1.1** | Accuracy | Input validation, processing checks, output verification |\n| **PI1.2** | Completeness | Transaction monitoring, reconciliation, error handling |\n| **PI1.3** | Timeliness | SLA monitoring, processing delay alerts, batch job monitoring |\n| **PI1.4** | Authorization | Processing authorization controls, segregation of duties |\n\n**Select when:** Data accuracy is critical (financial processing, healthcare records, analytics platforms).\n\n### Privacy (P1-P8) — Optional\n\n| Criteria | Focus | Key Controls |\n|----------|-------|-------------|\n| **P1** | Notice | Privacy policy, data collection notice, purpose limitation |\n| **P2** | Choice & Consent | Opt-in\u002Fopt-out, consent management, preference tracking |\n| **P3** | Collection | Minimal collection, lawful basis, purpose specification |\n| **P4** | Use, Retention, Disposal | Purpose limitation, retention schedules, secure disposal |\n| **P5** | Access | Data subject access requests, correction rights |\n| **P6** | Disclosure & Notification | Third-party sharing, breach notification |\n| **P7** | Quality | Data accuracy verification, correction mechanisms |\n| **P8** | Monitoring & Enforcement | Privacy program monitoring, complaint handling |\n\n**Select when:** You process PII and customers expect privacy assurance (complements GDPR compliance).\n\n---\n\n## Control Matrix Generation\n\nA control matrix maps each TSC criterion to specific controls, owners, evidence, and testing procedures.\n\n### Matrix Structure\n\n| Field | Description |\n|-------|-------------|\n| **Control ID** | Unique identifier (e.g., SEC-001, AVL-003) |\n| **TSC Mapping** | Which criteria the control addresses (e.g., CC6.1, A1.2) |\n| **Control Description** | What the control does |\n| **Control Type** | Preventive, Detective, or Corrective |\n| **Owner** | Responsible person\u002Fteam |\n| **Frequency** | Continuous, Daily, Weekly, Monthly, Quarterly, Annual |\n| **Evidence Type** | Screenshot, Log, Policy, Config, Ticket |\n| **Testing Procedure** | How the auditor verifies the control |\n\n### Control Naming Convention\n\n```\n{CATEGORY}-{NUMBER}\nSEC-001 through SEC-NNN  → Security\nAVL-001 through AVL-NNN  → Availability\nCON-001 through CON-NNN  → Confidentiality\nPRI-001 through PRI-NNN  → Processing Integrity\nPRV-001 through PRV-NNN  → Privacy\n```\n\n### Workflow\n\n1. Select applicable TSC categories based on business needs\n2. Run `control_matrix_builder.py` to generate the baseline matrix\n3. Customize controls to match your actual environment\n4. Assign owners and evidence requirements\n5. Validate coverage — every selected TSC criterion must have at least one control\n\n---\n\n## Gap Analysis Workflow\n\n### Phase 1: Current State Assessment\n\n1. **Document existing controls** — inventory all security policies, procedures, and technical controls\n2. **Map to TSC** — align existing controls to Trust Service Criteria\n3. **Collect evidence samples** — gather proof that controls exist and operate\n4. **Interview control owners** — verify understanding and execution\n\n### Phase 2: Gap Identification\n\nRun `gap_analyzer.py` against your current controls to identify:\n\n- **Missing controls** — TSC criteria with no corresponding control\n- **Partially implemented** — Control exists but lacks evidence or consistency\n- **Design gaps** — Control designed but does not adequately address the criteria\n- **Operating gaps** (Type II only) — Control designed correctly but not operating effectively\n\n### Phase 3: Remediation Planning\n\nFor each gap, define:\n\n| Field | Description |\n|-------|-------------|\n| Gap ID | Reference identifier |\n| TSC Criteria | Affected criteria |\n| Gap Description | What is missing or insufficient |\n| Remediation Action | Specific steps to close the gap |\n| Owner | Person responsible for remediation |\n| Priority | Critical \u002F High \u002F Medium \u002F Low |\n| Target Date | Completion deadline |\n| Dependencies | Other gaps or projects that must complete first |\n\n### Phase 4: Timeline Planning\n\n| Priority | Target Remediation |\n|----------|--------------------|\n| Critical | 2-4 weeks |\n| High | 4-8 weeks |\n| Medium | 8-12 weeks |\n| Low | 12-16 weeks |\n\n---\n\n## Evidence Collection\n\n### Evidence Types by Control Category\n\n| Control Area | Primary Evidence | Secondary Evidence |\n|--------------|-----------------|-------------------|\n| Access Management | User access reviews, provisioning tickets | Role matrix, access logs |\n| Change Management | Change tickets, approval records | Deployment logs, test results |\n| Incident Response | Incident tickets, postmortems | Runbooks, escalation records |\n| Vulnerability Management | Scan reports, patch records | Remediation timelines |\n| Encryption | Configuration screenshots, certificate inventory | Key rotation logs |\n| Backup & Recovery | Backup logs, DR test results | Recovery time measurements |\n| Monitoring | Alert configurations, dashboard screenshots | On-call schedules, escalation records |\n| Policy Management | Signed policies, version history | Training completion records |\n| Vendor Management | Vendor assessments, SOC 2 reports | Contract reviews, risk registers |\n\n### Automation Opportunities\n\n| Area | Automation Approach |\n|------|-------------------|\n| Access reviews | Integrate IAM with ticketing (automatic quarterly review triggers) |\n| Configuration evidence | Infrastructure-as-code snapshots, compliance-as-code tools |\n| Vulnerability scans | Scheduled scanning with auto-generated reports |\n| Change management | Git-based audit trail (commits, PRs, approvals) |\n| Uptime monitoring | Automated SLA dashboards with historical data |\n| Backup verification | Automated restore tests with success\u002Ffailure logging |\n\n### Continuous Monitoring\n\nMove from point-in-time evidence collection to continuous compliance:\n\n1. **Automated evidence gathering** — scripts that pull evidence on schedule\n2. **Control dashboards** — real-time visibility into control status\n3. **Alert-based monitoring** — notify when a control drifts out of compliance\n4. **Evidence repository** — centralized, timestamped evidence storage\n\n---\n\n## Audit Readiness Checklist\n\n### Pre-Audit Preparation (4-6 Weeks Before)\n\n- [ ] All controls documented with descriptions, owners, and frequencies\n- [ ] Evidence collected for the entire observation period (Type II)\n- [ ] Control matrix reviewed and gaps remediated\n- [ ] Policies signed and distributed within the last 12 months\n- [ ] Access reviews completed within the required frequency\n- [ ] Vulnerability scans current (no critical\u002Fhigh unpatched > SLA)\n- [ ] Incident response plan tested within the last 12 months\n- [ ] Vendor risk assessments current for all subservice organizations\n- [ ] DR\u002FBCP tested and documented within the last 12 months\n- [ ] Employee security training completed for all staff\n\n### Readiness Scoring\n\n| Score | Rating | Meaning |\n|-------|--------|---------|\n| 90-100% | Audit Ready | Proceed with confidence |\n| 75-89% | Minor Gaps | Address before scheduling audit |\n| 50-74% | Significant Gaps | Remediation required |\n| \u003C 50% | Not Ready | Major program build-out needed |\n\n### Common Audit Findings\n\n| Finding | Root Cause | Prevention |\n|---------|-----------|-----------|\n| Incomplete access reviews | Manual process, no reminders | Automate quarterly review triggers |\n| Missing change approvals | Emergency changes bypass process | Define emergency change procedure with post-hoc approval |\n| Stale vulnerability scans | Scanner misconfigured | Automated weekly scans with alerting |\n| Policy not acknowledged | No tracking mechanism | Annual e-signature workflow |\n| Missing vendor assessments | No vendor inventory | Maintain vendor register with review schedule |\n\n---\n\n## Vendor Management\n\n### Third-Party Risk Assessment\n\nEvery vendor that accesses, stores, or processes customer data must be assessed:\n\n1. **Vendor inventory** — maintain a register of all service providers\n2. **Risk classification** — categorize vendors by data access level\n3. **Due diligence** — collect SOC 2 reports, security questionnaires, certifications\n4. **Contractual protections** — ensure DPAs, security requirements, breach notification clauses\n5. **Ongoing monitoring** — annual reassessment, continuous news monitoring\n\n### Vendor Risk Tiers\n\n| Tier | Data Access | Assessment Frequency | Requirements |\n|------|-------------|---------------------|-------------|\n| Critical | Processes\u002Fstores customer data | Annual + continuous monitoring | SOC 2 Type II, penetration test, security review |\n| High | Accesses customer environment | Annual | SOC 2 Type II or equivalent, questionnaire |\n| Medium | Indirect access, support tools | Annual questionnaire | Security certifications, questionnaire |\n| Low | No data access | Biennial questionnaire | Basic security questionnaire |\n\n### Subservice Organizations\n\nWhen your SOC 2 report relies on controls at a subservice organization (e.g., AWS, GCP, Azure):\n\n- **Inclusive method** — your report covers the subservice org's controls (requires their cooperation)\n- **Carve-out method** — your report excludes their controls but references their SOC 2 report\n- Most companies use **carve-out** and include complementary user entity controls (CUECs)\n\n---\n\n## Continuous Compliance\n\n### From Point-in-Time to Continuous\n\n| Aspect | Point-in-Time | Continuous |\n|--------|---------------|-----------|\n| Evidence collection | Manual, before audit | Automated, ongoing |\n| Control monitoring | Periodic review | Real-time dashboards |\n| Drift detection | Found during audit | Alert-based, immediate |\n| Remediation | Reactive | Proactive |\n| Audit preparation | 4-8 week scramble | Always ready |\n\n### Implementation Steps\n\n1. **Automate evidence gathering** — cron jobs, API integrations, IaC snapshots\n2. **Build control dashboards** — aggregate control status into a single view\n3. **Configure drift alerts** — notify when controls fall out of compliance\n4. **Establish review cadence** — weekly control owner check-ins, monthly steering\n5. **Maintain evidence repository** — centralized, timestamped, auditor-accessible\n\n### Annual Re-Assessment Cycle\n\n| Quarter | Activities |\n|---------|-----------|\n| Q1 | Annual risk assessment, policy refresh, vendor reassessment launch |\n| Q2 | Internal control testing, remediation of findings |\n| Q3 | Pre-audit readiness review, evidence completeness check |\n| Q4 | External audit, management assertion, report distribution |\n\n---\n\n## Anti-Patterns\n\n| Anti-Pattern | Why It Fails | Better Approach |\n|--------------|-------------|----------------|\n| Point-in-time compliance | Controls degrade between audits; gaps found during audit | Implement continuous monitoring and automated evidence |\n| Manual evidence collection | Time-consuming, inconsistent, error-prone | Automate with scripts, IaC, and compliance platforms |\n| Missing vendor assessments | Auditors flag incomplete vendor due diligence | Maintain vendor register with risk-tiered assessment schedule |\n| Copy-paste policies | Generic policies don't match actual operations | Tailor policies to your actual environment and technology stack |\n| Security theater | Controls exist on paper but aren't followed | Verify operating effectiveness; build controls into workflows |\n| Skipping Type I | Jumping to Type II without foundational readiness | Start with Type I to validate control design before observation |\n| Over-scoping TSC | Including all 5 categories when only Security is needed | Select categories based on actual customer\u002Fbusiness requirements |\n| Treating audit as a project | Compliance degrades after the report is issued | Build compliance into daily operations and engineering culture |\n\n---\n\n## Tools\n\n### Control Matrix Builder\n\nGenerates a SOC 2 control matrix from selected TSC categories.\n\n```bash\n# Generate full security matrix in markdown\npython scripts\u002Fcontrol_matrix_builder.py --categories security --format md\n\n# Generate matrix for multiple categories as JSON\npython scripts\u002Fcontrol_matrix_builder.py --categories security,availability,confidentiality --format json\n\n# All categories, CSV output\npython scripts\u002Fcontrol_matrix_builder.py --categories security,availability,confidentiality,processing-integrity,privacy --format csv\n```\n\n### Evidence Tracker\n\nTracks evidence collection status per control.\n\n```bash\n# Check evidence status from a control matrix\npython scripts\u002Fevidence_tracker.py --matrix controls.json --status\n\n# JSON output for integration\npython scripts\u002Fevidence_tracker.py --matrix controls.json --status --json\n```\n\n### Gap Analyzer\n\nAnalyzes current controls against SOC 2 requirements and identifies gaps.\n\n```bash\n# Type I gap analysis\npython scripts\u002Fgap_analyzer.py --controls current_controls.json --type type1\n\n# Type II gap analysis (includes operating effectiveness)\npython scripts\u002Fgap_analyzer.py --controls current_controls.json --type type2 --json\n```\n\n---\n\n## References\n\n- [Trust Service Criteria Reference](references\u002Ftrust_service_criteria.md) — All 5 TSC categories with sub-criteria, control objectives, and evidence examples\n- [Evidence Collection Guide](references\u002Fevidence_collection_guide.md) — Evidence types per control, automation tools, documentation requirements\n- [Type I vs Type II Comparison](references\u002Ftype1_vs_type2.md) — Detailed comparison, timeline, cost analysis, and upgrade path\n\n---\n\n## Cross-References\n\n- **[gdpr-dsgvo-expert](..\u002Fgdpr-dsgvo-expert\u002FSKILL.md)** — SOC 2 Privacy criteria overlaps significantly with GDPR requirements; use together when processing EU personal data\n- **[information-security-manager-iso27001](..\u002Finformation-security-manager-iso27001\u002FSKILL.md)** — ISO 27001 Annex A controls map closely to SOC 2 Security criteria; organizations pursuing both can share evidence\n- **[isms-audit-expert](..\u002Fisms-audit-expert\u002FSKILL.md)** — Audit methodology and finding management patterns transfer directly to SOC 2 audit preparation\n","# SOC 2 Compliance\n\nSOC 2 Type I and Type II compliance preparation for SaaS companies. Covers Trust Service Criteria mapping, control matrix generation, evidence collection, gap analysis, and audit readiness assessment.\n\n## Table of Contents\n\n- [Overview](#overview)\n- [Trust Service Criteria](#trust-service-criteria)\n- [Control Matrix Generation](#control-matrix-generation)\n- [Gap Analysis Workflow](#gap-analysis-workflow)\n- [Evidence Collection](#evidence-collection)\n- [Audit Readiness Checklist](#audit-readiness-checklist)\n- [Vendor Management](#vendor-management)\n- [Continuous Compliance](#continuous-compliance)\n- [Anti-Patterns](#anti-patterns)\n- [Tools](#tools)\n- [References](#references)\n- [Cross-References](#cross-references)\n\n---\n\n## Overview\n\n### What Is SOC 2?\n\nSOC 2 (System and Organization Controls 2) is an auditing framework developed by the AICPA that evaluates how a service organization manages customer data. It applies to any technology company that stores, processes, or transmits customer information — primarily SaaS, cloud infrastructure, and managed service providers.\n\n### Type I vs Type II\n\n| Aspect | Type I | Type II |\n|--------|--------|---------|\n| **Scope** | Design of controls at a point in time | Design AND operating effectiveness over a period |\n| **Duration** | Snapshot (single date) | Observation window (3-12 months, typically 6) |\n| **Evidence** | Control descriptions, policies | Control descriptions + operating evidence (logs, tickets, screenshots) |\n| **Cost** | $20K-$50K (audit fees) | $30K-$100K+ (audit fees) |\n| **Timeline** | 1-2 months (audit phase) | 6-12 months (observation + audit) |\n| **Best For** | First-time compliance, rapid market need | Mature organizations, enterprise customers |\n\n### Who Needs SOC 2?\n\n- **SaaS companies** selling to enterprise customers\n- **Cloud infrastructure providers** handling customer workloads\n- **Data processors** managing PII, PHI, or financial data\n- **Managed service providers** with access to client systems\n- **Any vendor** whose customers require third-party assurance\n\n### Typical Journey\n\n```\nGap Assessment → Remediation → Type I Audit → Observation Period → Type II Audit → Annual Renewal\n    (4-8 wk)      (8-16 wk)     (4-6 wk)       (6-12 mo)          (4-6 wk)       (ongoing)\n```\n\n---\n\n## Trust Service Criteria\n\nSOC 2 is organized around five Trust Service Criteria (TSC) categories. **Security** is required for every SOC 2 report; the remaining four are optional and selected based on business need.\n\n### Security (Common Criteria CC1-CC9) — Required\n\nThe foundation of every SOC 2 report. Maps to COSO 2013 principles.\n\n| Criteria | Domain | Key Controls |\n|----------|--------|-------------|\n| **CC1** | Control Environment | Integrity\u002Fethics, board oversight, org structure, competence, accountability |\n| **CC2** | Communication & Information | Internal\u002Fexternal communication, information quality |\n| **CC3** | Risk Assessment | Risk identification, fraud risk, change impact analysis |\n| **CC4** | Monitoring Activities | Ongoing monitoring, deficiency evaluation, corrective actions |\n| **CC5** | Control Activities | Policies\u002Fprocedures, technology controls, deployment through policies |\n| **CC6** | Logical & Physical Access | Access provisioning, authentication, encryption, physical restrictions |\n| **CC7** | System Operations | Vulnerability management, anomaly detection, incident response |\n| **CC8** | Change Management | Change authorization, testing, approval, emergency changes |\n| **CC9** | Risk Mitigation | Vendor\u002Fbusiness partner risk management |\n\n### Availability (A1) — Optional\n\n| Criteria | Focus | Key Controls |\n|----------|-------|-------------|\n| **A1.1** | Capacity management | Infrastructure scaling, resource monitoring, capacity planning |\n| **A1.2** | Recovery operations | Backup procedures, disaster recovery, BCP testing |\n| **A1.3** | Recovery testing | DR drills, failover testing, RTO\u002FRPO validation |\n\n**Select when:** Customers depend on your uptime; you have SLAs; downtime causes direct business impact.\n\n### Confidentiality (C1) — Optional\n\n| Criteria | Focus | Key Controls |\n|----------|-------|-------------|\n| **C1.1** | Identification | Data classification policy, confidential data inventory |\n| **C1.2** | Protection | Encryption at rest and in transit, DLP, access restrictions |\n| **C1.3** | Disposal | Secure deletion procedures, media sanitization, retention enforcement |\n\n**Select when:** You handle trade secrets, proprietary data, or contractually confidential information.\n\n### Processing Integrity (PI1) — Optional\n\n| Criteria | Focus | Key Controls |\n|----------|-------|-------------|\n| **PI1.1** | Accuracy | Input validation, processing checks, output verification |\n| **PI1.2** | Completeness | Transaction monitoring, reconciliation, error handling |\n| **PI1.3** | Timeliness | SLA monitoring, processing delay alerts, batch job monitoring |\n| **PI1.4** | Authorization | Processing authorization controls, segregation of duties |\n\n**Select when:** Data accuracy is critical (financial processing, healthcare records, analytics platforms).\n\n### Privacy (P1-P8) — Optional\n\n| Criteria | Focus | Key Controls |\n|----------|-------|-------------|\n| **P1** | Notice | Privacy policy, data collection notice, purpose limitation |\n| **P2** | Choice & Consent | Opt-in\u002Fopt-out, consent management, preference tracking |\n| **P3** | Collection | Minimal collection, lawful basis, purpose specification |\n| **P4** | Use, Retention, Disposal | Purpose limitation, retention schedules, secure disposal |\n| **P5** | Access | Data subject access requests, correction rights |\n| **P6** | Disclosure & Notification | Third-party sharing, breach notification |\n| **P7** | Quality | Data accuracy verification, correction mechanisms |\n| **P8** | Monitoring & Enforcement | Privacy program monitoring, complaint handling |\n\n**Select when:** You process PII and customers expect privacy assurance (complements GDPR compliance).\n\n---\n\n## Control Matrix Generation\n\nA control matrix maps each TSC criterion to specific controls, owners, evidence, and testing procedures.\n\n### Matrix Structure\n\n| Field | Description |\n|-------|-------------|\n| **Control ID** | Unique identifier (e.g., SEC-001, AVL-003) |\n| **TSC Mapping** | Which criteria the control addresses (e.g., CC6.1, A1.2) |\n| **Control Description** | What the control does |\n| **Control Type** | Preventive, Detective, or Corrective |\n| **Owner** | Responsible person\u002Fteam |\n| **Frequency** | Continuous, Daily, Weekly, Monthly, Quarterly, Annual |\n| **Evidence Type** | Screenshot, Log, Policy, Config, Ticket |\n| **Testing Procedure** | How the auditor verifies the control |\n\n### Control Naming Convention\n\n```\n{CATEGORY}-{NUMBER}\nSEC-001 through SEC-NNN  → Security\nAVL-001 through AVL-NNN  → Availability\nCON-001 through CON-NNN  → Confidentiality\nPRI-001 through PRI-NNN  → Processing Integrity\nPRV-001 through PRV-NNN  → Privacy\n```\n\n### Workflow\n\n1. Select applicable TSC categories based on business needs\n2. Run `control_matrix_builder.py` to generate the baseline matrix\n3. Customize controls to match your actual environment\n4. Assign owners and evidence requirements\n5. Validate coverage — every selected TSC criterion must have at least one control\n\n---\n\n## Gap Analysis Workflow\n\n### Phase 1: Current State Assessment\n\n1. **Document existing controls** — inventory all security policies, procedures, and technical controls\n2. **Map to TSC** — align existing controls to Trust Service Criteria\n3. **Collect evidence samples** — gather proof that controls exist and operate\n4. **Interview control owners** — verify understanding and execution\n\n### Phase 2: Gap Identification\n\nRun `gap_analyzer.py` against your current controls to identify:\n\n- **Missing controls** — TSC criteria with no corresponding control\n- **Partially implemented** — Control exists but lacks evidence or consistency\n- **Design gaps** — Control designed but does not adequately address the criteria\n- **Operating gaps** (Type II only) — Control designed correctly but not operating effectively\n\n### Phase 3: Remediation Planning\n\nFor each gap, define:\n\n| Field | Description |\n|-------|-------------|\n| Gap ID | Reference identifier |\n| TSC Criteria | Affected criteria |\n| Gap Description | What is missing or insufficient |\n| Remediation Action | Specific steps to close the gap |\n| Owner | Person responsible for remediation |\n| Priority | Critical \u002F High \u002F Medium \u002F Low |\n| Target Date | Completion deadline |\n| Dependencies | Other gaps or projects that must complete first |\n\n### Phase 4: Timeline Planning\n\n| Priority | Target Remediation |\n|----------|--------------------|\n| Critical | 2-4 weeks |\n| High | 4-8 weeks |\n| Medium | 8-12 weeks |\n| Low | 12-16 weeks |\n\n---\n\n## Evidence Collection\n\n### Evidence Types by Control Category\n\n| Control Area | Primary Evidence | Secondary Evidence |\n|--------------|-----------------|-------------------|\n| Access Management | User access reviews, provisioning tickets | Role matrix, access logs |\n| Change Management | Change tickets, approval records | Deployment logs, test results |\n| Incident Response | Incident tickets, postmortems | Runbooks, escalation records |\n| Vulnerability Management | Scan reports, patch records | Remediation timelines |\n| Encryption | Configuration screenshots, certificate inventory | Key rotation logs |\n| Backup & Recovery | Backup logs, DR test results | Recovery time measurements |\n| Monitoring | Alert configurations, dashboard screenshots | On-call schedules, escalation records |\n| Policy Management | Signed policies, version history | Training completion records |\n| Vendor Management | Vendor assessments, SOC 2 reports | Contract reviews, risk registers |\n\n### Automation Opportunities\n\n| Area | Automation Approach |\n|------|-------------------|\n| Access reviews | Integrate IAM with ticketing (automatic quarterly review triggers) |\n| Configuration evidence | Infrastructure-as-code snapshots, compliance-as-code tools |\n| Vulnerability scans | Scheduled scanning with auto-generated reports |\n| Change management | Git-based audit trail (commits, PRs, approvals) |\n| Uptime monitoring | Automated SLA dashboards with historical data |\n| Backup verification | Automated restore tests with success\u002Ffailure logging |\n\n### Continuous Monitoring\n\nMove from point-in-time evidence collection to continuous compliance:\n\n1. **Automated evidence gathering** — scripts that pull evidence on schedule\n2. **Control dashboards** — real-time visibility into control status\n3. **Alert-based monitoring** — notify when a control drifts out of compliance\n4. **Evidence repository** — centralized, timestamped evidence storage\n\n---\n\n## Audit Readiness Checklist\n\n### Pre-Audit Preparation (4-6 Weeks Before)\n\n- [ ] All controls documented with descriptions, owners, and frequencies\n- [ ] Evidence collected for the entire observation period (Type II)\n- [ ] Control matrix reviewed and gaps remediated\n- [ ] Policies signed and distributed within the last 12 months\n- [ ] Access reviews completed within the required frequency\n- [ ] Vulnerability scans current (no critical\u002Fhigh unpatched > SLA)\n- [ ] Incident response plan tested within the last 12 months\n- [ ] Vendor risk assessments current for all subservice organizations\n- [ ] DR\u002FBCP tested and documented within the last 12 months\n- [ ] Employee security training completed for all staff\n\n### Readiness Scoring\n\n| Score | Rating | Meaning |\n|-------|--------|---------|\n| 90-100% | Audit Ready | Proceed with confidence |\n| 75-89% | Minor Gaps | Address before scheduling audit |\n| 50-74% | Significant Gaps | Remediation required |\n| \u003C 50% | Not Ready | Major program build-out needed |\n\n### Common Audit Findings\n\n| Finding | Root Cause | Prevention |\n|---------|-----------|-----------|\n| Incomplete access reviews | Manual process, no reminders | Automate quarterly review triggers |\n| Missing change approvals | Emergency changes bypass process | Define emergency change procedure with post-hoc approval |\n| Stale vulnerability scans | Scanner misconfigured | Automated weekly scans with alerting |\n| Policy not acknowledged | No tracking mechanism | Annual e-signature workflow |\n| Missing vendor assessments | No vendor inventory | Maintain vendor register with review schedule |\n\n---\n\n## Vendor Management\n\n### Third-Party Risk Assessment\n\nEvery vendor that accesses, stores, or processes customer data must be assessed:\n\n1. **Vendor inventory** — maintain a register of all service providers\n2. **Risk classification** — categorize vendors by data access level\n3. **Due diligence** — collect SOC 2 reports, security questionnaires, certifications\n4. **Contractual protections** — ensure DPAs, security requirements, breach notification clauses\n5. **Ongoing monitoring** — annual reassessment, continuous news monitoring\n\n### Vendor Risk Tiers\n\n| Tier | Data Access | Assessment Frequency | Requirements |\n|------|-------------|---------------------|-------------|\n| Critical | Processes\u002Fstores customer data | Annual + continuous monitoring | SOC 2 Type II, penetration test, security review |\n| High | Accesses customer environment | Annual | SOC 2 Type II or equivalent, questionnaire |\n| Medium | Indirect access, support tools | Annual questionnaire | Security certifications, questionnaire |\n| Low | No data access | Biennial questionnaire | Basic security questionnaire |\n\n### Subservice Organizations\n\nWhen your SOC 2 report relies on controls at a subservice organization (e.g., AWS, GCP, Azure):\n\n- **Inclusive method** — your report covers the subservice org's controls (requires their cooperation)\n- **Carve-out method** — your report excludes their controls but references their SOC 2 report\n- Most companies use **carve-out** and include complementary user entity controls (CUECs)\n\n---\n\n## Continuous Compliance\n\n### From Point-in-Time to Continuous\n\n| Aspect | Point-in-Time | Continuous |\n|--------|---------------|-----------|\n| Evidence collection | Manual, before audit | Automated, ongoing |\n| Control monitoring | Periodic review | Real-time dashboards |\n| Drift detection | Found during audit | Alert-based, immediate |\n| Remediation | Reactive | Proactive |\n| Audit preparation | 4-8 week scramble | Always ready |\n\n### Implementation Steps\n\n1. **Automate evidence gathering** — cron jobs, API integrations, IaC snapshots\n2. **Build control dashboards** — aggregate control status into a single view\n3. **Configure drift alerts** — notify when controls fall out of compliance\n4. **Establish review cadence** — weekly control owner check-ins, monthly steering\n5. **Maintain evidence repository** — centralized, timestamped, auditor-accessible\n\n### Annual Re-Assessment Cycle\n\n| Quarter | Activities |\n|---------|-----------|\n| Q1 | Annual risk assessment, policy refresh, vendor reassessment launch |\n| Q2 | Internal control testing, remediation of findings |\n| Q3 | Pre-audit readiness review, evidence completeness check |\n| Q4 | External audit, management assertion, report distribution |\n\n---\n\n## Anti-Patterns\n\n| Anti-Pattern | Why It Fails | Better Approach |\n|--------------|-------------|----------------|\n| Point-in-time compliance | Controls degrade between audits; gaps found during audit | Implement continuous monitoring and automated evidence |\n| Manual evidence collection | Time-consuming, inconsistent, error-prone | Automate with scripts, IaC, and compliance platforms |\n| Missing vendor assessments | Auditors flag incomplete vendor due diligence | Maintain vendor register with risk-tiered assessment schedule |\n| Copy-paste policies | Generic policies don't match actual operations | Tailor policies to your actual environment and technology stack |\n| Security theater | Controls exist on paper but aren't followed | Verify operating effectiveness; build controls into workflows |\n| Skipping Type I | Jumping to Type II without foundational readiness | Start with Type I to validate control design before observation |\n| Over-scoping TSC | Including all 5 categories when only Security is needed | Select categories based on actual customer\u002Fbusiness requirements |\n| Treating audit as a project | Compliance degrades after the report is issued | Build compliance into daily operations and engineering culture |\n\n---\n\n## Tools\n\n### Control Matrix Builder\n\nGenerates a SOC 2 control matrix from selected TSC categories.\n\n```bash\n# Generate full security matrix in markdown\npython scripts\u002Fcontrol_matrix_builder.py --categories security --format md\n\n# Generate matrix for multiple categories as JSON\npython scripts\u002Fcontrol_matrix_builder.py --categories security,availability,confidentiality --format json\n\n# All categories, CSV output\npython scripts\u002Fcontrol_matrix_builder.py --categories security,availability,confidentiality,processing-integrity,privacy --format csv\n```\n\n### Evidence Tracker\n\nTracks evidence collection status per control.\n\n```bash\n# Check evidence status from a control matrix\npython scripts\u002Fevidence_tracker.py --matrix controls.json --status\n\n# JSON output for integration\npython scripts\u002Fevidence_tracker.py --matrix controls.json --status --json\n```\n\n### Gap Analyzer\n\nAnalyzes current controls against SOC 2 requirements and identifies gaps.\n\n```bash\n# Type I gap analysis\npython scripts\u002Fgap_analyzer.py --controls current_controls.json --type type1\n\n# Type II gap analysis (includes operating effectiveness)\npython scripts\u002Fgap_analyzer.py --controls current_controls.json --type type2 --json\n```\n\n---\n\n## References\n\n- [Trust Service Criteria Reference](references\u002Ftrust_service_criteria.md) — All 5 TSC categories with sub-criteria, control objectives, and evidence examples\n- [Evidence Collection Guide](references\u002Fevidence_collection_guide.md) — Evidence types per control, automation tools, documentation requirements\n- [Type I vs Type II Comparison](references\u002Ftype1_vs_type2.md) — Detailed comparison, timeline, cost analysis, and upgrade path\n\n---\n\n## Cross-References\n\n- **[gdpr-dsgvo-expert](..\u002Fgdpr-dsgvo-expert\u002FSKILL.md)** — SOC 2 Privacy criteria overlaps significantly with GDPR requirements; use together when processing EU personal data\n- **[information-security-manager-iso27001](..\u002Finformation-security-manager-iso27001\u002FSKILL.md)** — ISO 27001 Annex A controls map closely to SOC 2 Security criteria; organizations pursuing both can share evidence\n- **[isms-audit-expert](..\u002Fisms-audit-expert\u002FSKILL.md)** — Audit methodology and finding management patterns transfer directly to SOC 2 audit preparation\n",{"name":5,"description":7},"main","b30820b3248f6676d5389f0ccabd4e5250c9c536","skills\u002Fnginity-ra-qm-team\u002Fsoc2-compliance","https:\u002F\u002Fgithub.com\u002Fkalash33\u002Fkstack","https:\u002F\u002Fgithub.com\u002Fkalash33","kalashpoddar.me","Tech-savvy Full Stack Developer 🚀 | Cybersecurity enthusiast 🔒 | Passionate about innovation and securing the digital world 🌐 | Let's code securely! 💻🔐","2026-05-20 04:11:22",{"source":8,"skillName":5,"commands":33,"prompt":43,"zipAvailable":44},[34,37,40],{"tool":35,"command":36},"npx","npx skills add kalash33\u002Fkstack --skill soc2-compliance",{"tool":38,"command":39},"bunx","bunx skills add kalash33\u002Fkstack --skill soc2-compliance",{"tool":41,"command":42},"pnpm","pnpm dlx skills add kalash33\u002Fkstack --skill soc2-compliance","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fkalash33\u002Fkstack\u002Fblob\u002Fmain\u002Fskills\u002Fnginity-ra-qm-team\u002Fsoc2-compliance\u002FSKILL.md",true,[46,52,56,60,66,70],{"path":47,"resourceType":48,"resourceTypeDesc":49,"sizeBytes":50,"sourceHtmlUrl":51},"references\u002Fevidence_collection_guide.md","REFERENCE","参考文档",11737,"https:\u002F\u002Fgithub.com\u002Fkalash33\u002Fkstack\u002Fblob\u002Fmain\u002Fskills\u002Fnginity-ra-qm-team\u002Fsoc2-compliance\u002Freferences\u002Fevidence_collection_guide.md",{"path":53,"resourceType":48,"resourceTypeDesc":49,"sizeBytes":54,"sourceHtmlUrl":55},"references\u002Ftrust_service_criteria.md",17764,"https:\u002F\u002Fgithub.com\u002Fkalash33\u002Fkstack\u002Fblob\u002Fmain\u002Fskills\u002Fnginity-ra-qm-team\u002Fsoc2-compliance\u002Freferences\u002Ftrust_service_criteria.md",{"path":57,"resourceType":48,"resourceTypeDesc":49,"sizeBytes":58,"sourceHtmlUrl":59},"references\u002Ftype1_vs_type2.md",10465,"https:\u002F\u002Fgithub.com\u002Fkalash33\u002Fkstack\u002Fblob\u002Fmain\u002Fskills\u002Fnginity-ra-qm-team\u002Fsoc2-compliance\u002Freferences\u002Ftype1_vs_type2.md",{"path":61,"resourceType":62,"resourceTypeDesc":63,"sizeBytes":64,"sourceHtmlUrl":65},"scripts\u002Fcontrol_matrix_builder.py","SCRIPT","脚本",27405,"https:\u002F\u002Fgithub.com\u002Fkalash33\u002Fkstack\u002Fblob\u002Fmain\u002Fskills\u002Fnginity-ra-qm-team\u002Fsoc2-compliance\u002Fscripts\u002Fcontrol_matrix_builder.py",{"path":67,"resourceType":62,"resourceTypeDesc":63,"sizeBytes":68,"sourceHtmlUrl":69},"scripts\u002Fevidence_tracker.py",7963,"https:\u002F\u002Fgithub.com\u002Fkalash33\u002Fkstack\u002Fblob\u002Fmain\u002Fskills\u002Fnginity-ra-qm-team\u002Fsoc2-compliance\u002Fscripts\u002Fevidence_tracker.py",{"path":71,"resourceType":62,"resourceTypeDesc":63,"sizeBytes":72,"sourceHtmlUrl":73},"scripts\u002Fgap_analyzer.py",15919,"https:\u002F\u002Fgithub.com\u002Fkalash33\u002Fkstack\u002Fblob\u002Fmain\u002Fskills\u002Fnginity-ra-qm-team\u002Fsoc2-compliance\u002Fscripts\u002Fgap_analyzer.py",[75,82,89,96,103,110],{"skillNo":76,"name":77,"nameZh":6,"description":78,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":79,"categories":80,"keywords":81,"publishedAt":19},"01M73CFERCR43JCAP606E41EFB","zustand-store-ts","Create Zustand stores with TypeScript, subscribeWithSelector middleware, and proper state\u002Faction separation. Use when building React state management, creating global stores, or implementing reacti...","https:\u002F\u002Fgithub.com\u002Fkalash33\u002Fkstack\u002Fblob\u002Fmain\u002Fskills\u002Fzustand-store-ts\u002FSKILL.md",[],[],{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":88,"publishedAt":19},"01M73CFCMFVTAQEMTZ5HR10X8V","zoom-automation","Automate Zoom meeting creation, management, recordings, webinars, and participant tracking via Rube MCP (Composio). Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002Fkalash33\u002Fkstack\u002Fblob\u002Fmain\u002Fskills\u002Fzoom-automation\u002FSKILL.md",[],[],{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":19},"01M73CFAA7EBWXJVXDQ1X555MB","zoho-crm-automation","Automate Zoho CRM tasks via Rube MCP (Composio): create\u002Fupdate records, search contacts, manage leads, and convert leads. Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002Fkalash33\u002Fkstack\u002Fblob\u002Fmain\u002Fskills\u002Fzoho-crm-automation\u002FSKILL.md",[],[],{"skillNo":97,"name":98,"nameZh":6,"description":99,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":100,"categories":101,"keywords":102,"publishedAt":19},"01M73CF80XCM9K81567MJ8QZFW","zod-validation-expert","Expert in Zod — TypeScript-first schema validation. Covers parsing, custom errors, refinements, type inference, and integration with React Hook Form, Next.js, and tRPC.","https:\u002F\u002Fgithub.com\u002Fkalash33\u002Fkstack\u002Fblob\u002Fmain\u002Fskills\u002Fzod-validation-expert\u002FSKILL.md",[],[],{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":109,"publishedAt":19},"01M73CF4YPMF3RA8ZJDXZSMD93","zeroize-audit","Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing C\u002FC++\u002FRust code handling secrets, keys, passwords, or other sensitive data.","https:\u002F\u002Fgithub.com\u002Fkalash33\u002Fkstack\u002Fblob\u002Fmain\u002Fskills\u002Fzeroize-audit\u002FSKILL.md",[],[],{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":116,"publishedAt":19},"01M73CF2S25EN3XNAMKY47XHPS","zendesk-automation","Automate Zendesk tasks via Rube MCP (Composio): tickets, users, organizations, replies. Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002Fkalash33\u002Fkstack\u002Fblob\u002Fmain\u002Fskills\u002Fzendesk-automation\u002FSKILL.md",[],[]]