SOC 2 Compliance Skill

How to Help Users — Task Router

Identify the user's need and follow the relevant section below:

Gap Analysis & Readiness Assessment

Step 1 — Scope

Before assessing, confirm:

1. Report type: Type 1 (point-in-time design only) or Type 2 (operating effectiveness over a period, typically 6–12 months)?
2. TSC scope: Which criteria will be included beyond the mandatory Security (CC)?
3. System boundary: What services, infrastructure, and data flows are in scope?
4. Timeline: When is the target audit date?

Step 2 — Self-Assessment Framework

For each in-scope criterion, assess:

• Design: Is a control designed and documented to meet this criterion?
• Implementation: Is the control actually in place and operating?
• Evidence: Can the organization prove it to an auditor?

Use this RAG status for each criterion:

• 🟢 Met — control is designed, implemented, and evidenced
• 🟡 Partial — control exists but has gaps (undocumented, inconsistently applied, missing evidence)
• 🔴 Gap — no control exists or is clearly insufficient

Step 3 — Common Gaps by Area

See references/controls.md for per-criterion gap patterns. The most frequently flagged gaps across all organizations:

1. Policies not documented or not reviewed annually (hits CC1, CC2, CC5)
2. No formal risk assessment process (CC3)
3. Access reviews not performed (CC6)
4. Incident response plan not tested (CC7)
5. Change management not consistently followed (CC8)
6. No vendor risk program (CC9)
7. Availability SLAs not monitored or evidenced (A1)
8. Data classification not defined (C1, P3)
9. Privacy notice incomplete or missing (P1)

Step 4 — Remediation Plan

For each 🔴 or 🟡 item, output a remediation plan entry:

Control Area: [TSC criterion, e.g., CC6.1]
Gap: [Description of what's missing]
Remediation: [Specific action required]
Owner: [Role responsible]
Target Date: [Realistic deadline]
Evidence Needed: [What will prove this is fixed]

Policy & Procedure Writing

Read references/policies.md for full templates and writing guidance.

Core Policy Set Required for SOC 2

Policy Writing Principles

1. Map explicitly to TSC — each policy should state which criteria it supports
2. Assign ownership — every policy needs a named owner/role
3. Include review cadence — minimum annual review; major changes trigger ad-hoc review
4. Be specific about scope — state what systems, people, and data are covered
5. Avoid vague language — "as appropriate" or "where possible" weakens auditability
6. Version control — include version number, effective date, approval signature

Control Documentation

Read references/controls.md for the full control matrix template and per-criterion examples.

Control Statement Format

Each control should be documented as:

Control ID:    [e.g., CC6.1-001]
TSC Criterion: [e.g., CC6.1 – Logical Access Controls]
Control Title: [Short descriptive name]
Control Type:  [Preventive / Detective / Corrective]
Control Owner: [Role]
Frequency:     [Continuous / Daily / Monthly / Annual / Event-driven]
Description:   [What the control does and how it works]
Evidence:      [What artifacts prove this control operates]
Test Procedure:[How an auditor would test this]

Control Types to Know

• Preventive — stops a problem before it occurs (e.g., MFA, firewall rules)
• Detective — identifies a problem after it occurs (e.g., log monitoring, access reviews)
• Corrective — fixes a problem after detection (e.g., patch management, incident remediation)

Auditors expect a mix. Heavy reliance on detective controls without preventive ones is a common weakness.

Audit Evidence Preparation

Read references/evidence.md for a full evidence catalog by criterion.

Evidence Principles

1. Contemporaneous — evidence must be created at the time the control operates, not reconstructed retroactively
2. Complete — covers the full audit period (for Type 2)
3. Attributable — shows who performed the action and when
4. Consistent — demonstrates the control is repeatable, not a one-time event

Evidence Organization

Organize evidence in folders mirroring criteria:

/audit-evidence/
  /CC1-control-environment/
  /CC2-communication/
  /CC3-risk-assessment/
  /CC4-monitoring/
  /CC5-control-activities/
  /CC6-access-controls/
  /CC7-system-operations/
  /CC8-change-management/
  /CC9-vendor-risk/
  /A1-availability/        (if in scope)
  /C1-confidentiality/     (if in scope)
  /PI1-processing-integrity/ (if in scope)
  /P1-P8-privacy/          (if in scope)

Common Evidence Artifacts

Vendor Risk Questionnaires

Read references/vendor.md for full questionnaire templates and review guidance.

When to Use (CC9 Context)

SOC 2 CC9 requires organizations to identify and manage risks from vendors and business partners. This means:

• Maintaining a vendor inventory with risk tiering
• Performing due diligence before onboarding critical vendors
• Reviewing vendor SOC 2 reports (or equivalent) annually
• Addressing Complementary User Entity Controls (CUECs) from vendor SOC 2 reports

Vendor Risk Tiers

Output Format Guidelines

Adapt your output to the user's context:

• First-time / startup — explain concepts, use plain language, provide examples, offer templates
• Security/compliance team — use technical TSC language, jump to specifics, provide gap matrices
• Auditor/consultant — use precise AICPA language, cite criteria codes, offer control testing procedures
• Responding to a customer — provide concise, professional summaries suitable for sharing externally

Always:

• Reference TSC criteria codes (e.g., CC6.1) when making specific claims
• Distinguish Type 1 vs Type 2 where relevant
• Flag when something requires a licensed CPA firm (formal audit, readiness letter)
• Note that controls must be tailored to the organization — SOC 2 prescribes criteria, not specific controls

Reference Files

Load these files when working on the corresponding tasks:

• references/controls.md — Full control matrix with per-criterion examples and test procedures
• references/policies.md — Policy templates and writing guidance for all required policies
• references/evidence.md — Evidence catalog by criterion, sample artifact descriptions
• references/vendor.md — Vendor risk questionnaire template and CUEC review guidance