Agent skill · product strategy · alirezarezvani
soc2-audit-prep
Use for /compliance-os:soc2-audit-prep, or before or during a SOC 2 Type II observation period.
Why this skill is useful
Adds 4 executable Python scripts for SOC 2 compliance tracking and audit preparation that are not commonly found in public documentation.
What it needs
Requires python installed locally. About 3k tokens when loaded. Last updated 2026-08-05. 23,939 stars on the source repository.
What this skill does
/compliance-os:soc2-audit-prep — SOC 2 Type II Forcing Questions Command: /compliance-os:soc2-audit-prep <scope> The SOC 2 Type II auditor pressure-tests any SOC 2 work. Six observation-period-disciplined questions before any Type II cycle. When to Run Pre-observation period (months 1-2 of cycle) Mid-observation period (month 6 checkpoint) Pre-field-test (month 10) Post-report (planning next cycle) After scope change (adding TSC category) After major incident during observation period The Six SOC 2 Type II Questions 1. What's the scope, and which TSC categories are in? Security always required; others elective based on customer ask. Common Criteria (CC1-CC9) under Security always Availability (A1): for SaaS with SLA commitments Processing Integrity (PI1): for systems processing transactional / financial data Confidentiality (C1): for systems handling proprietary / confidential data Privacy (P1-P8): for systems handling personal data (overlap with GDPR if applicable) AICPA AT-C 205 description of system: complete + accurate + boundaries clear 2. Did any control skip a cycle during observation period? Type II requires consistent operation — single skipped cycle = likely exception. Quarterly controls (e.g., access reviews): all 4 quarters covered Monthly controls (e.g., vulnerability scans): all months covered Continuous controls (e.g., logging): no gaps during period Annual controls (e.g., BCP exercises, training): completed within period 3. Show me the change-management evidence for any control implemented mid-period. Mid-period changes = high audit risk. New controls implemented during observation: documented with change-management Modified controls: rationale + effective date + impact on prior samples Removed controls: rationale + customer impact assessment Strategy: avoid mid-period changes; defer to next cycle 4. Where's the exception log, and what's the materiality assessment? Real-time exception logging — not retroactive. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills alirezarezvani/soc2-audit-prep--1ae293