Agent skill · marketing growth · alirezarezvani
soc2-compliance
Use when the user asks to prepare for SOC 2 audits, map Trust Service Criteria, build control matrices, collect audit evidence, perform gap analysis, or assess SOC 2 Type I vs Type II readiness.
Why this skill is useful
Provides specific workflows and templates for SOC 2 compliance that the AI wouldn't reliably generate on its own.
What it needs
About 11k tokens when loaded. Last updated 2026-08-05. 23,939 stars on the source repository.
What this skill does
SOC 2 Compliance SOC 2 Type I and Type II compliance preparation for SaaS companies. Covers Trust Service Criteria mapping, control matrix generation, evidence collection, gap analysis, and audit readiness assessment. Table of Contents Overview Trust Service Criteria Control Matrix Generation Gap Analysis Workflow Evidence Collection Audit Readiness Checklist Vendor Management Continuous Compliance Anti-Patterns Tools References Cross-References --- Overview What Is SOC 2? SOC 2 (System and Organization Controls 2) is an auditing framework developed by the AICPA that evaluates how a service organization manages customer data. It applies to any technology company that stores, processes, or transmits customer information — primarily SaaS, cloud infrastructure, and managed service providers. Type I vs Type II Aspect Type I Type II -------- -------- --------- Scope Design of controls at a point in time Design AND operating effectiveness over a period Duration Snapshot (single date) Observation window (3-12 months, typically 6) Evidence Control descriptions, policies Control descriptions + operating evidence (logs, tickets, screenshots) Cost $20K-$50K (audit fees) $30K-$100K+ (audit fees) Timeline 1-2 months (audit phase) 6-12 months (observation + audit) Best For First-time compliance, rapid market need Mature organizations, enterprise customers Who Needs SOC 2? SaaS companies selling to enterprise customers Cloud infrastructure providers handling customer workloads Data processors managing PII, PHI, or financial data Managed service providers with access to client systems Any vendor whose customers require third-party assurance Typical Journey --- Trust Service Criteria SOC 2 is organized around five Trust Service Criteria (TSC) categories. Security is required for every SOC 2 report; the remaining four are optional and selected based on business need. Security (Common Criteria CC1-CC9) — Required The foundation of every SOC 2 report. Maps to COSO 2013 principles. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills alirezarezvani/soc2-compliance--e82231