Agent skill · marketing growth · borghei
soc2-audit-prep
SOC 2 audit-prep playbook: the 4/8/12-week sprint to audit-ready for a Type I or Type II observation. Use when the audit is scheduled, when readiness assessment surfaced gaps and you need a sprint plan, or when evidence is missing or stale.
Why this skill is useful
Provides a detailed operational playbook and scripts for SOC 2 audit preparation that the AI wouldn't reliably generate on its own.
What it needs
About 5k tokens when loaded. Last updated 2026-07-21. 462 stars on the source repository.
What this skill does
SOC 2 Audit Prep Operational playbook for SOC 2 audit preparation. Designed to be picked up 4-12 weeks before an audit and run as a sprint to closure. Pairs with our deep ra-qm-team/soc2-compliance-expert skill (which builds the program from scratch). When to use this skill vs. soc2-compliance-expert: This skill: audit scheduled in 4-12 weeks; gaps known; need to execute the sprint soc2-compliance-expert: building the SOC 2 program; designing controls; multi-quarter effort --- When to use this skill Situation Skill applies ----------- --------------- SOC 2 audit scheduled, need readiness sprint Yes — start here Type I audit in 4-12 weeks Yes — use 4 or 8-week sprint plan Type II observation period closing soon Yes — use 12-week sprint plan Readiness assessment surfaced gaps Yes — scripts/soc2readinessscore.py + evidencegapfinder.py Building SOC 2 program from scratch Use ra-qm-team/soc2-compliance-expert instead --- The audit-prep sprint at a glance 4-week sprint (Type I, mostly ready) 8-week sprint (Type I, gaps remaining) 12-week sprint (Type II observation prep) See references/evidence-collection-sprint-plan.md for the detailed week-by-week plans. --- The pre-audit punch list Standard pre-audit punch list, organized by Trust Services Criterion: CC1-CC5 (Common Criteria — control environment) [ ] Information security policy approved + dated within 12 months [ ] Org chart current (reflects actual reporting lines) [ ] Risk assessment performed + documented within 12 months [ ] Board / leadership oversight evidence (minutes referencing security) [ ] Code of conduct signed by all employees [ ] Background checks documented for all hires CC6 (Logical and Physical Access) [ ] SSO enforced for all production systems [ ] MFA universal (no exceptions documented for production access) [ ] Access review evidence (quarterly minimum) [ ] Privileged access management (PAM) for admin/root accounts [ ] Physical security evidence (office badge logs, data center attestation) [ ] Enc …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills borghei/soc2-audit-prep