Agent skill · security · borghei
soc2-compliance-expert
SOC 2 Type I and Type II compliance management against the Trust Services Criteria. Use for SOC 2 readiness assessments, TSC gap analysis, audit evidence collection, infrastructure control validation, and CPA firm audit preparation.
Why this skill is useful
Provides detailed workflows and specific scripts for SOC 2 readiness assessments that the AI wouldn't reliably generate on its own.
What it needs
Requires python installed locally. About 11k tokens when loaded. Last updated 2026-07-21. 462 stars on the source repository.
What this skill does
SOC 2 Compliance Expert SOC 2 Type I and Type II compliance management covering all Trust Services Criteria (TSC), infrastructure security validation, evidence collection, and end-to-end audit preparation. --- SOC 2 Overview Type I vs Type II Aspect Type I Type II -------- -------- --------- Scope Design of controls at a point in time Design AND operating effectiveness over a period Duration Single date (snapshot) Observation period (3-12 months, typically 6-12) Cost $20K-$60K (first audit) $40K-$150K (first audit) Timeline 1-3 months 6-15 months (includes observation period) Customer Preference Early-stage acceptable Enterprise customers require Start with Type I to validate control design, then transition to Type II within 6 months. Trust Services Criteria Summary Category Focus Controls ---------- ------- ---------- CC1-CC5 Common Criteria (COSO-based) Control environment, communication, risk, monitoring, control activities CC6 Logical and Physical Access Authentication, authorization, physical security, encryption CC7 System Operations Vulnerability management, monitoring, incident response, BCP CC8 Change Management Authorization, testing, deployment controls CC9 Risk Mitigation Vendor management, business disruption, risk transfer A1 Availability Capacity planning, DR, recovery testing PI1 Processing Integrity Data validation, error handling, reconciliation C1 Confidentiality Classification, encryption, disposal P1 Privacy Notice, consent, data subject rights, retention For detailed control requirements per category, see REFERENCE.md. --- Clarify First Before running the readiness assessment, confirm these inputs. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills borghei/soc2-compliance-expert