Soc2 Compliance Expert

SOC 2 Compliance Expert

SOC 2 Type I and Type II compliance management covering all Trust Services Criteria (TSC), infrastructure security validation, evidence collection, and end-to-end audit preparation.

SOC 2 Overview

Type I vs Type II

Start with Type I to validate control design, then transition to Type II within 6 months.

Trust Services Criteria Summary

For detailed control requirements per category, see REFERENCE.md.

Clarify First

Before running the readiness assessment, confirm these inputs. If any is unknown or vague, ASK — do not assume:

• Report type — Type I (design at a point in time) vs Type II (operating effectiveness over a period) (sets the observation-period requirement and timeline)
• TSC scope — which criteria beyond mandatory Security (Availability, Processing Integrity, Confidentiality, Privacy) (drives which controls and evidence are needed)
• Subservice organizations — carve-out vs inclusive (affects the scope and system description)

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the assessment.

Readiness Assessment Workflow

The agent guides organizations through SOC 2 readiness from gap analysis through audit completion.

Workflow: Phase 1 -- Gap Analysis (Weeks 1-4)

1. Define scope -- determine which TSC categories to include (Security is mandatory), define system boundaries, identify subservice organizations (carve-out vs. inclusive), document principal service commitments.
2. Assess current state -- inventory existing policies and procedures, map current controls to TSC requirements, interview process owners and control operators.
3. Run automated gap analysis using scripts/soc2_readiness_checker.py.
4. Document gaps -- missing controls, controls lacking evidence, controls not operating effectively.
5. Prioritize gaps by risk level and remediation effort.
6. Validation checkpoint: Gap analysis covers all in-scope TSC categories; each gap has severity rating and remediation owner assigned.

Workflow: Phase 2 -- Remediation (Weeks 5-16)

1. Develop/update policies -- information security policy, supporting procedures per control domain, policy review and approval workflows.
2. Implement technical controls -- configure IdP with SSO/MFA enforcement, deploy endpoint security (MDM, EDR, disk encryption), implement SIEM logging and monitoring, configure backup and DR, harden cloud infrastructure.
3. Establish processes -- access review procedures, change management workflow, incident response procedures, vendor management program, security awareness training.
4. Set up evidence collection -- configure automated collection, establish repository structure, define refresh cadence per TSC category.
5. Validation checkpoint: All identified gaps remediated; technical controls verified via scripts/soc2_infrastructure_auditor.py; evidence collection producing artifacts.

Workflow: Phase 3 -- Pre-Audit (Weeks 17-20)

1. Conduct internal readiness assessment -- mock audit against all in-scope TSC, validate evidence completeness and quality, run infrastructure auditor for technical validation.
2. Remediate pre-audit findings -- address remaining gaps, strengthen evidence.
3. Select and engage CPA firm -- negotiate scope, timeline, fees; schedule kickoff; prepare system description draft.
4. Validation checkpoint: Mock audit passes with no critical gaps; system description reviewed; auditor engaged.

Workflow: Phase 4 -- Audit Execution

1. Type I audit (if applicable) -- auditor reviews control design; management provides assertions; address findings before Type II.
2. Type II observation period (3-12 months) -- controls operate consistently, evidence collected continuously, quarterly self-assessments, regular auditor check-ins.
3. Fieldwork (2-4 weeks) -- auditor selects samples, tests controls, interviews personnel; draft report review; final report issuance.
4. Validation checkpoint: Clean opinion received; any findings have management response and remediation plan.

Evidence Collection Framework

Evidence by TSC Category

Example: Evidence Collection Command

# Generate evidence checklist for all TSC categories
python scripts/evidence_collector.py --generate-checklist --categories all

# Track evidence status
python scripts/evidence_collector.py --status evidence-tracker.json

# Update specific evidence item
python scripts/evidence_collector.py --update evidence-tracker.json \
  --item CC6.1-MFA --status collected

# Generate readiness dashboard
python scripts/evidence_collector.py --dashboard evidence-tracker.json

# Export for auditor review
python scripts/evidence_collector.py --export evidence-tracker.json --format json

Automation Strategies

GRC Platforms: Vanta, Drata, Secureframe, Laika, AuditBoard -- automated evidence collection via API integrations, continuous control monitoring, auditor collaboration portals.

Infrastructure-as-Evidence: Cloud configuration snapshots (AWS Config, Azure Policy, GCP Org Policies), Terraform state as configuration evidence, Git history as change management evidence, CI/CD pipeline logs as deployment control evidence.

Infrastructure Security Validation

The agent validates infrastructure configurations against SOC 2 requirements.

Quick Reference: Infrastructure Checks

For detailed per-provider control mappings, see REFERENCE.md.

Example: Infrastructure Audit Command

# Full infrastructure audit
python scripts/soc2_infrastructure_auditor.py --config infra-config.json

# Audit specific domains only
python scripts/soc2_infrastructure_auditor.py --config infra-config.json \
  --domains dns tls cloud

# JSON output with severity ratings
python scripts/soc2_infrastructure_auditor.py --config infra-config.json --format json

# Generate sample configuration template
python scripts/soc2_infrastructure_auditor.py --generate-template

Audit Timeline

Typical Timeline (First SOC 2)

Annual Renewal

• Begin renewal planning 3 months before observation period ends
• Maintain continuous compliance between audit periods
• Address prior-year findings before new observation period
• Bridge letters available for gaps between reports

Incident Response Requirements

IRP Structure

1. Preparation -- IR team defined, communication channels established, runbooks for common incidents, legal/PR contacts on retainer.
2. Detection and Analysis -- monitoring/alerting coverage, severity classification (SEV1-SEV4), triage procedures, escalation matrix.
3. Containment, Eradication, Recovery -- isolate affected systems, preserve evidence, identify root cause, restore and validate.
4. Post-Incident -- blameless post-mortem within 5 business days, lessons learned, control improvements, notification assessment (MTTD, MTTR, MTTC tracking).

For severity level definitions and breach notification timelines, see REFERENCE.md.

Tools

SOC 2 Readiness Checker

# Full readiness assessment
python scripts/soc2_readiness_checker.py --config org-controls.json

# JSON output for programmatic use
python scripts/soc2_readiness_checker.py --config org-controls.json --format json

# Check specific TSC categories
python scripts/soc2_readiness_checker.py --config org-controls.json \
  --categories security availability

# Include cloud provider control mapping
python scripts/soc2_readiness_checker.py --config org-controls.json --cloud-mapping

Evidence Collector

# Generate checklist and track status
python scripts/evidence_collector.py --generate-checklist --categories all
python scripts/evidence_collector.py --status evidence-tracker.json
python scripts/evidence_collector.py --dashboard evidence-tracker.json

Infrastructure Auditor

# Validate infrastructure against SOC 2 requirements
python scripts/soc2_infrastructure_auditor.py --config infra-config.json
python scripts/soc2_infrastructure_auditor.py --config infra-config.json --format json

References

Troubleshooting

Success Criteria

• SOC 2 scope defined with all applicable TSC categories selected, system boundaries documented, and subservice organizations identified (carve-out vs inclusive)
• Gap analysis completed with every identified gap assigned a severity rating, remediation owner, and target completion date
• Readiness score of 80%+ across all in-scope TSC categories before engaging the CPA firm, trending to 95%+ before Type II fieldwork
• Evidence collection framework operational with centralized repository, defined refresh cadence per TSC category, and automated collection where possible
• Infrastructure audit passes with no critical or high-severity findings in DNS, TLS, cloud, endpoint, or access control domains
• Type II observation period of at least 6 months with continuous control operation, quarterly self-assessments, and no significant control failures
• Clean SOC 2 Type II opinion received with any findings addressed by management response and documented remediation plans

Scope & Limitations

In Scope:

• SOC 2 Type I and Type II readiness assessment against all TSC categories (CC1-CC9, A1, PI1, C1, P1)
• Infrastructure security validation (DNS, TLS, cloud, endpoint, network, container, CI/CD, secrets)
• Evidence collection framework generation and tracking
• Gap analysis with severity-rated findings and remediation guidance
• Audit timeline planning and CPA firm engagement preparation
• Incident response plan structure and requirements
• Continuous compliance program design

Out of Scope:

• CPA firm audit execution (the tools prepare for audit; the actual Type I/II report requires an independent CPA firm)
• SOC 1 (ICFR) assessment (SOC 1 covers financial reporting controls, not security/availability/privacy)
• SOC 3 report generation (SOC 3 is a public-facing summary derived from SOC 2; it requires a completed SOC 2 audit)
• Penetration testing execution (use infrastructure-compliance-auditor or engage a third-party pentest firm)
• GRC platform selection or implementation (the skill is compatible with Vanta, Drata, Secureframe, etc., but does not implement them)
• Legal advice on customer contractual requirements for SOC 2 reports
• Physical security assessments (the infrastructure auditor covers logical controls; physical data center audits require on-site assessment)

Integration Points

Tool Reference

soc2_readiness_checker.py

Evaluates organizational controls against SOC 2 Trust Services Criteria with per-category scoring.

evidence_collector.py

Generates evidence collection checklists and tracks evidence gathering status.

soc2_infrastructure_auditor.py

Audits infrastructure configurations against SOC 2 requirements with severity-rated findings.