Soc2 Compliance Check

SOC2 Compliance Check Skill

Assess SOC2 Type II readiness for {{ organization }} covering audit period {{ audit_period }}.

Workflow

Step 1 — Scope Definition

Establish what is in scope:

1. Trust Service Criteria: {{ trust_criteria | "Security (required), Availability, Confidentiality" }}
2. Systems in scope: [list services, infrastructure, third-party tools]
3. Prior audit findings: [review any open items from previous audit]

Step 2 — CC6: Logical & Physical Access Controls

ACCESS CONTROLS (CC6)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] User access provisioning requires manager approval
[ ] User access reviews conducted quarterly
[ ] Terminated users deprovisioned within 24 hours
[ ] MFA enforced for all production access
[ ] Privileged access limited and logged
[ ] SSH keys / API tokens rotated on schedule
[ ] Physical data center access controlled (if applicable)
[ ] Vendor access reviewed and time-limited
[ ] Role-based access control (RBAC) implemented

Step 3 — CC7: System Operations & Monitoring

SYSTEM OPERATIONS (CC7)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Infrastructure monitoring with alerting (uptime, errors, latency)
[ ] Security event monitoring and SIEM in place
[ ] Vulnerability scanning on regular cadence
[ ] Patch management process with defined SLAs
[ ] Capacity monitoring with proactive scaling
[ ] Backup procedures documented and tested
[ ] Backup restoration tested at least annually
[ ] Incident detection within defined time thresholds

Step 4 — CC8: Change Management

CHANGE MANAGEMENT (CC8)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] All code changes require peer review (PR approval)
[ ] CI/CD pipeline enforces automated tests before deploy
[ ] Production deployments logged with who/what/when
[ ] Infrastructure changes via IaC (Terraform, CloudFormation)
[ ] Change approval process for production changes
[ ] Separation of duties: developers cannot deploy to production alone
[ ] Rollback procedures documented for all deployments
[ ] Emergency change process defined and documented

Step 5 — Incident Response & Communication

INCIDENT RESPONSE (CC7.3-CC7.5)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Incident response plan documented and current
[ ] On-call rotation staffed 24/7
[ ] Incident severity classification defined
[ ] Communication procedures for security incidents
[ ] Post-incident reviews conducted for SEV1/SEV2
[ ] Annual incident response drill or tabletop exercise
[ ] Customer notification process for data breaches

Step 6 — Risk Assessment & Vendor Management

RISK & VENDOR MANAGEMENT (CC3, CC9)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Annual risk assessment conducted
[ ] Risk register maintained with owners and mitigations
[ ] Vendor inventory maintained with criticality ratings
[ ] Critical vendors have SOC2 reports or equivalent
[ ] Vendor access reviewed annually
[ ] Business continuity plan documented
[ ] Data processing agreements in place with vendors

Step 7 — Evidence Collection Checklist

For each control, gather evidence:

• Access reviews: Export of quarterly review with approvals
• Change management: Sample PRs showing review process
• Monitoring: Screenshots of dashboards and alert configurations
• Incident response: Post-mortem documents from audit period
• Vendor management: Vendor SOC2 reports or security questionnaires
• Training: Security awareness training completion records

Step 8 — Gap Analysis & Remediation

Counter-Rationalizations

Output Format

Produce a SOC2 readiness report with:

1. Scope summary (criteria, systems, audit period)
2. Control assessment per Trust Service Category with READY/GAP status
3. Evidence checklist with collection status per control
4. Gap analysis with prioritized remediation actions
5. Readiness score (% of controls audit-ready)