# Soc2 Expert

> Expert in SOC 2 compliance, trust service criteria, audit preparation, controls implementation, and security frameworks. Use when the user mentions compliance, audit, trust services, AICPA, controls, or security framework, or when the task involves Trust Service Criteria, SOC 2 Types, Security Common Criteria, or Control Implementation Framework.

- Skill: `personamanagmentlayer/soc2-expert` (Agent Skill)
- Install (CLI): `npx skillmds add personamanagmentlayer/soc2-expert`
- Raw SKILL.md: https://api.skillmd.com/api/skills/personamanagmentlayer/soc2-expert/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: personamanagmentlayer (https://skillmd.com/u/personamanagmentlayer)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/personamanagmentlayer/soc2-expert

---


# SOC 2 Expert

You are an expert in SOC 2 (System and Organization Controls 2) compliance, specializing in trust service criteria, audit preparation, controls implementation, and continuous monitoring.

## Core Concepts

### Trust Service Criteria (TSC)

- **Security (Common Criteria)**: Protection against unauthorized access
- **Availability**: System availability for operation and use
- **Processing Integrity**: System processing is complete, valid, accurate, timely
- **Confidentiality**: Confidential information is protected
- **Privacy**: Personal information is collected, used, retained, disclosed appropriately

### SOC 2 Types

- **Type I**: Design of controls at a specific point in time
- **Type II**: Operating effectiveness of controls over a period (usually 6-12 months)
- **Report Structure**: Description criteria, control objectives, auditor opinion
- **Audit Period**: Typically 6 months minimum for Type II
- **Scope**: Systems, services, and controls in scope
- **Exceptions**: Control failures and their impact

### Security Common Criteria (CC)

- **CC1**: Control Environment
- **CC2**: Communication and Information
- **CC3**: Risk Assessment
- **CC4**: Monitoring Activities
- **CC5**: Control Activities
- **CC6**: Logical and Physical Access Controls
- **CC7**: System Operations
- **CC8**: Change Management
- **CC9**: Risk Mitigation

## Code Examples

### Control Implementation Framework

```python
# soc2_controls.py - SOC 2 controls management system
from dataclasses import dataclass
from datetime import datetime
from enum import Enum
from typing import List, Optional

class ControlCategory(Enum):
    CC1_CONTROL_ENVIRONMENT = "CC1"
    CC2_COMMUNICATION = "CC2"
    CC3_RISK_ASSESSMENT = "CC3"
    CC4_MONITORING = "CC4"
    CC5_CONTROL_ACTIVITIES = "CC5"
    CC6_ACCESS_CONTROLS = "CC6"
    CC7_SYSTEM_OPERATIONS = "CC7"
    CC8_CHANGE_MANAGEMENT = "CC8"
    CC9_RISK_MITIGATION = "CC9"

class ControlStatus(Enum):
    DESIGNED = "designed"
    IMPLEMENTED = "implemented"
    OPERATING = "operating"
    NOT_OPERATING = "not_operating"
    REMEDIATED = "remediated"

@dataclass
class Control:
    id: str
    category: ControlCategory
    description: str
    control_owner: str
    frequency: str  # daily, weekly, monthly, quarterly, annual
    evidence_required: List[str]
    status: ControlStatus
    last_tested: Optional[datetime] = None
    exceptions: List[str] = None

    def __post_init__(self):
        if self.exceptions is None:
            self.exceptions = []

class SOC2ControlsManager:
    def __init__(self):
        self.controls = {}
        self.evidence = {}
        self.exceptions = []

    def add_control(self, control: Control):
        """Add a SOC 2 control to the framework."""
        self.controls[control.id] = control

    def test_control(self, control_id: str, test_results: dict):
        """Document control testing for audit."""
        if control_id not in self.controls:
            raise ValueError(f"Control {control_id} not found")

        control = self.controls[control_id]
        control.last_tested = datetime.now()

        if test_results.get('passed'):
            control.status = ControlStatus.OPERATING
        else:
            control.status = ControlStatus.NOT_OPERATING
            self._log_exception(control, test_results.get('reason'))

        self._store_evidence(control_id, test_results)

    def collect_evidence(self, control_id: str, evidence: dict):
        """Collect audit evidence for controls."""
        if control_id not in self.evidence:
            self.evidence[control_id] = []

        evidence['collected_at'] = datetime.now()
        self.evidence[control_id].append(evidence)

    def get_control_effectiveness(self, control_id: str) -> dict:
        """Calculate control operating effectiveness."""
        if control_id not in self.controls:
            return {'effective': False, 'reason': 'Control not found'}

        control = self.controls[control_id]
        evidence_items = self.evidence.get(control_id, [])

        if control.status != ControlStatus.OPERATING:
            return {'effective': False, 'reason': 'Control not operating'}

        if not evidence_items:
            return {'effective': False, 'reason': 'No evidence collected'}

        # Calculate effectiveness based on testing frequency
        required_tests = self._calculate_required_tests(control.frequency)
        actual_tests = len(evidence_items)

        effectiveness_rate = (actual_tests / required_tests) * 100 if required_tests > 0 else 0

        return {
            'effective': effectiveness_rate >= 95,  # 95% threshold
            'rate': effectiveness_rate,
            'required_tests': required_tests,
            'actual_tests': actual_tests
        }

    def generate_audit_report(self) -> dict:
        """Generate SOC 2 audit readiness report."""
        report = {
            'total_controls': len(self.controls),
            'by_category': {},
            'by_status': {},
            'exceptions': len(self.exceptions),
            'evidence_collected': sum(len(items) for items in self.evidence.values()),
            'generated_at': datetime.now().isoformat()
        }

        # Count by category
        for control in self.controls.values():
            category = control.category.value
            report['by_category'][category] = report['by_category'].get(category, 0) + 1

            status = control.status.value
            report['by_status'][status] = report['by_status'].get(status, 0) + 1

        return report

    def _log_exception(self, control: Control, reason: str):
        """Log control exceptions for audit report."""
        exception = {
            'control_id': control.id,
            'category': control.category.value,
            'description': control.description,
            'reason': reason,
            'logged_at': datetime.now(),
            'owner': control.control_owner
        }
        self.exceptions.append(exception)
        control.exceptions.append(exception)

    def _calculate_required_tests(self, frequency: str) -> int:
        """Calculate required test samples based on frequency."""
        # For 12-month audit period
        frequency_map = {
            'daily': 365,
            'weekly': 52,
            'monthly': 12,
            'quarterly': 4,
            'annual': 1
        }
        return frequency_map.get(frequency.lower(), 1)

    def _store_evidence(self, control_id: str, evidence: dict):
        """Store evidence for audit trail."""
        self.collect_evidence(control_id, evidence)

# Example usage
manager = SOC2ControlsManager()

# Add access control
access_control = Control(
    id="CC6.1",
    category=ControlCategory.CC6_ACCESS_CONTROLS,
    description="Logical access is granted based on approved authorization",
    control_owner="Security Team",
    frequency="daily",
    evidence_required=["Access logs", "Approval tickets", "User provisioning records"],
    status=ControlStatus.IMPLEMENTED
)
manager.add_control(access_control)

# Test control
manager.test_control("CC6.1", {
    'passed': True,
    'tester': 'Audit Team',
    'date': datetime.now(),
    'evidence': 'Access logs reviewed'
})
```

### Evidence Collection Automation

```python
# evidence_collection.py - Automated evidence gathering
import boto3
import json
from datetime import datetime

class EvidenceCollector:
    def __init__(self):
        self.s3_client = boto3.client('s3')
        self.evidence_bucket = 'soc2-evidence'

    def collect_access_logs(self, start_date, end_date):
        """Collect access logs for CC6 controls."""
        logs = self._query_cloudwatch_logs(start_date, end_date)
        self._store_evidence('access_logs', logs)
        return logs

    def collect_change_tickets(self, start_date, end_date):
        """Collect change management tickets for CC8."""
        tickets = self._query_jira('project = CHANGE', start_date, end_date)
        self._store_evidence('change_tickets', tickets)
        return tickets

    def collect_security_scans(self):
        """Collect vulnerability scans for CC9."""
        scans = self._get_latest_scans()
        self._store_evidence('security_scans', scans)
        return scans

    def _store_evidence(self, evidence_type, data):
        """Store evidence in S3 for audit."""
        timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
        key = f"{evidence_type}/{timestamp}.json"

        self.s3_client.put_object(
            Bucket=self.evidence_bucket,
            Key=key,
            Body=json.dumps(data, indent=2),
            ServerSideEncryption='AES256'
        )

    def _query_cloudwatch_logs(self, start, end):
        """Query CloudWatch for access logs."""
        # Implementation
        return []

    def _query_jira(self, jql, start, end):
        """Query Jira for tickets."""
        # Implementation
        return []

    def _get_latest_scans(self):
        """Get latest security scans."""
        # Implementation
        return []
```

## Best Practices

### Audit Preparation

- Maintain continuous compliance year-round
- Automate evidence collection where possible
- Document all controls clearly
- Conduct regular internal audits
- Keep detailed audit trails
- Assign control owners and accountability

### Control Design

- Map controls to TSC criteria
- Define clear control objectives
- Specify control frequency
- Document evidence requirements
- Design for automation
- Consider scalability

### Evidence Management

- Collect evidence systematically
- Store evidence securely and immutably
- Organize by control and period
- Automate collection processes
- Maintain chain of custody
- Keep evidence for required retention period

### Continuous Monitoring

- Monitor control effectiveness continuously
- Track exceptions and remediation
- Regular control testing
- Automated alerting for control failures
- Dashboard for compliance status
- Quarterly assessments

### Remediation

- Document all exceptions
- Implement timely remediation
- Track remediation to closure
- Root cause analysis
- Prevent recurrence
- Update controls as needed

## Anti-Patterns

### Audit Failures

- Last-minute compliance efforts
- Missing or incomplete evidence
- Undocumented controls
- No control testing
- Ignoring exceptions
- Poor communication with auditors

### Control Issues

- Poorly defined controls
- No assigned owners
- Infrequent testing
- Manual processes prone to error
- Controls not aligned to TSC
- Overlapping or redundant controls

### Evidence Problems

- Missing evidence for audit period
- Evidence not retained
- Poor organization
- No automation
- Unverifiable evidence
- Inconsistent collection

### Management Mistakes

- No executive buy-in
- Insufficient resources
- Treating SOC 2 as one-time project
- No continuous monitoring
- Ignoring control failures
- Poor exception management

## Resources

### Official Standards

- [AICPA Trust Services Criteria](https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/trustdataintegritytaskforce.html)
- [SOC 2 Framework](https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/socforserviceorganizations.html)

### Tools and Platforms

- [Vanta Compliance Automation](https://www.vanta.com/)
- [Drata Continuous Compliance](https://drata.com/)
- [Secureframe SOC 2](https://secureframe.com/)
- [Tugboat Logic](https://www.tugboatlogic.com/)

### Learning Resources

- [SOC 2 Academy](https://soc2.com/)
- [AICPA SOC Resources](https://www.aicpa.org/soc)
- [Compliance as Code Patterns](https://www.oreilly.com/library/view/compliance-as-code/9781492073888/)

### Community

- [Trust Services Forum](https://www.aicpa.org/forums/trustservices)
- [GRC Community](https://www.linkedin.com/groups/82571/)
- [SOC 2 Subreddit](https://www.reddit.com/r/cybersecurity/)