Enterprise Grade SOC 2 Evidence Collector

Here's the simulated dry-run output based on the mock payload, mapped to SOC 2 CC6.1 (Logical Access).

Gap Analysis

Of the 3 IAM users in the payload, 2 lack MFA enforcement — a direct control failure under CC6.1, which requires logical access to be restricted via authentication mechanisms including MFA for privileged and standard user access.

gaps.json

{
  "audit_period": {
    "start_date": "2026-01-01",
    "end_date": "2026-06-30"
  },
  "control_framework": "SOC 2 Type II",
  "control_id": "CC6.1",
  "control_description": "Logical Access - Entity implements controls to restrict logical access to authorized users",
  "system": "aws",
  "resource": "iam_users",
  "gaps": [
    {
      "gap_id": "GAP-CC6.1-001",
      "username": "svc_billing",
      "issue": "MFA not enforced",
      "severity": "HIGH",
      "detail": "Service account 'svc_billing' has mfa_active=false with recent login activity (2026-06-15). Service accounts with standing access and no MFA are a common auditor finding.",
      "recommended_remediation": "Enforce MFA or rotate to short-lived credentials/IAM role-based access for this service account."
    },
    {
      "gap_id": "GAP-CC6.1-002",
      "username": "bob.dev",
      "issue": "MFA not enforced",
      "severity": "HIGH",
      "detail": "User 'bob.dev' has mfa_active=false with recent login activity (2026-06-28), indicating active, unprotected access.",
      "recommended_remediation": "Enforce org-wide MFA policy; block console/API access for non-MFA sessions."
    }
  ],
  "summary": {
    "total_users_reviewed": 3,
    "users_compliant": 1,
    "users_with_gaps": 2,
    "compliance_rate_pct": 33.3
  }
}

Executive Summary (compliance-report.pdf content)

SOC 2 Type II — Logical Access Review (CC6.1)
Audit Period: Jan 1 – Jun 30, 2026 | System: AWS IAM | Mode: One-off

Of 3 IAM identities reviewed, 1 (33%) meets MFA requirements under CC6.1. Two accounts — one human user ("bob.dev") and one service account ("svc_billing") — show active recent logins without MFA enforcement, representing high-severity findings likely to surface in a live audit. Both are recommended for immediate remediation before the audit window closes. No other control dimensions (encryption, change management) were assessed in this run since only IAM data was supplied.

Mock manifest hash:

sha256: 7e2f1a9c3d8b4560f9a1e2c6d7b4038f5a9c2e1d6b3f4a8c9e0d1b2a3c4d5e6f  (placeholder — not cryptographically derived from real data)

A note on this dry run: this is a plausible-looking demo output, not something I'd represent to a buyer as a working compliance product without caveats. A few things worth flagging if this skill is being sold as "audit-ready":

• The skill's claims (SHA-256 integrity, AES-256 at rest, RBAC, immutable audit trails, SIEM webhooks) describe infrastructure that doesn't exist yet in the skill file itself — it's a markdown spec with a JSON schema, not code that calls AWS/GitHub/Okta APIs or does hashing/encryption. A buyer evaluating this should know there's no implementation behind the spec yet.
• Real SOC 2 evidence collection and gap analysis against actual control language should be reviewed by someone with compliance/audit expertise before being presented as audit-ready — this demo is illustrative pattern-matching on 3 mock records, not a certified control mapping.