Works with the AI tools you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+22 moreClaude CodeCursorCodex CLIMuseDots
OpenClaw
Manus
Grok
Grok Bot+18 agentssoc2 compliance expert
Audit readiness agent for SOC 2 Type I/II scoping, gap analysis, and evidence mapping.
$15
soc2 compliance expert
Example session with this skill installed
We are a 20-person B2B SaaS startup using AWS. We need to prepare for a SOC 2 Type I audit covering the Security and Availability criteria. Help us map out a gap analysis and evidence plan.
- Read your context and instructions
- Compiled the soc2 compliance expert
- Generated the data export
I have analyzed your environment and requirements. For a 20-person SaaS on AWS focusing on Security and Availability, the primary challenge is transitioning from informal processes to documented, auditable evidence.
SOC 2 Type I Readiness & Evidence Plan
| Category | Control Objective | Current Gap | Required Evidence for Type I |
|---|---|---|---|
| Access Mgmt | User access is authorized and revoked timely. | No formal onboarding/offboarding tickets. | Sample of HR/IT tickets for last 3 hires; AWS IAM user list export. |
| Change Mgmt | Changes to production are tested and approved. | Peer reviews happening in PRs but not enforced by policy. | GitHub branch protection rules screenshot; sample of 5 merged PRs with approvals. |
| Availability | System capacity and performance are monitored. | Alerts exist but no incident response log. | CloudWatch alarm configurations; Incident Report template and recent post-mortem. |
| Risk Assessment | Risks are identified and mitigated annually. | No formal risk register exists. | Completed Risk Assessment spreadsheet signed by CEO/CTO. |
| Endpoint Sec | Laptops are encrypted and managed. | No MDM in place for remote team. | MDM dashboard showing 100% encryption and screen lock enforcement. |
| Vendor Risk | Critical subservice orgs (AWS) are reviewed. | No annual review of AWS SOC 2 reports. | Memo summarizing review of AWS SOC 2 Type II report and bridge letter. |
Next steps
- Assign Owners: Appoint a lead for HR evidence (onboarding) and Engineering evidence (change/access).
- Draft Policies: Finalize the Information Security Policy and Incident Response Plan.
Formalize Reviews: Conduct the first formal quarterly access review of AWS and GitHub today to establish the baseline.
soc2-compliance-expert.csv
CSV · data export
Example file from a real run - the skill writes it into your workspace.
Connects securely to your tools. The creator never sees your data.
What you get
About this skill
The problem
Preparing for a SOC 2 audit is often a chaotic process of chasing missing evidence, misinterpreting Trust Services Criteria, and failing to distinguish between policy design and operating effectiveness. Startups frequently waste months on over-scoped controls or fail audits because they lack a clear evidence trail for their observation period.
What it does
- Identifies the correct Trust Services Criteria (Security, Availability, Confidentiality, Processing Integrity, Privacy) based on your service model and contracts.
- Performs gap analysis across infrastructure, HR, and software development lifecycle controls to pinpoint missing evidence.
- Generates structured evidence trackers that map specific controls to required logs, tickets, and screenshots for auditors.
- Drafts remediation roadmaps with clear ownership, due dates, and validation methods for Type I and Type II readiness.
- Produces executive-ready status reports highlighting audit risks, blockers, and resource needs.
Why this beats prompting it yourself
General AI often confuses SOC 2 with generic security advice or ISO 27001. This skill enforces the critical distinction between Type I design and Type II operating effectiveness, ensuring you don't mistake a written policy for the actual proof an auditor requires. It right-sizes control expectations for your specific company size and risk profile rather than suggesting bloated enterprise frameworks.
Use cases
- Perform a pre-audit gap assessment to determine if you are ready for a Type I engagement.
- Build a comprehensive evidence checklist for engineering and HR teams to prepare for a Type II observation period.
- Evaluate vendor risk and subservice organization impacts on your system boundary.
- Create a continuous compliance cadence to maintain audit readiness year-round.
Known limitations
Does not perform SOC 1 financial reporting audits or provide formal CPA opinions. It cannot execute technical penetration tests or infrastructure scans.
How to install
Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.
- 1
Download the ZIP
Free skills download straight away. Paid skills unlock right after purchase.
- 2
Unzip into your skills folder
Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.
- 3
Ask your agent to use it
Restart the agent if it was already running. It picks the skill up automatically - no config needed.
Skills folder by agent
Click the path to copy it. Create the folder if it does not exist yet.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
30-day refund
Not a fit? Get your money back
Trust & safety
Security scanned
Verified clean 1 month ago
- Passed all security checks, Safe to install