Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIDeepSeekDeepSeekMuseMuse+22 more

    SOC2 ISO27001 Readiness Evidence Kit

    1

    Prepare for SOC 2 and ISO 27001 audits with gap assessments, evidence request lists, and artifact quality reviews.

    $20

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    SOC2 ISO27001 Readiness Evidence Kit

    SOC2 ISO27001 Readiness Evidence Kit

    Example session with this skill installed

    We are a 50-person SaaS company on AWS/Okta. We need a gap assessment for SOC 2 (Security and Availability) and ISO 27001:2022. Give me a P1 remediation list and the first 5 evidence requests.

    • Read your context and instructions
    • Compiled the soc2 iso27001 readiness

    I have initiated the gap assessment based on a 50-person SaaS profile using AWS and Okta. Below are the high-priority remediation items and the initial Evidence Request List (PBC) for your SOC 2 and ISO 27001:2022 readiness.

    Audit Readiness Summary

    Frameworks: SOC 2 (Security, Availability) & ISO 27001:2022
    Top Risks: Missing quarterly access reviews, undocumented change management for infrastructure-as-code.

    P1 Remediation Roadmap

    IDRequirementGapPriorityAction Item
    REM-01CC6.1 / A.5.15No formal quarterly access review process.P1Establish a recurring schedule to review Okta and AWS IAM permissions.
    REM-02CC8.1 / A.8.32Pull requests lack consistent peer approval evidence.P1Enforce branch protection rules in GitHub requiring at least one reviewer.
    REM-03Clause 9.2No internal audit performed in the last 12 months.P1Schedule an internal audit of the ISMS to meet ISO mandatory requirements.

    Initial Evidence Request List (PBC)

    PBC IDFramework MapItem DescriptionSource SystemFormat
    E001CC6.3 / A.5.18List of all users offboarded in the last 6 months.HRIS / OktaCSV/XLS
    E002CC6.7 / A.8.15Screenshots of MFA enforcement configuration for all admins.Okta / AWSPDF/PNG
    E003CC7.1 / A.8.8Most recent external penetration test report and retest.Third-party vendorPDF
    E004A.5.1Information Security Policy set (approved/dated).Google Drive / VantaPDF
    E005CC9.2 / A.5.21Inventory of critical vendors and SOC 2 reports for AWS.ProcurementPDF/XLS

    Next steps

    1. Review the access control gap (REM-01) and schedule the first user access review for this month.
    2. Upload the Information Security Policy set for a quality review against the ISO 27001:2022 mandatory list.
    3. Confirm the observation window start date for your SOC 2 Type II audit.

    Readiness guidance only. Not legal advice, not an audit opinion or certification. Final criteria interpretation rests with your auditor / certification body.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Preparing for a SOC 2 or ISO 27001 audit often involves chaotic evidence collection and late-stage gap discovery. This skill provides a structured framework to manage audit readiness, ensuring your controls and evidence meet auditor expectations before the official examination begins.

    What it does

    • Scope definition identifies in-scope systems, data, and subservice organizations for SOC 2 (Trust Services Criteria) or ISO 27001:2022.
    • Control gap assessment maps existing processes against the AICPA TSC or ISO Annex A to identify P1 audit-blocking gaps.
    • Evidence request list (PBC) generates a stack-specific list of required artifacts, including source systems and acceptable formats.
    • Evidence quality review audits your provided artifacts for completeness, timeliness, and authenticity to preempt auditor follow-up questions.
    • Policy coverage check evaluates your documentation library against mandatory requirements and highlights missing or outdated policies.

    How it works

    1. Intake provides the framework, audit window, and technology stack (cloud, IDP, HRIS) to the agent.
    2. Gap Analysis executes the Mode 2 command to receive a prioritized remediation roadmap based on the current state.
    3. PBC Generation runs Mode 3 to produce a tailored evidence tracker in Markdown or CSV format.
    4. Validation submits redacted evidence samples for a quality check against standard audit criteria.

    Frameworks & tools

    This skill supports SOC 2 (2017 TSC with 2022 points of focus) and ISO/IEC 27001:2022 (including the 2024 climate change amendment). It tailors evidence requests for modern stacks involving AWS/Azure/GCP, Okta, GitHub, and common HRIS/ticketing platforms.

    Why this beats prompting it yourself

    Generic prompts often miss the specific evidence requirements for SOC 2 Type II windows or the mandatory documented information required for ISO 27001 certification. This skill enforces strict evidence quality rules and uses a pre-built crosswalk to reduce work for dual-framework audits.

    Use cases

    • Prepare for a first-time SOC 2 Type I or Type II examination.
    • Transition an existing ISO 27001:2013 management system to the 2022 standard.
    • Build a remediation roadmap to close security gaps before a certification audit.
    • Perform a dry-run review of evidence artifacts to ensure they are audit-ready.

    Known limitations

    Does not provide legal advice, formal audit opinions, or certifications. Users must redact sensitive data from evidence before submission. Final criteria interpretation rests with the auditor.

    Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for Security.

    Cannot issue audit opinions or certifications. Requires manual redaction of PII/secrets. Users must verify current standards with their specific auditor.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before buying a skill.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 1 month ago

    Permissions

    No special permissions declared or detected

    Listed1 month ago

    What's inside

    Frequently Asked Questions

    This skill streamlines audit preparation by mapping your specific tech stack to SOC 2 and ISO 27001 requirements, identifying gaps in your controls, and validating that your evidence artifacts meet auditor standards before the official examination.

    Yes, the skill includes a pre-built crosswalk that identifies overlapping requirements between SOC 2 and ISO 27001, allowing you to collect evidence once for both frameworks and avoid redundant work.

    The kit includes the structured audit framework, automated gap assessment logic, a tailored evidence request list (PBC) generator, and an artifact quality review module compatible with major AI agents.

    For security and privacy, you should provide only redacted or anonymized evidence samples; the skill is designed to evaluate the structure and metadata of artifacts rather than sensitive raw data.

    The skill is updated quarterly to reflect changes in AICPA Trust Services Criteria points of focus and ISO/IEC updates, including the recent 2024 climate change amendments.

    While it provides a rigorous dry-run and quality check, this tool is for readiness only; formal certifications and audit opinions must still be issued by an accredited CPA firm or ISO certification body.

    New in Security