soc2-audit-helper

name: assisting-with-soc2-audit-preparation description: | Automate SOC 2 audit preparation including evidence gathering, control assessment, and compliance gap identification. Use when you need to prepare for SOC 2 audits, assess Trust Service Criteria compliance, document security controls, or generate readiness reports. Trigger with phrases like "SOC 2 audit preparation", "SOC 2 readiness assessment", "collect SOC 2 evidence", or "Trust Service Criteria compliance". allowed-tools:

• Read
• Write
• Edit
• Grep
• Glob
• Bash(audit-collect:, compliance-check:) version: 1.0.0 license: MIT

Prerequisites

Before using this skill, ensure:

• Documentation directory accessible in {baseDir}/docs/
• Infrastructure-as-code and configuration files available
• Access to cloud provider logs (AWS CloudTrail, Azure Activity Log, GCP Audit Logs)
• Security policies and procedures documented
• Employee training records available
• Incident response documentation accessible
• Write permissions for audit reports in {baseDir}/soc2-audit/

Instructions

1. Trust Service Criteria Assessment

Evaluate controls across five categories:

Security (Common Criteria) - Required for all SOC 2 audits:

• CC1: Control Environment
• CC2: Communication and Information
• CC3: Risk Assessment
• CC4: Monitoring Activities
• CC5: Control Activities
• CC6: Logical and Physical Access Controls
• CC7: System Operations
• CC8: Change Management
• CC9: Risk Mitigation

Additional Criteria (Optional):

• Availability
• Processing Integrity
• Confidentiality
• Privacy

2. Evidence Collection Phase

Security Controls Evidence:

• Access control policies and configurations
• Multi-factor authentication implementation
• Password policy documentation
• Firewall rules and network segmentation
• Encryption at rest and in transit
• Security monitoring and alerting configs

Operational Evidence:

• Change management logs
• Backup and recovery procedures
• Disaster recovery testing results
• System monitoring dashboards
• Capacity planning documentation
• Performance metrics

Policy and Procedure Evidence:

• Information security policy
• Incident response plan
• Business continuity plan
• Vendor management procedures
• Employee onboarding/offboarding
• Security awareness training records

System Evidence:

• System architecture diagrams
• Data flow diagrams
• Asset inventory
• Software bill of materials (SBOM)
• Configuration management database

3. Control Effectiveness Testing

For each control point:

• Verify control design (is it properly designed?)
• Test operating effectiveness (is it working as intended?)
• Document test results with screenshots/logs
• Identify gaps or weaknesses
• Recommend remediation actions

4. Compliance Gap Analysis

Compare current state against SOC 2 requirements:

• Missing controls (critical gaps)
• Partially implemented controls (needs improvement)
• Improperly documented controls (evidence gaps)
• Ineffective controls (design or operating failures)

5. Evidence Documentation

Organize evidence by Trust Service Criteria:

{baseDir}/soc2-audit/
├── CC1-control-environment/
│   ├── org-chart.pdf
│   ├── security-policy.md
│   └── training-records.xlsx
├── CC6-access-controls/
│   ├── iam-policies.json
│   ├── mfa-config.yaml
│   └── access-review-logs.csv
├── CC7-system-operations/
│   ├── monitoring-configs/
│   ├── backup-procedures.md
│   └── incident-logs/
└── readiness-report.md

6. Generate Readiness Report

Create comprehensive SOC 2 readiness assessment with:

• Executive summary with readiness score
• Control-by-control assessment
• Gap analysis with severity ratings
• Remediation roadmap with timelines
• Evidence collection checklist
• Auditor interview preparation guide

Output

The skill produces:

Primary Output: SOC 2 readiness report saved to {baseDir}/soc2-audit/readiness-report-YYYYMMDD.md

Report Structure:

# SOC 2 Readiness Assessment
Assessment Date: 2024-01-15
Organization: TechCorp Inc.
Audit Type: SOC 2 Type II (Security + Availability)

## Executive Summary
- Overall Readiness: 75% (Needs Improvement)
- Controls Implemented: 28/40 (70%)
- Critical Gaps: 3
- High Priority Items: 8
- Estimated Remediation Time: 8-12 weeks

## Readiness by Trust Service Category

### CC1: Control Environment (80%)
✅ Implemented (4):
- Organizational structure documented
- Security policy established
- Risk assessment framework in place
- Board oversight of security

⚠️ Gaps (1):
- Security role and responsibility matrix incomplete

### CC6: Logical and Physical Access Controls (60%)
✅ Implemented (5):
- Multi-factor authentication enabled
- Role-based access control (RBAC) implemented
- Password policy enforced
- Access review process established
- Visitor access controls in place

❌ Critical Gaps (2):
- No automated user deprovisioning
- Privileged access not logged/monitored

⚠️ High Priority (3):
- Access logs retention < 1 year
- No formal access request workflow
- Physical security cameras not monitored 24/7

### CC7: System Operations (70%)
[Similar breakdown...]

## Critical Gaps Requiring Immediate Action

### 1. Automated User Deprovisioning (CC6.2)
**Current State**: Manual offboarding process
**Risk**: Terminated employees retain system access
**Evidence**: {baseDir}/hr/offboarding-checklist.pdf
**Remediation**:
- Implement automated deprovisioning tied to HR system
- Set up alerts for access not removed within 24 hours
- Estimated effort: 2-3 weeks
**Priority**: CRITICAL

### 2. Privileged Access Monitoring (CC6.7)
**Current State**: No logging of admin actions
**Risk**: Insider threats undetected
**Remediation**:
- Enable audit logging for all admin accounts
- Set up SIEM alerts for privileged actions
- Implement session recording for production access
**Priority**: CRITICAL

### 3. Disaster Recovery Testing (CC7.4)
**Current State**: DR plan exists but never tested
**Risk**: Recovery time objectives may not be achievable
**Remediation**:
- Schedule quarterly DR tests
- Document test results
- Update plan based on test findings
**Priority**: CRITICAL

## Evidence Collection Status

| Control | Evidence Type | Status | Location |
|---------|--------------|--------|----------|
| CC1.1 | Org Chart | ✅ Complete | {baseDir}/soc2-audit/CC1/ |
| CC6.1 | MFA Config | ✅ Complete | {baseDir}/soc2-audit/CC6/ |
| CC6.2 | Offboarding Logs | ❌ Missing | N/A |
| CC7.1 | Monitoring Dashboards | ⚠️ Partial | Need 90-day history |

## Remediation Roadmap

**Weeks 1-2 (Critical Fixes)**:
- Implement automated deprovisioning
- Enable privileged access monitoring
- Begin DR test planning

**Weeks 3-6 (High Priority)**:
- Extend log retention to 1 year
- Implement access request workflow
- Complete initial DR test

**Weeks 7-12 (Medium Priority)**:
- Enhance physical security monitoring
- Improve change management documentation
- Complete second DR test cycle

## Auditor Preparation

**Key Interview Topics**:
- Control environment and tone from the top
- Incident response capabilities
- Change management process
- Access control procedures
- Monitoring and alerting effectiveness

**Suggested Interviewees**:
- CTO/CISO (control environment)
- Security Engineer (technical controls)
- HR Manager (employee lifecycle)
- Operations Lead (monitoring, DR)

## Next Steps

1. Review and approve remediation roadmap
2. Assign owners to each gap remediation
3. Begin evidence collection for completed controls
4. Schedule monthly progress reviews
5. Engage SOC 2 auditor for scoping discussion

Secondary Outputs:

• Evidence collection checklist (Excel/CSV)
• Control testing templates
• Auditor questionnaire responses
• Gap tracking dashboard (JSON for dashboarding tools)

Error Handling

Common Issues and Resolutions:

1. Missing Evidence Files

   • Error: "Cannot locate security policy in {baseDir}/docs/"
   • Resolution: Request document locations from user
   • Fallback: Mark as evidence gap in report

2. Incomplete Access Logs

   • Error: "Log retention < SOC 2 requirement (1 year)"
   • Resolution: Note current retention period, flag as gap
   • Remediation: Extend retention, backfill if possible

3. Undocumented Procedures

   • Error: "No incident response playbook found"
   • Resolution: Flag as critical gap requiring documentation
   • Assistance: Provide template for creating procedure

4. Cloud Provider Access Required

   • Error: "Cannot assess AWS controls without API access"
   • Resolution: Request CloudTrail exports or console screenshots
   • Alternative: Provide manual checklist for cloud controls

5. Multiple Environments Not Distinguished

   • Error: "Production and dev configs mixed in {baseDir}/"
   • Resolution: Request environment separation or clear labeling
   • Risk: May audit wrong environment

Resources

SOC 2 Framework References:

• AICPA Trust Service Criteria: https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/trustdataintegritytaskforce.html
• SOC 2 Compliance Checklist: https://secureframe.com/hub/soc-2/checklist

Control Implementation Guides:

• CIS Controls: https://www.cisecurity.org/controls/
• NIST Cybersecurity Framework: https://www.nist.gov/cyberframework

Compliance Automation Tools:

• Drata: SOC 2 compliance automation
• Vanta: Continuous compliance monitoring
• Secureframe: Evidence collection platform

Template Documents:

• Information Security Policy: {baseDir}/templates/security-policy-template.md
• Incident Response Plan: {baseDir}/templates/incident-response-template.md
• Risk Assessment Template: {baseDir}/templates/risk-assessment-template.xlsx

Auditor Resources:

• Find SOC 2 auditors: https://www.aicpa.org/
• SOC 2 vs ISO 27001 comparison
• Type I vs Type II audit differences

Evidence Examples:

• Sample SOC 2 control matrix
• Evidence collection best practices
• Auditor interview preparation guide