What it does. 'Automates SOC 2 Type II audit preparation including gap assessment against Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/performing-soc2-type2-audit-preparation/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-soc2-type2-audit-preparation, or copy the skill folder into ~/.claude/skills/performing-soc2-type2-audit-preparation/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-soc2-type2-audit-preparation/SKILL.md

SKILL.md (verbatim)

name: performing-soc2-type2-audit-preparation
description: 'Automates SOC 2 Type II audit preparation including gap assessment against
  AICPA Trust Services Criteria (CC1-CC9), evidence collection from cloud providers
  and identity systems, control testing validation, remediation tracking, and continuous
  compliance monitoring. Covers all five TSC categories (Security, Availability, Processing
  Integrity, Confidentiality, Privacy) with automated evidence gathering from AWS,
  Azure, GCP, Okta, GitHub, and Jira. Use when preparing for or maintaining SOC 2
  Type II certification.

  '
domain: cybersecurity
subdomain: governance-risk-compliance
tags:
- soc2
- compliance
- grc
- aicpa-tsc
- audit-preparation
- governance-risk-compliance
version: '1.0'
author: mukul975
license: Apache-2.0
nist_csf:
- GV.OC-01
- GV.RM-01
- GV.PO-01
- GV.OV-01
mitre_attack:
- T1078
- T1190
- T1059
- T1071
- T1095

Performing SOC 2 Type II Audit Preparation

When to Use

• When preparing for a SOC 2 Type II audit engagement with a CPA firm
• When conducting a gap assessment against AICPA Trust Services Criteria
• When automating evidence collection across cloud infrastructure and identity providers
• When validating that controls have operated effectively over the audit period (3-12 months)
• When building continuous compliance monitoring to maintain SOC 2 posture between audits
• When remediating control gaps identified during readiness assessment

Prerequisites

• Familiarity with AICPA Trust Services Criteria (CC1-CC9)
• Access to cloud provider APIs (AWS, Azure, or GCP) with read-only permissions
• Access to identity provider (Okta, Azure AD, Google Workspace)
• Access to version control system (GitHub, GitLab)
• Access to ticketing system (Jira, Linear, ServiceNow)
• Python 3.8+ with boto3, requests, pyyaml dependencies
• Appropriate authorization to collect compliance evidence

Instructions

1. Understand the Trust Services Criteria

SOC 2 is built on five Trust Services Categories defined by AICPA. Security (Common Criteria CC1-CC9) is mandatory; the others are selected based on business relevance:

Category	Criteria	Focus
Security (mandatory)	CC1-CC9	Control environment, risk, access, operations, change management
Availability	A1	System uptime and disaster recovery
Processing Integrity	PI1	Accurate and complete data processing
Confidentiality	C1	Protection of confidential information
Privacy	P1-P8	Personal information lifecycle

2. Common Criteria Breakdown (CC1-CC9)

CC1 - Control Environment: Board oversight, management structure, integrity and ethical values, HR policies, accountability.

CC2 - Communication and Information: Internal/external communication of security policies, system boundaries, roles, and responsibilities.

CC3 - Risk Assessment: Risk identification, fraud risk analysis, change impact assessment, risk tolerance definition.

CC4 - Monitoring Activities: Ongoing control evaluations, deficiency identification, remediation tracking, internal audit.

CC5 - Control Activities: Policy-to-procedure mapping, technology controls, deployment of controls across the entity.

CC6 - Logical and Physical Access Controls: Authentication, authorization, access provisioning/deprovisioning, physical security, encryption.

CC7 - System Operations: Anomaly detection, incident response, vulnerability management, change detection, event monitoring.

CC8 - Change Management: Change authorization, testing, approval workflows, emergency changes, rollback procedures.

CC9 - Risk Mitigation: Vendor risk management, business continuity, insurance, residual risk acceptance.

3. Conduct Gap Assessment

Before the audit period begins, perform a readiness assessment 8-12 weeks in advance:

# Define control matrix against CC criteria
gap_assessment = {
    "CC1": {
        "CC1.1": {
            "criteria": "COSO Principle 1: Demonstrates commitment to integrity",
            "control": "Code of conduct signed annually by all employees",
            "evidence": "Signed acknowledgments in HR system",
            "status": "implemented",
            "gap": None,
        },
        "CC1.2": {
            "criteria": "COSO Principle 2: Board exercises oversight",
            "control": "Quarterly board security reviews",
            "evidence": "Board meeting minutes with security agenda items",
            "status": "partial",
            "gap": "No documented security committee charter",
        },
    },
}

4. Automate Evidence Collection

Collect evidence continuously throughout the audit period from integrated systems:

import boto3

# CC6 Evidence: AWS IAM access controls
iam = boto3.client("iam")

# Collect MFA status for all IAM users
users = iam.list_users()["Users"]
mfa_evidence = []
for user in users:
    mfa_devices = iam.list_mfa_devices(UserName=user["UserName"])
    mfa_evidence.append({
        "user": user["UserName"],
        "mfa_enabled": len(mfa_devices["MFADevices"]) > 0,
        "created": user["CreateDate"].isoformat(),
    })

# CC7 Evidence: AWS CloudTrail logging status
cloudtrail = boto3.client("cloudtrail")
trails = cloudtrail.describe_trails()["trailList"]
logging_evidence = []
for trail in trails:
    status = cloudtrail.get_trail_status(Name=trail["TrailARN"])
    logging_evidence.append({
        "trail": trail["Name"],
        "is_logging": status["IsLogging"],
        "multi_region": trail.get("IsMultiRegionTrail", False),
        "log_validation": trail.get("LogFileValidationEnabled", False),
    })

5. Validate Control Effectiveness

For Type II audits, demonstrate controls operated effectively over the entire audit period:

import requests

# CC8 Evidence: Change management - verify all production changes
# had tickets, approvals, and testing before deployment
headers = {"Authorization": f"token {github_token}"}
prs = requests.get(
    "https://api.github.com/repos/org/repo/pulls",
    params={"state": "closed", "base": "main", "per_page": 100},
    headers=headers,
).json()

change_evidence = []
for pr in prs:
    if not pr.get("merged_at"):
        continue
    reviews = requests.get(pr["url"] + "/reviews", headers=headers).json()
    approved = any(r["state"] == "APPROVED" for r in reviews)
    change_evidence.append({
        "pr_number": pr["number"],
        "title": pr["title"],
        "merged_at": pr["merged_at"],
        "approved": approved,
    })

# Flag PRs merged without approval (control exception)
exceptions = [c for c in change_evidence if not c["approved"]]

6. Continuous Compliance Monitoring

Set up automated checks that run daily to detect control drift:

# Daily compliance check - run via cron or Lambda
checks = [
    {"control": "CC6.1", "check": "All IAM users have MFA enabled"},
    {"control": "CC6.6", "check": "No public S3 buckets"},
    {"control": "CC7.1", "check": "CloudTrail logging enabled"},
    {"control": "CC7.2", "check": "GuardDuty findings under threshold"},
    {"control": "CC8.1", "check": "All PRs have required reviews"},
]

for check in checks:
    result = run_compliance_check(check["control"])
    if not result["passing"]:
        send_alert(
            channel="#compliance",
            message=f"Control drift: {check['control']} - {check['check']}",
            details=result["findings"],
        )

7. Prepare Evidence Packages for Auditors

Organize collected evidence into structured packages per criteria:

evidence_package = {
    "audit_period": {"start": "2025-04-01", "end": "2026-03-31"},
    "criteria_packages": {
        "CC1_Control_Environment": {
            "CC1.1": ["signed_acknowledgments.csv"],
            "CC1.2": ["board_minutes_q1.pdf", "board_minutes_q2.pdf"],
        },
        "CC6_Logical_Physical_Access": {
            "CC6.1": ["okta_mfa_policy.json", "iam_users_mfa_status.csv"],
            "CC6.2": ["access_review_q1.csv", "access_review_q2.csv"],
            "CC6.3": ["offboarding_tickets.csv", "terminated_user_audit.csv"],
        },
        "CC7_System_Operations": {
            "CC7.1": ["cloudtrail_config.json", "siem_dashboard.png"],
            "CC7.2": ["guardduty_findings_summary.csv"],
            "CC7.3": ["vulnerability_scan_reports/"],
        },
        "CC8_Change_Management": {
            "CC8.1": ["merged_prs_with_approvals.csv"],
        },
    },
}

Examples

Automated Access Review for CC6.2

import boto3
from datetime import datetime, timedelta

iam = boto3.client("iam")

# Find users with no activity in 90 days
inactive_threshold = datetime.utcnow() - timedelta(days=90)
report = iam.get_credential_report()["Content"].decode()

inactive_users = []
for line in report.strip().split("\n")[1:]:
    fields = line.split(",")
    username = fields[0]
    last_used = fields[4]
    if last_used not in ("N/A", "no_information"):
        last_date = datetime.strptime(last_used, "%Y-%m-%dT%H:%M:%S+00:00")
        if last_date < inactive_threshold:
            inactive_users.append({"user": username, "last_active": last_used})

Vulnerability Management Evidence for CC7.2

import requests

headers = {"Authorization": f"Bearer {scanner_token}"}
scans = requests.get(
    "https://scanner.example.com/api/v1/scans",
    params={"status": "completed", "since": "2025-04-01"},
    headers=headers,
).json()

vuln_evidence = {"scan_count": len(scans), "critical_findings": 0, "high_findings": 0}
for scan in scans:
    findings = requests.get(
        f"https://scanner.example.com/api/v1/scans/{scan['id']}/findings",
        headers=headers,
    ).json()
    vuln_evidence["critical_findings"] += len([f for f in findings if f["severity"] == "critical"])
    vuln_evidence["high_findings"] += len([f for f in findings if f["severity"] == "high"])

Incident Response Evidence for CC7.3

incidents = requests.get(
    "https://pagerduty.com/api/v1/incidents",
    params={"since": "2025-04-01", "until": "2026-03-31"},
    headers={"Authorization": f"Token token={pd_token}"},
).json()

ir_evidence = {
    "total_incidents": len(incidents["incidents"]),
    "incidents": [
        {
            "id": inc["id"],
            "title": inc["title"],
            "severity": inc["urgency"],
            "created": inc["created_at"],
            "resolved": inc.get("last_status_change_at"),
        }
        for inc in incidents["incidents"]
    ],
}

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

SOC 2 Type II Audit Preparation Checklist

Organization Information

Field	Value
Organization Name
Audit Period Start
Audit Period End
Audit Firm
TSC Categories In Scope	Security / Availability / Processing Integrity / Confidentiality / Privacy
Preparation Lead
Assessment Date

---

Phase 1: Scoping

TSC Category Selection

• Security (Common Criteria) - Mandatory
• Availability - Include if uptime SLAs exist
• Processing Integrity - Include if data processing services provided
• Confidentiality - Include if confidential data handled
• Privacy - Include if personal information processed

System Boundaries

• In-scope services identified
• Infrastructure components documented (servers, databases, networks)
• Cloud services and regions listed
• Data flows mapped (input, processing, storage, output)
• Subservice organizations identified (e.g., AWS, Azure, GCP)
• Carve-out vs. inclusive method determined for subservice orgs
• Out-of-scope systems and justifications documented

Audit Firm Selection

• CPA firm selected with SOC 2 experience
• Engagement letter signed
• Audit timeline agreed upon
• Fee structure confirmed
• Point of contact established

---

Phase 2: Control Design

Control Matrix

• All applicable TSC criteria identified
• Existing controls inventoried and mapped to criteria
• Control gaps identified and new controls designed
• Each control has:
  • Unique control ID
  • Clear description of control activity
  • Mapped TSC criteria
  • Control type (Preventive/Detective/Corrective)
  • Frequency (Continuous/Daily/Weekly/Monthly/Quarterly/Annual)
  • Assigned owner
  • Defined evidence type
• Coverage verified: every TSC criterion mapped to at least one control

Key Controls by Series

CC1 - Control Environment

• Code of conduct/ethics policy published
• Board/management oversight documented
• Organizational chart with security roles
• Background check process for new hires
• Performance evaluation includes security responsibilities

CC2 - Communication and Information

• Security policies communicated to employees
• External security commitments documented (SLAs, contracts)
• Incident notification procedures defined

CC3 - Risk Assessment

• Annual risk assessment completed
• Risk register maintained
• Fraud risk assessment performed

CC4 - Monitoring Activities

• Internal control testing programme
• Control deficiency tracking and remediation

CC5 - Control Activities

• Information security policies approved and current
• Procedures documented for key processes

CC6 - Logical and Physical Access

• MFA enabled for all production and sensitive systems
• Role-based access control (RBAC) implemented
• Quarterly user access reviews performed
• Access provisioning/deprovisioning process documented
• Terminated user access removed within 24 hours
• Physical access restricted to authorized personnel
• Encryption at rest (AES-256) and in transit (TLS 1.2+)
• Endpoint protection deployed to all devices
• Firewall and network segmentation configured

CC7 - System Operations

• SIEM deployed with alerting rules
• 24/7 monitoring capability (or justified exception)
• Vulnerability scanning (weekly/monthly)
• Annual penetration testing by third party
• Incident response plan documented and tested
• Security event evaluation procedures

CC8 - Change Management

• Change management policy and process documented
• Changes require peer review and management approval
• Separation of duties between development and deployment
• Emergency change process defined

CC9 - Risk Mitigation

• Vendor management programme implemented
• Critical vendor SOC reports reviewed annually
• Vendor security assessments performed
• Insurance coverage evaluated

---

Phase 3: Evidence Collection

Evidence Repository

• Centralized evidence storage established
• Folder structure organized by TSC criterion
• Naming convention defined and communicated
• Evidence collection calendar created
• Owners assigned for each evidence type

Periodic Evidence Checklist

Monthly

• Security metrics report
• Incident summary report
• Change management summary
• Backup verification logs

Quarterly

• User access review completion (all systems)
• Risk register update
• Vendor review status
• Management/board security briefing

Annually

• Penetration test report
• Security awareness training records
• Business continuity/DR test results
• Policy review and approval records
• Risk assessment report
• Background check process verification

Evidence Quality Checks

• Evidence covers the complete audit period
• No gaps in periodic control evidence
• Screenshots include timestamps and system identification
• Reports are in PDF or export format (not editable)
• Approval chains clearly visible in tickets

---

Phase 4: Pre-Audit Readiness

Documentation

• System description document completed and reviewed
• Management assertion letter drafted
• Subservice organization disclosures accurate
• CUECs (Complementary User Entity Controls) documented
• CSOCs (Complementary Subservice Organization Controls) documented

Walkthrough Testing

• Sample of each control type tested internally
• Control operation verified against design
• Evidence adequacy confirmed
• Control owners can explain and demonstrate controls

Gap Remediation

• All identified gaps documented
• Remediation plans with owners and timelines
• Critical gaps resolved before audit starts
• Compensating controls documented where needed

Audit Team Preparation

• Control owners briefed on audit process
• Interview preparation materials distributed
• Evidence request list anticipated and pre-staged
• Auditor access to systems and tools arranged
• Communication channel with audit firm established

---

Phase 5: Audit Execution

Audit Support

• Kick-off meeting completed
• Information requests responded to within SLA
• Population lists provided (users, changes, incidents, vendors)
• Interviews scheduled and completed
• Exception responses prepared promptly

Post-Audit

• Draft report reviewed for factual accuracy
• Exception descriptions verified
• Management responses drafted for exceptions
• Final report received and distributed
• Remediation plan created for all exceptions
• Lessons learned documented
• Next audit cycle planning initiated

---

Summary Status

Phase	Status	Completion %	Notes
Scoping
Control Design
Evidence Collection
Pre-Audit Readiness
Audit Execution
Post-Audit

Exception Tracker

Exception #	Control ID	TSC Criteria	Description	Root Cause	Remediation	Owner	Due Date	Status

Sign-off

Role	Name	Signature	Date
SOC 2 Lead
CISO
CTO

references/api-reference.md (verbatim)

API Reference: SOC 2 Type II Audit Preparation

AICPA Trust Services Criteria (2017, updated 2022)

Five Trust Services Categories

Category	Required	Focus Area
Security (CC1-CC9)	Mandatory	Common criteria for all SOC 2 audits
Availability (A1)	Optional	System uptime, DR, capacity planning
Processing Integrity (PI1)	Optional	Data processing accuracy and completeness
Confidentiality (C1)	Optional	Confidential information protection
Privacy (P1-P8)	Optional	Personal information lifecycle

Common Criteria Detail

ID	Name	Key Controls
CC1	Control Environment	Ethics, board oversight, org structure, competence, accountability
CC2	Communication and Information	Internal/external communications, system boundaries
CC3	Risk Assessment	Risk identification, fraud risk, change impact analysis
CC4	Monitoring Activities	Control evaluations, deficiency identification
CC5	Control Activities	Policy implementation, technology controls
CC6	Logical and Physical Access	Auth, access provisioning, encryption, MFA
CC7	System Operations	Monitoring, anomaly detection, incident response, vuln management
CC8	Change Management	Change authorization, testing, approval, documentation
CC9	Risk Mitigation	Vendor management, business continuity, disaster recovery

AWS Evidence Collection APIs

IAM (CC6 - Access Controls)

import boto3

iam = boto3.client("iam")

# List all users
users = iam.list_users()

# Check MFA devices per user
mfa = iam.list_mfa_devices(UserName="username")

# Get password policy
policy = iam.get_account_password_policy()

# Generate credential report
iam.generate_credential_report()
report = iam.get_credential_report()

# List access keys and their last used dates
keys = iam.list_access_keys(UserName="username")
last_used = iam.get_access_key_last_used(AccessKeyId="AKIA...")

# List attached policies
policies = iam.list_attached_user_policies(UserName="username")

CloudTrail (CC7 - System Operations)

ct = boto3.client("cloudtrail")

# Describe all trails
trails = ct.describe_trails()

# Get trail logging status
status = ct.get_trail_status(Name="trail-arn")

# Lookup recent events
events = ct.lookup_events(
    LookupAttributes=[
        {"AttributeKey": "EventName", "AttributeValue": "ConsoleLogin"}
    ],
    StartTime=datetime(2025, 4, 1),
    EndTime=datetime(2026, 3, 31),
)

S3 (CC6 - Data Protection)

s3 = boto3.client("s3")

# List all buckets
buckets = s3.list_buckets()

# Check public access block
pab = s3.get_public_access_block(Bucket="bucket-name")

# Check encryption
enc = s3.get_bucket_encryption(Bucket="bucket-name")

# Check versioning
ver = s3.get_bucket_versioning(Bucket="bucket-name")

# Check logging
log = s3.get_bucket_logging(Bucket="bucket-name")

GuardDuty (CC7 - Anomaly Detection)

gd = boto3.client("guardduty")

# List detectors
detectors = gd.list_detectors()

# Get findings (high severity)
findings = gd.list_findings(
    DetectorId="detector-id",
    FindingCriteria={"Criterion": {"severity": {"Gte": 7}}}
)

# Get finding details
details = gd.get_findings(
    DetectorId="detector-id",
    FindingIds=findings["FindingIds"]
)

GitHub Evidence Collection APIs

Pull Request Evidence (CC8 - Change Management)

import requests

headers = {
    "Authorization": "token ghp_xxx",
    "Accept": "application/vnd.github.v3+json",
}

# List merged PRs
prs = requests.get(
    "https://api.github.com/repos/org/repo/pulls",
    params={"state": "closed", "base": "main", "per_page": 100},
    headers=headers,
)

# Get PR reviews
reviews = requests.get(
    "https://api.github.com/repos/org/repo/pulls/123/reviews",
    headers=headers,
)

# Get branch protection rules
protection = requests.get(
    "https://api.github.com/repos/org/repo/branches/main/protection",
    headers=headers,
)

Okta Evidence Collection APIs (CC6 - Identity)

headers = {
    "Authorization": "SSWS okta-api-token",
    "Accept": "application/json",
}

# List all users
users = requests.get("https://org.okta.com/api/v1/users", headers=headers)

# Get user MFA factors
factors = requests.get(
    "https://org.okta.com/api/v1/users/userId/factors",
    headers=headers,
)

# List authentication policies
policies = requests.get(
    "https://org.okta.com/api/v1/policies?type=ACCESS_POLICY",
    headers=headers,
)

# Get system log events
logs = requests.get(
    "https://org.okta.com/api/v1/logs",
    params={"since": "2025-04-01T00:00:00Z"},
    headers=headers,
)

Compliance Automation Platforms

Vanta API (GraphQL)

headers = {"Authorization": "Bearer vanta-token"}

query = """
{
  controls {
    id
    name
    status
    lastTestedAt
    evidence { id name collectedAt }
  }
}
"""
resp = requests.post(
    "https://api.vanta.com/graphql",
    json={"query": query},
    headers=headers,
)

Drata API (REST)

headers = {"Authorization": "Bearer drata-token"}

# List controls
controls = requests.get("https://public-api.drata.com/controls", headers=headers)

# Get control evidence
evidence = requests.get(
    "https://public-api.drata.com/controls/{controlId}/evidence",
    headers=headers,
)

# List monitors
monitors = requests.get("https://public-api.drata.com/monitors", headers=headers)

SOC 2 Type I vs Type II

Aspect	Type I	Type II
Scope	Point in time	Period of time (3-12 months)
Assessment	Controls designed properly	Controls operated effectively
Evidence	Current state docs	Historical evidence over period
Duration	1-2 months prep	3-12 month observation window
Cost	$20,000 - $50,000	$30,000 - $100,000+

Evidence Collection Frequency

Evidence Type	Frequency	Example
Automated scans	Daily/Continuous	IAM MFA status, S3 public access
Access reviews	Quarterly	User access certification
Vulnerability scans	Weekly/Monthly	Nessus, Qualys reports
Penetration tests	Annual	Third-party pentest report
Policy reviews	Annual	Security policy updates
Training records	Annual	Security awareness completion
Incident reports	Per-incident	IR documentation
Board minutes	Quarterly	Security committee meeting notes

References

• AICPA Trust Services Criteria: https://us.aicpa.org/interestareas/frc/assuranceadvisoryservices/trustservicescriteria
• SOC 2 Guide: https://soc2.fyi/
• Vanta SOC 2: https://www.vanta.com/collection/soc-2
• Drata Trust Services Criteria: https://drata.com/blog/trust-services-criteria
• Secureframe SOC 2 Checklist: https://secureframe.com/blog/soc-2-compliance-checklist
• SANS SOC 2 Trust Categories: https://www.sans.org/blog/soc-2-trust-services-categories
• Splunk SOC 2 Compliance: https://www.splunk.com/en_us/blog/learn/soc-2-compliance-checklist.html

references/standards.md (verbatim)

SOC 2 Type II Standards Reference

Primary Standards

AICPA Trust Services Criteria (TSC) 2017 (Revised 2022)

• Governing Body: American Institute of Certified Public Accountants (AICPA)
• Basis: Built on COSO 2013 Internal Control Framework
• Revision: Points of Focus updated in 2022 to address cloud, supply chain, and evolving technology risks
• Description Criteria: Updated July 2025

SSAE 18 (Statement on Standards for Attestation Engagements No. 18)

• Standard: AT-C Section 105, 205, and 320
• Purpose: Governs the attestation engagement performed by the CPA firm
• Effective: May 1, 2017 (replaced SSAE 16)

Trust Services Criteria Detail

Security (Common Criteria) - MANDATORY

CC1: Control Environment

• CC1.1: COSO Principle 1 - Demonstrates commitment to integrity and ethical values
• CC1.2: COSO Principle 2 - Board exercises oversight responsibility
• CC1.3: COSO Principle 3 - Management establishes structures, reporting lines, authorities
• CC1.4: COSO Principle 4 - Demonstrates commitment to attract, develop, retain competent individuals
• CC1.5: COSO Principle 5 - Holds individuals accountable for internal control responsibilities

CC2: Communication and Information

• CC2.1: COSO Principle 13 - Uses relevant, quality information to support internal control
• CC2.2: COSO Principle 14 - Internally communicates information supporting internal control
• CC2.3: COSO Principle 15 - Communicates with external parties regarding internal control

CC3: Risk Assessment

• CC3.1: COSO Principle 6 - Specifies objectives with sufficient clarity
• CC3.2: COSO Principle 7 - Identifies risks to achievement of objectives
• CC3.3: COSO Principle 8 - Considers potential for fraud
• CC3.4: COSO Principle 9 - Identifies and assesses changes that could impact internal control

CC4: Monitoring Activities

• CC4.1: COSO Principle 16 - Selects, develops, performs ongoing and separate evaluations
• CC4.2: COSO Principle 17 - Evaluates and communicates internal control deficiencies

CC5: Control Activities

• CC5.1: COSO Principle 10 - Selects and develops control activities
• CC5.2: COSO Principle 11 - Selects and develops general controls over technology
• CC5.3: COSO Principle 12 - Deploys through policies and procedures

CC6: Logical and Physical Access Controls

• CC6.1: Logical access security software, infrastructure, and architectures
• CC6.2: Prior to credential issuance, registration and authorization processes
• CC6.3: Access removal, modification upon changes to roles
• CC6.4: Physical access restrictions to facilities and protected information assets
• CC6.5: Changes in physical access restrictions are managed
• CC6.6: Logical access security measures against threats from external sources
• CC6.7: Restricts transmission, movement, and removal of information
• CC6.8: Controls against threats from deployment of unauthorized or malicious code

CC7: System Operations

• CC7.1: Detection and monitoring for anomalies and events
• CC7.2: Activities monitored against security event criteria
• CC7.3: Procedures exist to evaluate security events
• CC7.4: Response to identified security incidents
• CC7.5: Identification and remediation of identified vulnerabilities

CC8: Change Management

• CC8.1: Changes to infrastructure, data, software, and procedures are authorized, designed, developed, tested, approved, and implemented

CC9: Risk Mitigation

• CC9.1: Risk mitigation activities are considered through risk assessment
• CC9.2: Assesses and manages risks through vendor/business partner activities

Availability (Optional)

• A1.1: Performance and capacity maintenance
• A1.2: Environmental protections, software, data backup and recovery
• A1.3: Recovery plan testing

Processing Integrity (Optional)

• PI1.1: Obtains or generates, uses, and communicates relevant quality information
• PI1.2: System inputs are complete, accurate, and timely
• PI1.3: Processing is complete, valid, accurate, timely, and authorized
• PI1.4: System output is complete, valid, accurate, timely, and authorized
• PI1.5: Data stored is complete, valid, accurate, timely, and authorized

Confidentiality (Optional)

• C1.1: Identifies and maintains confidential information
• C1.2: Disposes of confidential information

Privacy (Optional)

• P1.0-P8.0: Covers notice, choice, collection, use, retention, disclosure, access, quality, and monitoring/enforcement

SOC 2 Report Structure

Section I: Independent Service Auditor's Report

• Auditor opinion on control design and operating effectiveness
• Scope of examination and applicable criteria

Section II: Management's Assertion

• Management's representation regarding system description and control effectiveness

Section III: Description of the System

• Nature of services, principal service commitments, system requirements
• Components: infrastructure, software, people, procedures, data
• Boundaries and subservice organizations

Section IV: Description of Criteria, Controls, Tests, and Results

• Each TSC criterion with mapped controls
• Test procedures performed by auditor
• Results of testing (no exceptions / exception noted)

Section V: Other Information (Optional)

• Complementary User Entity Controls (CUECs)
• Complementary Subservice Organization Controls (CSOCs)

Related Standards

• SOC 1 (SSAE 18/ISAE 3402): Financial reporting controls
• SOC 3 (Trust Services Criteria): Public-facing summary report
• ISO 27001: Information Security Management System
• NIST CSF: Cybersecurity Framework (mappings available)

references/workflows.md (verbatim)

SOC 2 Type II Audit Preparation Workflows

Workflow 1: Scoping and TSC Selection

Start
  |
  v
[Analyze Customer Requirements]
  - Review customer security questionnaires
  - Identify frequently requested TSC categories
  - Review contractual obligations
  |
  v
[Define System Boundaries]
  - Identify in-scope services and applications
  - Map infrastructure components
  - Identify data flows and storage locations
  - Determine subservice organizations (e.g., AWS, Azure)
  |
  v
[Select TSC Categories]
  - Security (CC) - Always included
  |
  +--> [SaaS with uptime SLAs?] --> Include Availability (A)
  |
  +--> [Process financial/sensitive data?] --> Include Processing Integrity (PI)
  |
  +--> [Handle confidential customer data?] --> Include Confidentiality (C)
  |
  +--> [Collect/process personal data?] --> Include Privacy (P)
  |
  v
[Document Scope and Boundaries]
  |
  v
[Select Audit Firm]
  - Verify CPA firm qualifications
  - Confirm experience with your industry
  - Agree on audit timeline and fees
  |
  v
End

Workflow 2: Control Design and Mapping

Start
  |
  v
[Review TSC Requirements]
  - Identify all applicable criteria and points of focus
  |
  v
[Map Existing Controls to TSC]
  - Inventory current security controls
  - Map each control to TSC criteria
  - Identify coverage gaps
  |
  v
[Design New Controls for Gaps]
  - Define control objective
  - Define control activity
  - Set control frequency
  - Assign control owner
  - Define evidence requirements
  |
  v
[Classify Control Types]
  |
  +--> Preventive: Stops events before they occur
  |     (e.g., MFA, firewall rules, access reviews)
  |
  +--> Detective: Identifies events after they occur
  |     (e.g., SIEM alerts, audit logs, vulnerability scans)
  |
  +--> Corrective: Remedies events after detection
        (e.g., incident response, patching, access revocation)
  |
  v
[Document Control Matrix]
  - TSC Criterion -> Control ID -> Description -> Type ->
    Frequency -> Owner -> Evidence -> Test Procedure
  |
  v
[Implement Controls]
  |
  v
[Validate Control Operation]
  |
  v
End

Workflow 3: Evidence Collection Process

Start
  |
  v
[Establish Evidence Repository]
  - Create structured folder hierarchy by TSC category
  - Set naming conventions (YYYY-MM_CC6.1_AccessReview)
  - Assign evidence collection responsibilities
  |
  v
[Continuous Controls (Daily/Real-time)]
  - SIEM log collection and alerting
  - Intrusion detection monitoring
  - Endpoint protection status
  - Encryption enforcement
  |
  v
[Periodic Controls]
  |
  +--> Weekly:
  |     - Vulnerability scan reports
  |     - Backup verification
  |
  +--> Monthly:
  |     - Security metric reports
  |     - Incident summary
  |     - Change management review
  |
  +--> Quarterly:
  |     - User access reviews (CC6.3)
  |     - Risk assessment updates (CC3.2)
  |     - Vendor security reviews (CC9.2)
  |     - Board/management reporting (CC1.2)
  |
  +--> Annually:
        - Penetration testing (CC7.1)
        - Security awareness training (CC1.4)
        - Business continuity testing (A1.3)
        - Policy reviews and updates (CC5.3)
        - Risk assessment (CC3.1)
  |
  v
[Organize and Label Evidence]
  - Screenshot with timestamps
  - Export system reports to PDF
  - Preserve ticket/approval chains
  - Document manual control execution
  |
  v
[Quality Check Evidence]
  - Verify coverage for entire audit period
  - Confirm no gaps in periodic controls
  - Validate evidence matches control description
  |
  v
End

Workflow 4: Readiness Assessment

Start
  |
  v
[Perform Walkthrough Testing]
  - Select sample of each control type
  - Trace control from input to evidence
  - Verify control operates as designed
  |
  v
[Identify Gaps and Exceptions]
  |
  +--> [Control Not Operating?]
  |     - Document exception
  |     - Implement remediation
  |     - Restart evidence collection
  |
  +--> [Evidence Missing?]
  |     - Locate alternative evidence
  |     - Implement improved capture
  |
  +--> [Control Design Insufficient?]
        - Redesign control
        - Implement and begin new evidence period
  |
  v
[Prepare System Description]
  - Overview of organization
  - Principal service commitments
  - System components description
  - Subservice organization relationships
  - CUECs and CSOCs
  |
  v
[Prepare Management Assertion]
  - Confirm system description is fairly presented
  - Assert controls were suitably designed
  - Assert controls operated effectively
  |
  v
[Brief Control Owners]
  - Explain audit process
  - Review evidence expectations
  - Prepare for auditor interviews
  |
  v
End

Workflow 5: Audit Execution Support

Start
  |
  v
[Kick-off Meeting with Auditor]
  - Confirm scope and timeline
  - Provide system description
  - Share evidence repository access
  - Establish communication cadence
  |
  v
[Respond to Information Requests]
  - Provide requested populations (user lists, change tickets, etc.)
  - Facilitate system access for auditor testing
  - Schedule interviews with control owners
  |
  v
[Auditor Performs Testing]
  - Inquiry (interviews with control owners)
  - Observation (watch control operation)
  - Inspection (review evidence documents)
  - Reperformance (re-execute control steps)
  |
  v
[Address Exceptions]
  |
  +--> [Exception Found]
  |     - Investigate root cause
  |     - Determine if compensating controls exist
  |     - Provide additional context to auditor
  |     - Document remediation plan
  |
  +--> [No Exceptions] --> Continue
  |
  v
[Review Draft Report]
  - Check system description accuracy
  - Verify control descriptions
  - Review exception descriptions
  - Confirm factual accuracy
  |
  v
[Receive Final Report]
  |
  v
[Plan Remediation for Exceptions]
  |
  v
End

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.