Master SOC 2 Compliance Audits

Provides expert guidance for SOC 2 compliance across the AICPA Trust Service Criteria - readiness assessment, control implementation, evidence collection, continuous monitoring, and audit finding remediation.

Use this skill when preparing for a SOC 2 audit, mapping existing controls to Trust Service Criteria, documenting control testing evidence, building a compliance monitoring dashboard, or responding to audit findings. Not a fit for other compliance frameworks (ISO 27001, HIPAA) without SOC 2 overlap, or for organizations not pursuing a formal SOC 2 report.

Defines the nine required Common Criteria (Security) categories - CC1.0 Control Environment through CC9.0 Risk Mitigation - covering governance, communication, risk assessment, monitoring, control activities, access management, system operations, change management, and vendor/data-disposal risk. Also covers the four optional Trust Service Criteria: Availability (A1.0), Processing Integrity (PI1.0), Confidentiality (C1.0), and Privacy (P1.0).

Provides a pre-audit readiness checklist spanning scoping/planning (defining system boundaries, selecting applicable TSCs, choosing an audit firm, forming a compliance team) and gap analysis (mapping existing controls to TSC requirements, prioritizing remediation by risk). Control implementation examples include a YAML identity and access management policy (MFA requirement, password complexity/rotation, account lockout thresholds, least-privilege authorization, quarterly access reviews) for CC6.1, and a four-stage change management procedure (request submission, approval workflow with CAB sign-off for high-risk changes, staged test-to-production implementation, post-implementation review) for CC8.1.

Evidence collection guidance includes a JSON control testing documentation schema (control ID, description, testing procedures, sample size, testing method, evidence types, frequency, responsible party, retention period). Continuous monitoring guidance provides a Python metrics dictionary defining KPI thresholds across security (failed login attempts, patch compliance, vulnerability remediation days, access review completion), availability (system uptime, incident response time, backup success rate), and processing integrity (data processing error rate, transaction completeness).

Common audit findings and remediation cover incomplete documentation (document management system with regular reviews), inconsistent control operation (enhanced training, automated controls), inadequate monitoring (SIEM deployment, 24/7 monitoring), and vendor management gaps (third-party risk management program) - alongside a management response template capturing root cause, remediation plan, responsible party, target date, and evidence of remediation.

Best practices recommend starting compliance efforts 6-12 months before the target report date, automating controls to reduce human error, providing ongoing SOC 2 awareness training, treating SOC 2 as a continuous program rather than a one-time project, securing executive sponsorship, and integrating controls with existing business processes.

References SIEM tooling for continuous monitoring and a configuration management database (CMDB) for change tracking, structured around the AICPA Trust Service Criteria framework.

Compliance officers and security engineers preparing for or maintaining SOC 2 certification who need concrete control implementation examples, evidence documentation formats, and audit remediation templates rather than a high-level compliance overview.

Access_Control_Policy:
  authentication:
    - multi_factor_authentication: required
    - password_policy:
        min_length: 12