SOC 2 Compliance
SOC 2 Compliance is a skill that guides users through preparing for SOC 2 Type I and Type II audits. It covers Trust Service Criteria mapping, control matrix generation, gap analysis, evidence collection, and audit readiness assessment for SaaS companies.
✨ What it does
- Explains SOC 2 Type I vs Type II differences and typical journey.
- Maps all five Trust Service Criteria (Security, Availability, Confidentiality, Processing Integrity, Privacy) with key c
- Provides a structured control matrix generation workflow with naming conventions.
- Outlines a four-phase gap analysis workflow with remediation planning.
- Lists evidence types by control category and automation opportunities.
- Includes an audit readiness checklist with scoring and common findings.
🎯 When to use it
- When preparing for a SOC 2 audit or assessing readiness.
- When mapping Trust Service Criteria to existing controls.
- When building a control matrix or collecting audit evidence.
- When performing a gap analysis to identify missing or weak controls.
- When deciding between SOC 2 Type I and Type II audits.
🚀 How to use
Trigger the skill by asking to prepare for SOC 2 audits, map Trust Service Criteria, build control matrices, collect evidence, or perform gap analysis. The skill expects inputs like your current controls, policies, and audit scope. Example prompts:
Help me prepare for a SOC 2 Type II audit.
Map our existing security controls to the SOC 2 Trust Service Criteria.
📄 Output: Guidance, checklists, and structured workflows for SOC 2 compliance preparation.
📦 Add this skill to Claude Code
# 1. Get the skills repo
git clone --depth 1 https://github.com/alirezarezvani/claude-skills /tmp/claude-skills
# 2. Copy this skill into your project (or ~/.claude/skills for all projects)
mkdir -p .claude/skills
cp -r /tmp/claude-skills/ra-qm-team/skills/soc2-compliance .claude/skills/soc2-complianceSkill source: ra-qm-team/skills/soc2-compliance/SKILL.md
⚠️ Good to know
The skill provides guidance and templates but does not replace an actual auditor or legal advice; it assumes the user has basic knowledge of their own systems and policies.
❓ FAQ
What is the difference between SOC 2 Type I and Type II?
Type I assesses the design of controls at a point in time, while Type II assesses design and operating effectiveness over a period (typically 6-12 months).
Which Trust Service Criteria are required for SOC 2?
Security (Common Criteria CC1-CC9) is required for every SOC 2 report; the other four (Availability, Confidentiality, Processing Integrity, Privacy) are optional based on business needs.
How do I generate a control matrix?
Use the workflow: select applicable TSC categories, run control_matrix_builder.py to generate a baseline, customize controls, assign owners and evidence, and validate coverage.
🤖 Overview, features, install steps and FAQ were generated from the project's SKILL.md on Sep 4, 2026. Always check the original source before running commands.