SOC 2 Type II Forcing Questions
This skill runs a six-question forcing interrogation for SOC 2 Type II readiness, focused on the observation period. It produces a structured readiness report with verdict and top actions.
✨ What it does
- Checks TSC scope and AT-C 205 description completeness
- Verifies controls operated consistently without skipped cycles
- Reviews change-management evidence for mid-period control changes
- Assesses exception log and materiality against audit firm tolerance
- Evaluates sample evidence coverage from the first month of observation
- Cross-walks to ISO 27001 for evidence reuse
🎯 When to use it
- Before a Type II observation period begins (months 1-2)
- At a mid-observation checkpoint (month 6)
- Pre-field-test readiness review (month 10)
- After a scope change or major incident during observation
🚀 How to use
Trigger: /cs:soc2-audit-prep
Trigger with the slash command /cs:soc2-audit-prep <scope> where describes the system or service under audit. The skill expects you to provide scope and answer the six forcing questions, optionally using the referenced scripts for gap analysis, control matrix, evidence tracking, and mock audit. Example prompts:
/cs:soc2-audit-prep my-saas-platform
Run SOC 2 Type II prep for our cloud service, including Availability and Confidentiality.
📄 Output: A markdown report with TSC scope, observation period status, exception log, sample evidence coverage, ISO 27001 cross-walk reuse, audit firm readiness, verdict, and top 3 actions.
📦 Add this skill to Claude Code
# 1. Get the skills repo
git clone --depth 1 https://github.com/alirezarezvani/claude-skills /tmp/claude-skills
# 2. Copy this skill into your project (or ~/.claude/skills for all projects)
mkdir -p .claude/skills
cp -r /tmp/claude-skills/compliance-os/skills/soc2-audit-prep .claude/skills/soc2-audit-prepSkill source: compliance-os/skills/soc2-audit-prep/SKILL.md
⚠️ Good to know
Requires access to the referenced scripts and evidence logs; assumes the user can answer the six questions with accurate data.
❓ FAQ
What is the audit firm tolerance for exceptions per control?
Typically 1-2 exceptions per control are acceptable; 3 or more is considered a finding.
Why is evidence from the first month of observation important?
Front-loaded evidence demonstrates operational discipline, while back-loaded evidence (last 30 days) signals scrambling.
How much control overlap exists with ISO 27001?
There is approximately 75% control overlap, and the skill recommends reusing shared artefacts to avoid duplicate evidence collection.
🤖 Overview, features, install steps and FAQ were generated from the project's SKILL.md on Sep 4, 2026. Always check the original source before running commands.