Trust Center Builder
GRCEngClub/claude-grc-engineering
Builds and deploys a serverless trust center that publishes a company's compliance posture, with gated access to audit reports and an admin dashboard.
SOC 2 Type I and Type II compliance management against the Trust Services Criteria.
Install Soc2 Compliance Expert
$ npx skills add borghei/Claude-Skills --skill soc2-compliance-expert -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install borghei/Claude-Skills soc2-compliance-expert --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/borghei/Claude-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/ra-qm-team/soc2-compliance-expert .claude/skills/soc2-compliance-expert && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "soc2-compliance-expert" agent skill from https://github.com/borghei/Claude-Skills/tree/main/ra-qm-team/soc2-compliance-expert into .claude/skills/soc2-compliance-expert/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "soc2-compliance-expert", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/borghei/Claude-Skills/tree/main/ra-qm-team/soc2-compliance-expertType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add borghei/Claude-Skills --skill soc2-compliance-expert -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install borghei/Claude-Skills soc2-compliance-expert --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/borghei/Claude-Skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/ra-qm-team/soc2-compliance-expert .agents/skills/soc2-compliance-expert && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "soc2-compliance-expert" agent skill from https://github.com/borghei/Claude-Skills/tree/main/ra-qm-team/soc2-compliance-expert into .agents/skills/soc2-compliance-expert/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "soc2-compliance-expert", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add borghei/Claude-Skills --skill soc2-compliance-expert -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install borghei/Claude-Skills soc2-compliance-expert --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/borghei/Claude-Skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/ra-qm-team/soc2-compliance-expert .cursor/skills/soc2-compliance-expert && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "soc2-compliance-expert" agent skill from https://github.com/borghei/Claude-Skills/tree/main/ra-qm-team/soc2-compliance-expert into .cursor/skills/soc2-compliance-expert/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "soc2-compliance-expert", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/borghei/Claude-Skills.git --path ra-qm-team/soc2-compliance-expert--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add borghei/Claude-Skills --skill soc2-compliance-expert -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install borghei/Claude-Skills soc2-compliance-expert --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/borghei/Claude-Skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/ra-qm-team/soc2-compliance-expert .gemini/skills/soc2-compliance-expert && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "soc2-compliance-expert" agent skill from https://github.com/borghei/Claude-Skills/tree/main/ra-qm-team/soc2-compliance-expert into .gemini/skills/soc2-compliance-expert/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "soc2-compliance-expert", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install borghei/Claude-Skills soc2-compliance-expertInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add borghei/Claude-Skills --skill soc2-compliance-expert -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/borghei/Claude-Skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/ra-qm-team/soc2-compliance-expert .github/skills/soc2-compliance-expert && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "soc2-compliance-expert" agent skill from https://github.com/borghei/Claude-Skills/tree/main/ra-qm-team/soc2-compliance-expert into .github/skills/soc2-compliance-expert/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "soc2-compliance-expert", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add borghei/Claude-Skills --skill soc2-compliance-expert -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install borghei/Claude-Skills soc2-compliance-expert --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/borghei/Claude-Skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/ra-qm-team/soc2-compliance-expert .opencode/skills/soc2-compliance-expert && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "soc2-compliance-expert" agent skill from https://github.com/borghei/Claude-Skills/tree/main/ra-qm-team/soc2-compliance-expert into .opencode/skills/soc2-compliance-expert/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "soc2-compliance-expert", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
soc2-compliance-expert- GitHub stars
- 886
- Token cost
- ~5.3k tokens
- SKILL.md length
- 2,143 words
- Files
- 8 (incl. scripts, references)
- Skills in repo
- 354
- Repo updated
- First seen
- Licence
- MIT
At a glance
SOC 2 Type I and Type II compliance management against the Trust Services Criteria.
- Works in 6 steps: Define scope -- determine which TSC… → Assess current state -- inventory… → Run automated gap analysis using… → …
- SOC 2 readiness assessments
- SKILL.md covers SOC 2 Overview, Clarify First, Readiness Assessment Workflow and Evidence Collection Framework, plus 8 more sections
- Runs Python scripts from its folder; calls python
What it does
Soc2 Compliance Expert is an agent skill from borghei/Claude-Skills. SOC 2 Type I and Type II compliance management against the Trust Services Criteria. Use for SOC 2 readiness assessments, TSC gap analysis, audit evidence collection, infrastructure control validation, and CPA firm audit preparation.
Its SKILL.md is about 5.3k tokens, which your agent loads only when the skill is triggered. The skill folder holds 9 other files, including scripts and reference files (for example `REFERENCE.md`, `references/audit-preparation-playbook.md` and `references/infrastructure-security-controls.md`).
It sits in Legal & Compliance, covering SOC 2 and security compliance and Audit readiness. The repository describes itself as: 385 AI skills, 77 expert agents, and 900 stdlib Python tools for every team: engineering, PM, marketing, C-level, compliance, business ops, research, and a LinkedIn toolkit… The licence is MIT.
When your agent uses it
- SOC 2 readiness assessments
- TSC gap analysis
- Audit evidence collection
- Infrastructure control validation
Example prompts
- “/soc2-compliance-expert”
Requirements
- Python 3
Workflow steps
6 steps, taken from the first numbered list in SKILL.md.
- Define scope -- determine which TSC categories to include (Security is mandatory), define system boundaries, identify subservice…
- Assess current state -- inventory existing policies and procedures, map current controls to TSC requirements, interview process owners and…
- Run automated gap analysis using scripts/soc2_readiness_checker.py.
- Document gaps -- missing controls, controls lacking evidence, controls not operating effectively.
- Prioritize gaps by risk level and remediation effort.
- Validation checkpoint: Gap analysis covers all in-scope TSC categories; each gap has severity rating and remediation owner assigned.
What it can do on your machine
Read from SKILL.md and the folder at commit 4a698e8. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Ships 3 files in scripts/ (Python), which the agent can run.
Shell commands in SKILL.md call:
python
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Soc2 Compliance Expert loads about 5.3k tokens when it runs, and up to ~28k if it reads all its reference files. Until then it costs about 64 tokens; SKILL.md has 2,143 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.
SKILL.md
The full file from borghei/Claude-Skills at commit 4a698e8, republished under its MIT licence (© borghei). 2,143 words, ~5,314 tokens.
Download SKILL.mdSave it as
.claude/skills/soc2-compliance-expert/SKILL.md (or your agent's skills folder). This skill also uses 7 other files; get the full folder from GitHub.- name
- soc2-compliance-expert
- description
- SOC 2 Type I and Type II compliance management against the Trust Services Criteria. Use for SOC 2 readiness assessments, TSC gap analysis, audit evidence collection, infrastructure control validation, and CPA firm audit preparation.
- license
- MIT + Commons Clause
- metadata.version
- 1.0.0
- metadata.author
- borghei
- metadata.category
- compliance
- metadata.domain
- security-compliance
- metadata.updated
- 2026-03-31
- metadata.tags
- soc2, trust-services, security-compliance, evidence-collection
SOC 2 Compliance Expert
SOC 2 Type I and Type II compliance management covering all Trust Services Criteria (TSC), infrastructure security validation, evidence collection, and end-to-end audit preparation.
SOC 2 Overview
Type I vs Type II
| Aspect | Type I | Type II |
|---|---|---|
| Scope | Design of controls at a point in time | Design AND operating effectiveness over a period |
| Duration | Single date (snapshot) | Observation period (3-12 months, typically 6-12) |
| Cost | $20K-$60K (first audit) | $40K-$150K (first audit) |
| Timeline | 1-3 months | 6-15 months (includes observation period) |
| Customer Preference | Early-stage acceptable | Enterprise customers require |
Start with Type I to validate control design, then transition to Type II within 6 months.
Trust Services Criteria Summary
| Category | Focus | Controls |
|---|---|---|
| CC1-CC5 | Common Criteria (COSO-based) | Control environment, communication, risk, monitoring, control activities |
| CC6 | Logical and Physical Access | Authentication, authorization, physical security, encryption |
| CC7 | System Operations | Vulnerability management, monitoring, incident response, BCP |
| CC8 | Change Management | Authorization, testing, deployment controls |
| CC9 | Risk Mitigation | Vendor management, business disruption, risk transfer |
| A1 | Availability | Capacity planning, DR, recovery testing |
| PI1 | Processing Integrity | Data validation, error handling, reconciliation |
| C1 | Confidentiality | Classification, encryption, disposal |
| P1 | Privacy | Notice, consent, data subject rights, retention |
For detailed control requirements per category, see REFERENCE.md.
Clarify First
Before running the readiness assessment, confirm these inputs. If any is unknown or vague, ASK — do not assume:
- Report type — Type I (design at a point in time) vs Type II (operating effectiveness over a period) (sets the observation-period requirement and timeline)
- TSC scope — which criteria beyond mandatory Security (Availability, Processing Integrity, Confidentiality, Privacy) (drives which controls and evidence are needed)
- Subservice organizations — carve-out vs inclusive (affects the scope and system description)
Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the assessment.
Readiness Assessment Workflow
The agent guides organizations through SOC 2 readiness from gap analysis through audit completion.
Workflow: Phase 1 -- Gap Analysis (Weeks 1-4)
- Define scope -- determine which TSC categories to include (Security is mandatory), define system boundaries, identify subservice organizations (carve-out vs. inclusive), document principal service commitments.
- Assess current state -- inventory existing policies and procedures, map current controls to TSC requirements, interview process owners and control operators.
- Run automated gap analysis using
scripts/soc2_readiness_checker.py. - Document gaps -- missing controls, controls lacking evidence, controls not operating effectively.
- Prioritize gaps by risk level and remediation effort.
- Validation checkpoint: Gap analysis covers all in-scope TSC categories; each gap has severity rating and remediation owner assigned.
Workflow: Phase 2 -- Remediation (Weeks 5-16)
- Develop/update policies -- information security policy, supporting procedures per control domain, policy review and approval workflows.
- Implement technical controls -- configure IdP with SSO/MFA enforcement, deploy endpoint security (MDM, EDR, disk encryption), implement SIEM logging and monitoring, configure backup and DR, harden cloud infrastructure.
- Establish processes -- access review procedures, change management workflow, incident response procedures, vendor management program, security awareness training.
- Set up evidence collection -- configure automated collection, establish repository structure, define refresh cadence per TSC category.
- Validation checkpoint: All identified gaps remediated; technical controls verified via
scripts/soc2_infrastructure_auditor.py; evidence collection producing artifacts.
Workflow: Phase 3 -- Pre-Audit (Weeks 17-20)
- Conduct internal readiness assessment -- mock audit against all in-scope TSC, validate evidence completeness and quality, run infrastructure auditor for technical validation.
- Remediate pre-audit findings -- address remaining gaps, strengthen evidence.
- Select and engage CPA firm -- negotiate scope, timeline, fees; schedule kickoff; prepare system description draft.
- Validation checkpoint: Mock audit passes with no critical gaps; system description reviewed; auditor engaged.
Workflow: Phase 4 -- Audit Execution
- Type I audit (if applicable) -- auditor reviews control design; management provides assertions; address findings before Type II.
- Type II observation period (3-12 months) -- controls operate consistently, evidence collected continuously, quarterly self-assessments, regular auditor check-ins.
- Fieldwork (2-4 weeks) -- auditor selects samples, tests controls, interviews personnel; draft report review; final report issuance.
- Validation checkpoint: Clean opinion received; any findings have management response and remediation plan.
Evidence Collection Framework
Evidence by TSC Category
| TSC | Evidence Type | Collection Method | Refresh |
|---|---|---|---|
| CC1 | Code of conduct acknowledgments | HR system export | Annual |
| CC2 | Security awareness training records | LMS export | Ongoing |
| CC3 | Risk assessment report, risk register | GRC platform | Annual/Quarterly |
| CC4 | Penetration test reports, vulnerability scans | Third-party/scanner | Annual/Monthly |
| CC5 | Policy documents with version history | Policy management | Annual review |
| CC6 | Access reviews, MFA enrollment, offboarding | IAM/IdP/HRIS | Quarterly/Per event |
| CC7 | Vulnerability remediation, incident records | Ticketing/ITSM | Ongoing |
| CC8 | Change tickets with approvals, code reviews | ITSM/Git | Per change |
| CC9 | Vendor risk assessments, vendor SOC 2 reports | GRC platform | Annual |
| A1 | Uptime reports, DR tests, backup logs | Monitoring/backup | Monthly/Semi-annual |
| PI1 | Data validation/reconciliation reports | Application logs | Per process |
| C1 | Data classification inventory, encryption configs | Manual/automated | Annual/Quarterly |
| P1 | PIAs, DSR response tracking | Privacy tool | Per event |
Example: Evidence Collection Command
# Generate evidence checklist for all TSC categories
python scripts/evidence_collector.py --generate-checklist --categories all
# Track evidence status
python scripts/evidence_collector.py --status evidence-tracker.json
# Update specific evidence item
python scripts/evidence_collector.py --update evidence-tracker.json \
--item CC6.1-MFA --status collected
# Generate readiness dashboard
python scripts/evidence_collector.py --dashboard evidence-tracker.json
# Export for auditor review
python scripts/evidence_collector.py --export evidence-tracker.json --format jsonAutomation Strategies
GRC Platforms: Vanta, Drata, Secureframe, Laika, AuditBoard -- automated evidence collection via API integrations, continuous control monitoring, auditor collaboration portals.
Infrastructure-as-Evidence: Cloud configuration snapshots (AWS Config, Azure Policy, GCP Org Policies), Terraform state as configuration evidence, Git history as change management evidence, CI/CD pipeline logs as deployment control evidence.
Infrastructure Security Validation
The agent validates infrastructure configurations against SOC 2 requirements.
Quick Reference: Infrastructure Checks
| Domain | Key Checks | SOC 2 Mapping |
|---|---|---|
| Cloud (AWS/Azure/GCP) | Encryption, IAM, logging, network, backup, secrets | CC6, CC7, A1, C1 |
| DNS | SPF, DKIM, DMARC, DNSSEC, CAA | CC6.6, CC2.2 |
| TLS/SSL | TLS 1.2+, AEAD ciphers, HSTS, auto-renewal | CC6.7 |
| Endpoint | MDM, disk encryption, EDR, patching, screen lock | CC6.1, CC6.8, CC7.1 |
| Network | Segmentation, WAF, DDoS, VPN/ZTNA, egress filtering | CC6.6, A1.1 |
| Container | Image scanning, minimal base, no privileged, RBAC | CC6.1, CC7.1 |
| CI/CD | Signed commits, branch protection, SAST/DAST, SBOM | CC7.1, CC8.1 |
| Secrets | Vault storage, rotation policies, git scanning | CC6.1 |
For detailed per-provider control mappings, see REFERENCE.md.
Example: Infrastructure Audit Command
# Full infrastructure audit
python scripts/soc2_infrastructure_auditor.py --config infra-config.json
# Audit specific domains only
python scripts/soc2_infrastructure_auditor.py --config infra-config.json \
--domains dns tls cloud
# JSON output with severity ratings
python scripts/soc2_infrastructure_auditor.py --config infra-config.json --format json
# Generate sample configuration template
python scripts/soc2_infrastructure_auditor.py --generate-templateAudit Timeline
Typical Timeline (First SOC 2)
| Phase | Duration | Activities |
|---|---|---|
| Scoping | 2-4 weeks | Define TSC, system boundaries, auditor selection |
| Gap Analysis | 2-4 weeks | Assess current controls, identify gaps |
| Remediation | 8-16 weeks | Implement missing controls, policies, procedures |
| Type I Audit | 2-4 weeks | Point-in-time control design assessment |
| Type II Observation | 3-12 months | Controls operate, evidence collected continuously |
| Type II Fieldwork | 2-4 weeks | Auditor testing, evidence review, interviews |
| Report Issuance | 2-4 weeks | Draft review, management response, final report |
Annual Renewal
- Begin renewal planning 3 months before observation period ends
- Maintain continuous compliance between audit periods
- Address prior-year findings before new observation period
- Bridge letters available for gaps between reports
Incident Response Requirements
IRP Structure
- Preparation -- IR team defined, communication channels established, runbooks for common incidents, legal/PR contacts on retainer.
- Detection and Analysis -- monitoring/alerting coverage, severity classification (SEV1-SEV4), triage procedures, escalation matrix.
- Containment, Eradication, Recovery -- isolate affected systems, preserve evidence, identify root cause, restore and validate.
- Post-Incident -- blameless post-mortem within 5 business days, lessons learned, control improvements, notification assessment (MTTD, MTTR, MTTC tracking).
For severity level definitions and breach notification timelines, see REFERENCE.md.
Tools
SOC 2 Readiness Checker
# Full readiness assessment
python scripts/soc2_readiness_checker.py --config org-controls.json
# JSON output for programmatic use
python scripts/soc2_readiness_checker.py --config org-controls.json --format json
# Check specific TSC categories
python scripts/soc2_readiness_checker.py --config org-controls.json \
--categories security availability
# Include cloud provider control mapping
python scripts/soc2_readiness_checker.py --config org-controls.json --cloud-mappingEvidence Collector
# Generate checklist and track status
python scripts/evidence_collector.py --generate-checklist --categories all
python scripts/evidence_collector.py --status evidence-tracker.json
python scripts/evidence_collector.py --dashboard evidence-tracker.jsonInfrastructure Auditor
# Validate infrastructure against SOC 2 requirements
python scripts/soc2_infrastructure_auditor.py --config infra-config.json
python scripts/soc2_infrastructure_auditor.py --config infra-config.json --format jsonReferences
| Document | Description |
|---|---|
| REFERENCE.md | Detailed TSC controls, infrastructure checks, access control specs, vendor management, training, IRP, BC/DR |
| Trust Services Criteria Guide | Complete TSC reference with control objectives and audit questions |
| Infrastructure Security Controls | Cloud, DNS, TLS, endpoint, container, CI/CD security configurations |
| Audit Preparation Playbook | End-to-end audit prep guide with timelines, checklists, cost estimation |
Show full SKILL.md (953 more words)Show less
Troubleshooting
| Problem | Likely Cause | Resolution |
|---|---|---|
| Readiness checker scores are 0% across all categories | Controls JSON missing config_key values or all set to false | Verify the input JSON maps each TSC control to a boolean value under the correct config_key. Run --generate-sample > sample-config.json to see the expected structure. |
| Infrastructure auditor reports all checks as "fail" | Infrastructure config JSON is empty or uses wrong key names | Run --generate-template to produce a valid template. Populate DNS, TLS, cloud, endpoint, and other sections with actual infrastructure state. |
| Evidence collector checklist missing categories | --categories flag filtering output | Use --categories all to generate the complete checklist. Available categories: security, availability, processing_integrity, confidentiality, privacy. |
| Evidence tracker status not updating | Tracker file path incorrect or file not writable | Verify the path passed to --status or --update points to an existing tracker JSON file. Check file permissions. |
| Cloud mapping not appearing in readiness report | --cloud-mapping flag not included | Add --cloud-mapping to the readiness checker command to include AWS/Azure/GCP control mappings in the output. |
| Type II observation period too short for auditor | Observation period is less than 3 months | Most CPA firms require a minimum 3-month observation period for Type II. A 6-12 month period carries more weight. Plan the observation window during the scoping phase. |
| Auditor requests evidence not in the tracker | Evidence catalog does not cover all TSC subcriteria for the selected scope | Supplement the auto-generated checklist with auditor-specific evidence requests. Each CPA firm may have additional requirements beyond the standard TSC evidence items. |
Success Criteria
- SOC 2 scope defined with all applicable TSC categories selected, system boundaries documented, and subservice organizations identified (carve-out vs inclusive)
- Gap analysis completed with every identified gap assigned a severity rating, remediation owner, and target completion date
- Readiness score of 80%+ across all in-scope TSC categories before engaging the CPA firm, trending to 95%+ before Type II fieldwork
- Evidence collection framework operational with centralized repository, defined refresh cadence per TSC category, and automated collection where possible
- Infrastructure audit passes with no critical or high-severity findings in DNS, TLS, cloud, endpoint, or access control domains
- Type II observation period of at least 6 months with continuous control operation, quarterly self-assessments, and no significant control failures
- Clean SOC 2 Type II opinion received with any findings addressed by management response and documented remediation plans
Scope & Limitations
In Scope:
- SOC 2 Type I and Type II readiness assessment against all TSC categories (CC1-CC9, A1, PI1, C1, P1)
- Infrastructure security validation (DNS, TLS, cloud, endpoint, network, container, CI/CD, secrets)
- Evidence collection framework generation and tracking
- Gap analysis with severity-rated findings and remediation guidance
- Audit timeline planning and CPA firm engagement preparation
- Incident response plan structure and requirements
- Continuous compliance program design
Out of Scope:
- CPA firm audit execution (the tools prepare for audit; the actual Type I/II report requires an independent CPA firm)
- SOC 1 (ICFR) assessment (SOC 1 covers financial reporting controls, not security/availability/privacy)
- SOC 3 report generation (SOC 3 is a public-facing summary derived from SOC 2; it requires a completed SOC 2 audit)
- Penetration testing execution (use infrastructure-compliance-auditor or engage a third-party pentest firm)
- GRC platform selection or implementation (the skill is compatible with Vanta, Drata, Secureframe, etc., but does not implement them)
- Legal advice on customer contractual requirements for SOC 2 reports
- Physical security assessments (the infrastructure auditor covers logical controls; physical data center audits require on-site assessment)
Integration Points
| Skill | Integration |
|---|---|
| infrastructure-compliance-auditor | Provides Vanta-level infrastructure checks across cloud, DNS, TLS, endpoints, access controls, and CI/CD that map directly to SOC 2 TSC requirements |
| nist-csf-specialist | NIST CSF functions map to SOC 2 TSC categories; use the control mapper to build unified control matrices for organizations pursuing both |
| information-security-manager-iso27001 | ISO 27001 Annex A controls provide a management system backbone that satisfies many SOC 2 requirements; shared evidence reduces audit burden |
| pci-dss-specialist | PCI DSS requirements overlap with SOC 2 CC6 (access), CC7 (operations), CC8 (change management); shared controls for payment-processing organizations |
| gdpr-dsgvo-expert | GDPR requirements align with SOC 2 Privacy (P1) criteria; organizations processing EU personal data can leverage shared privacy controls |
| nis2-directive-specialist | NIS2 minimum security measures overlap with SOC 2 security criteria; EU entities can map shared incident response, access control, and encryption controls |
Tool Reference
soc2_readiness_checker.py
Evaluates organizational controls against SOC 2 Trust Services Criteria with per-category scoring.
| Flag | Required | Description |
|---|---|---|
--config | Yes (or --generate-sample) | Path to organization controls JSON file with boolean values for each TSC control |
--format | No | Output format: json for structured output, omit for human-readable text |
--categories | No | Space-separated TSC categories to assess (e.g., security availability). Omit for all. |
--cloud-mapping | No | Include cloud provider (AWS/Azure/GCP) control mappings in the output |
--generate-sample | No | Generate a sample controls JSON template (pipe to file with > sample-config.json) |
evidence_collector.py
Generates evidence collection checklists and tracks evidence gathering status.
| Flag | Required | Description |
|---|---|---|
--generate-checklist | No | Generate an evidence collection checklist for the specified categories |
--categories | No | Space-separated TSC categories: security, availability, processing_integrity, confidentiality, privacy, or all |
--status | No | Path to evidence tracker JSON file to display collection status |
--update | No | Path to evidence tracker JSON file to update (use with --item and --status) |
--item | No | Evidence item identifier to update (e.g., CC6.1-MFA) |
--dashboard | No | Path to evidence tracker JSON file to generate a readiness dashboard |
--export | No | Path to evidence tracker JSON file to export |
--format | No | Export format: json for structured output |
soc2_infrastructure_auditor.py
Audits infrastructure configurations against SOC 2 requirements with severity-rated findings.
| Flag | Required | Description |
|---|---|---|
--config | Yes (or --generate-template) | Path to infrastructure configuration JSON file with DNS, TLS, cloud, endpoint, and other domain settings |
--format | No | Output format: json for structured findings with severity ratings, omit for human-readable text |
--domains | No | Space-separated infrastructure domains to audit (e.g., dns tls cloud). Omit for all domains. |
--generate-template | No | Generate a sample infrastructure configuration template (pipe to file with > infra-config.json) |
© borghei, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 7 other files (scripts, references) in ra-qm-team/soc2-compliance-expert of borghei/Claude-Skills.
- SKILL.md
- REFERENCE.md
- references/audit-preparation-playbook.md
- references/infrastructure-security-controls.md
- references/trust-services-criteria-guide.md
- scripts/evidence_collector.py
- scripts/soc2_infrastructure_auditor.py
- scripts/soc2_readiness_checker.py
Open the folder on GitHubat commit 4a698e8
Compare with similar skills
Soc2 Compliance Expert next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Soc2 Compliance Expert this skillborghei/Claude-Skills | 886 | — | ~5.3k | Automated safety check: Pass | MIT | |
| Trust Center BuilderGRCEngClub/claude-grc-engineering | 420 | — | ~2.6k | Automated safety check: Pass | Custom licence | |
| Isms Audit Expertalirezarezvani/claude-skills | 28k | 1 repos | ~1.9k | Automated safety check: Pass | MIT | |
| Performing Soc2 Type2 Audit Preparationmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.7k | Automated safety check: Pass | Apache-2.0 | |
| Compliance Osalirezarezvani/claude-skills | 28k | — | ~3.3k | Automated safety check: Pass | MIT | |
| Implementing Complianceancoleman/ai-design-components | 526 | — | ~4k | Automated safety check: Pass | MIT |
Similar skills
Isms Audit Expert
alirezarezvani/claude-skills
Information Security Management System (ISMS) audit expert for ISO 27001 compliance verification, security control assessment, and certification support.
Performing Soc2 Type2 Audit Preparation
mukul975/Anthropic-Cybersecurity-Skills
Automates SOC 2 Type II audit preparation including gap assessment against AICPA Trust Services Criteria (CC1-CC9), evidence collection from cloud providers and identity systems, control testing…
Compliance Os
alirezarezvani/claude-skills
Compliance OS — meta-orchestrator that lets compliance teams CONFIGURE which frameworks apply, COMPUTE cross-framework control overlap, SIMULATE internal audits, and CONSOLIDATE evidence across…
Implementing Compliance
ancoleman/ai-design-components
Implement and maintain compliance with SOC 2, HIPAA, PCI-DSS, and GDPR using unified control mapping, policy-as-code enforcement, and automated evidence collection.
Assisting With Soc2 Audit Preparation
jeremylongshore/tons-of-skills-marketplace
Execute automate SOC 2 audit preparation including evidence gathering, control assessment, and compliance gap identification.
More from borghei/Claude-Skills
All 354 skills in this repoAgent Harness
borghei/Claude-Skills
Test and evaluation harness for AI agents — scenario suites, deterministic replay, regression diffing, cost and latency budgets.
Agents In The Team
borghei/Claude-Skills
Run delivery when AI coding and ops agents take tickets. An agent skill from borghei/Claude-Skills.
AI Content Disclosure
borghei/Claude-Skills
Check AI-generated marketing content and reviews for required disclosures under the EU AI Act, FTC rules and platform AI-label policies.
AI Prototyping
borghei/Claude-Skills
Idea to AI-generated prototype to customer validation to engineering handoff.
Analytics Engineer
borghei/Claude-Skills
Analytics engineering across data modeling, dbt, transformation, and semantic layers.
Ansoff Matrix
borghei/Claude-Skills
Ansoff Matrix — 4-quadrant framework for growth options: market penetration, market/product development, and diversification.
Related
Categories
Questions about Soc2 Compliance Expert
What does Soc2 Compliance Expert do?
SOC 2 Type I and Type II compliance management against the Trust Services Criteria. Soc2 Compliance Expert is an agent skill from borghei/Claude-Skills. SOC 2 Type I and Type II compliance management against the Trust Services Criteria.
When should I use Soc2 Compliance Expert?
Soc2 Compliance Expert fits situations like: SOC 2 readiness assessments; TSC gap analysis; audit evidence collection; infrastructure control validation.
How do I install Soc2 Compliance Expert in Claude Code?
Run `npx skills add borghei/Claude-Skills --skill soc2-compliance-expert -a claude-code`. Or copy the skill folder (ra-qm-team/soc2-compliance-expert in borghei/Claude-Skills) into .claude/skills/soc2-compliance-expert in your project. Claude Code loads it when a task matches its description.
How do I install Soc2 Compliance Expert in Codex?
Run `npx skills add borghei/Claude-Skills --skill soc2-compliance-expert -a codex`. Or copy the skill folder (ra-qm-team/soc2-compliance-expert in borghei/Claude-Skills) into .agents/skills/soc2-compliance-expert in your project. Codex loads it when a task matches its description.
Can I use Soc2 Compliance Expert in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add borghei/Claude-Skills --skill soc2-compliance-expert -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/soc2-compliance-expert, .gemini/skills/soc2-compliance-expert, .github/skills/soc2-compliance-expert and .opencode/skills/soc2-compliance-expert in your project.
What does Soc2 Compliance Expert need to run?
Going by SKILL.md and its folder, Soc2 Compliance Expert needs Python for the scripts in its folder and the command-line tools its instructions call (python). Our summary lists: Python 3.
Does Soc2 Compliance Expert access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Soc2 Compliance Expert safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.
What licence does Soc2 Compliance Expert use?
Soc2 Compliance Expert is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Soc2 Compliance Expert use?
About 5.3k tokens (SKILL.md is roughly 21k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 23k tokens, read only when the agent opens those files.
What are the alternatives to Soc2 Compliance Expert?
Skills that share tags, products or a category with Soc2 Compliance Expert: Trust Center Builder (GRCEngClub/claude-grc-engineering, 420 stars), Isms Audit Expert (alirezarezvani/claude-skills, 28k stars), Performing Soc2 Type2 Audit Preparation (mukul975/Anthropic-Cybersecurity-Skills, 34k stars) and Compliance Os (alirezarezvani/claude-skills, 28k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Soc2 Compliance Expert?
borghei (a GitHub user) maintains it in borghei/Claude-Skills, which has 886 GitHub stars. The repository holds 354 skills in this directory. The repository was last updated on October 7, 2026.
Source: borghei/Claude-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.