Agent skill

Soc2 Readiness

by mohitagw15856 in mohitagw15856/pm-claude-skills

Assess SOC 2 readiness across the Trust Services Criteria and produce a gap remediation plan.

MITAuto-check passedLegal & Compliance

Install Soc2 Readiness

skills CLI
$ npx skills add mohitagw15856/pm-claude-skills --skill soc2-readiness -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mohitagw15856/pm-claude-skills soc2-readiness --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mohitagw15856/pm-claude-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/soc2-readiness .claude/skills/soc2-readiness && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
soc2-readiness
GitHub stars
1.4k
Token cost
~1k tokens
SKILL.md length
496 words
Files
2 (incl. scripts)
Skills in repo
1,348
Repo updated
First seen
Licence
MIT

At a glance

Assess SOC 2 readiness across the Trust Services Criteria and produce a gap remediation plan.

  • Asked to prepare for a SOC 2 audit
  • SKILL.md covers Required Inputs, Output Format, Programmatic Helper and Quality Checks, plus 3 more sections
  • Runs Python scripts from its folder; calls python3
  • Run a SOC 2 readiness/gap assessment

What it does

Soc2 Readiness is an agent skill from mohitagw15856/pm-claude-skills. Assess SOC 2 readiness across the Trust Services Criteria and produce a gap remediation plan. Use when asked to prepare for a SOC 2 audit, run a SOC 2 readiness/gap assessment, scope controls, or get audit-ready. Produces a readiness report — scope & criteria, a control-by-control status, a weighted readiness score, prioritised gaps with owners, and the evidence each control needs.

Its SKILL.md is about 1k tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including scripts (for example `scripts/soc2_score.py`).

It sits in Legal & Compliance, covering SOC 2 and security compliance. The repository describes itself as: 1255 professional Agent Skills for Claude, ChatGPT, Gemini, Cursor & Codex — PRDs, postmortems, leases, medical bills, layoffs, go-bags, new countries. Plain markdown, MIT, in… The licence is MIT.

When your agent uses it

  • Asked to prepare for a SOC 2 audit
  • Run a SOC 2 readiness/gap assessment
  • Get audit-ready

Example prompts

  • “/soc2-readiness”

Requirements

  • Python 3

What it can do on your machine

Read from SKILL.md and the folder at commit 1cbf1f0. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 1 file in scripts/ (Python), which the agent can run.

    Shell commands in SKILL.md call:

    • python3

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Soc2 Readiness loads about 1k tokens when it runs. Until then it costs about 100 tokens; SKILL.md has 496 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~100
When it runs · the whole SKILL.md, loaded when a task matches
~1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mohitagw15856/pm-claude-skills at commit 1cbf1f0, republished under its MIT licence (© mohitagw15856). 496 words, ~1,040 tokens.

Download SKILL.mdSave it as .claude/skills/soc2-readiness/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
soc2-readiness
description
Assess SOC 2 readiness across the Trust Services Criteria and produce a gap remediation plan. Use when asked to prepare for a SOC 2 audit, run a SOC 2 readiness/gap assessment, scope controls, or get audit-ready. Produces a readiness report — scope & criteria, a control-by-control status, a weighted readiness score, prioritised gaps with owners, and the evidence each control needs.

SOC 2 Readiness Skill

A SOC 2 audit fails on two things: missing controls and missing evidence of controls you actually run. This skill scopes the engagement to the right Trust Services Criteria, assesses each control's status honestly, scores readiness deterministically (so "we're basically ready" becomes a number), and turns the gaps into a prioritised, owned remediation plan with the evidence each control must produce.

Required Inputs

Ask for these only if they aren't already provided:

  • Report type & period — SOC 2 Type I (point in time) or Type II (a window, usually 3–12 months).
  • In-scope criteria — Security (always), plus any of Availability, Confidentiality, Processing Integrity, Privacy. Don't include criteria you can't evidence.
  • Systems in scope — the product/infra boundary the report covers.
  • Current control state — what's implemented, partially implemented, or missing (be honest; auditors test, they don't take your word).

Output Format

SOC 2 Readiness: [company] — [Type I/II], [period]

1. Scope — the systems, the in-scope criteria, and explicitly what's out of scope.

2. Control status — a table grouped by criterion; status is met / partial / gap.

CriterionControlStatusEvidence it needsOwner
Security (CC6)Access reviews quarterlypartialSigned access-review recordsIT

3. Readiness score — overall and per-criterion %, from the helper script (so it's consistent, not vibes). State the bar: a readiness assessment isn't a pass, but <~85% means you're not audit-ready.

4. Prioritised gaps — ranked by risk × effort: what to fix first, the owner, and the target date.

5. Evidence plan — for a Type II especially: what evidence must be collected continuously over the period (you can't backfill a quarter of access reviews the week before the audit).

Programmatic Helper

scripts/soc2_score.py (stdlib only) scores readiness from a control list so the number is calculated, not estimated:

bash
# controls.json: [{"criterion":"Security","control":"...","status":"met|partial|gap","weight":1}, ...]
python3 scripts/soc2_score.py controls.json
python3 scripts/soc2_score.py controls.json --json   # machine-readable, for chaining

It returns per-criterion and overall readiness (met=1.0, partial=0.5, gap=0) and lists the gaps.

Show full SKILL.md (197 more words)Show less

Quality Checks

  • Only criteria the org can actually evidence are in scope (don't add Privacy to look thorough)
  • Every control names the specific evidence an auditor would request
  • The readiness score is computed from the control list, not asserted
  • For Type II, the plan distinguishes "implement the control" from "accumulate evidence over the period"
  • Gaps are prioritised by risk and have an owner and date — not a flat list

Anti-Patterns

  • Do not confuse a readiness assessment with a passed audit — readiness is self-assessed; the report comes from a licensed CPA firm
  • Do not claim a control is "met" without the evidence to prove it — auditors test operating effectiveness, not intentions
  • Do not over-scope criteria — every criterion you add is more controls to evidence; include only what's true and needed
  • Do not leave gaps unowned or undated — an unowned gap is a gap that's still open at audit time
  • Do not try to backfill Type II evidence — controls must demonstrably operate across the whole period

Based On

AICPA SOC 2 Trust Services Criteria (Security, Availability, Confidentiality, Processing Integrity, Privacy).

Example Trigger Phrases

  • "Prepare for a SOC 2 audit."
  • "Run a SOC 2 readiness/gap assessment."
  • "Scope controls."
  • "Get audit-ready."

© mohitagw15856, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (scripts) in skills/soc2-readiness of mohitagw15856/pm-claude-skills.

  • SKILL.md
  • scripts/soc2_score.py

Open the folder on GitHubat commit 1cbf1f0

Compare with similar skills

Soc2 Readiness next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Soc2 Readiness compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Soc2 Readiness this skillmohitagw15856/pm-claude-skills1.4k—~1kAutomated safety check: PassMIT
Nist 800 53Sushegaad/Claude-Skills-Governance-Risk-and-Compliance9461 repos~3.3kAutomated safety check: PassMIT
Soc2Sushegaad/Claude-Skills-Governance-Risk-and-Compliance9461 repos~2.7kAutomated safety check: PassMIT
Grc Knowledgemlunato47/claude-grc-plugin184—~6.1kAutomated safety check: PassMIT
Information Security Manager Iso27001davila7/claude-code-templates33k1 repos~2.9kAutomated safety check: PassMIT
Audit Frameworkscartography-cncf/cartography4.1k—~2.8kAutomated safety check: PassApache-2.0

Similar skills

  • Nist 800 53

    Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

    NIST SP 800-53 Rev 5 compliance advisor — all 20 control families (AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, PT, RA, SA, SC, SI, SR), Low/Moderate/High baseline selection, FIPS 199/200…

    946 GitHub starsUsed in 1 repo~3.3k tokens
    Legal & ComplianceAuto-check passed
  • Soc2

    Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

    Expert SOC 2 compliance assistant covering all five Trust Services Criteria (Security/CC, Availability/A, Confidentiality/C, Processing Integrity/PI, Privacy/P).

    946 GitHub starsUsed in 1 repo~2.7k tokens
    Legal & ComplianceAuto-check passed
  • Grc Knowledge

    mlunato47/claude-grc-plugin

    Senior GRC analyst expertise across 18 compliance frameworks — NIST 800-53, FedRAMP (Rev5 + 20x/CR26, KSIs, VDR/VER, Certification Classes A–D), DoD/DoW Impact Levels (IL2–IL6, DISA Cloud SRG), ITAR…

    184 GitHub stars~6.1k tokensUpdated 4 days ago
    Legal & ComplianceAuto-check passed
  • Information Security Manager Iso27001

    davila7/claude-code-templates

    Senior Information Security Manager specializing in ISO 27001 and ISO 27002 implementation for HealthTech and MedTech companies.

    33k GitHub starsUsed in 1 repo~2.9k tokens
    Legal & ComplianceAuto-check passed
  • Audit Frameworks

    cartography-cncf/cartography

    Audit Cartography's rules and compliance frameworks under cartography/rules/data/rules/.

    4.1k GitHub stars~2.8k tokensUpdated today
    Legal & ComplianceAuto-check passed
  • Trust Center Builder

    GRCEngClub/claude-grc-engineering

    Builds and deploys a serverless trust center that publishes a company's compliance posture, with gated access to audit reports and an admin dashboard.

    419 GitHub stars~2.6k tokensUpdated 7 days ago
    Legal & ComplianceAuto-check passed

More from mohitagw15856/pm-claude-skills

All 1,348 skills in this repo
  • Car Tco

    mohitagw15856/pm-claude-skills

    Compare the total cost of car ownership across buy-new, buy-used, lease, and keep-your-current-car — depreciation, insurance, maintenance ramp, and fuel over a real horizon, not just the monthly…

    1.4k GitHub stars~1.1k tokensUpdated yesterday
    Auto-check passed
  • Cs Health Scorecard

    mohitagw15856/pm-claude-skills

    Build a customer health scorecard for a specific account. An agent skill from mohitagw15856/pm-claude-skills.

    1.4k GitHub stars~2.4k tokensUpdated yesterday
    Auto-check passed
  • Exit Waterfall

    mohitagw15856/pm-claude-skills

    Compute who gets what at each exit price from a cap table — liquidation preferences, conversion points, and where the founders' share collapses.

    1.4k GitHub stars~1.1k tokensUpdated yesterday
    Auto-check passed
  • Feature Prioritisation

    mohitagw15856/pm-claude-skills

    Apply prioritisation frameworks (RICE, MoSCoW, Kano, ICE, Opportunity Scoring) to rank features and backlog items.

    1.4k GitHub stars~2k tokensUpdated yesterday
    Auto-check passed
  • Fire Number

    mohitagw15856/pm-claude-skills

    Compute a financial-independence (FIRE) target and years-to-reach with every assumption labeled as an assumption — plus a sensitivity table instead of a single false-precision answer.

    1.4k GitHub stars~1.1k tokensUpdated yesterday
    Auto-check passed
  • Freelance Rate

    mohitagw15856/pm-claude-skills

    Derive a freelance day/hourly rate backwards from target income, honest billable utilization, overhead, and the self-employment tax premium — the arithmetic that proves a rate is not salary÷2000.

    1.4k GitHub stars~1.2k tokensUpdated yesterday
    Auto-check passed

Questions about Soc2 Readiness

What does Soc2 Readiness do?

Assess SOC 2 readiness across the Trust Services Criteria and produce a gap remediation plan. Soc2 Readiness is an agent skill from mohitagw15856/pm-claude-skills. Assess SOC 2 readiness across the Trust Services Criteria and produce a gap remediation plan.

When should I use Soc2 Readiness?

Soc2 Readiness fits situations like: asked to prepare for a SOC 2 audit; run a SOC 2 readiness/gap assessment; get audit-ready.

How do I install Soc2 Readiness in Claude Code?

Run `npx skills add mohitagw15856/pm-claude-skills --skill soc2-readiness -a claude-code`. Or copy the skill folder (skills/soc2-readiness in mohitagw15856/pm-claude-skills) into .claude/skills/soc2-readiness in your project. Claude Code loads it when a task matches its description.

How do I install Soc2 Readiness in Codex?

Run `npx skills add mohitagw15856/pm-claude-skills --skill soc2-readiness -a codex`. Or copy the skill folder (skills/soc2-readiness in mohitagw15856/pm-claude-skills) into .agents/skills/soc2-readiness in your project. Codex loads it when a task matches its description.

Can I use Soc2 Readiness in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mohitagw15856/pm-claude-skills --skill soc2-readiness -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/soc2-readiness, .gemini/skills/soc2-readiness, .github/skills/soc2-readiness and .opencode/skills/soc2-readiness in your project.

What does Soc2 Readiness need to run?

Going by SKILL.md and its folder, Soc2 Readiness needs Python for the scripts in its folder and the command-line tools its instructions call (python3). Our summary lists: Python 3.

Does Soc2 Readiness access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Soc2 Readiness safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Soc2 Readiness use?

Soc2 Readiness is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Soc2 Readiness use?

About 1k tokens (SKILL.md is roughly 4.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Soc2 Readiness?

Skills that share tags, products or a category with Soc2 Readiness: Nist 800 53 (Sushegaad/Claude-Skills-Governance-Risk-and-Compliance, 946 stars), Soc2 (Sushegaad/Claude-Skills-Governance-Risk-and-Compliance, 946 stars), Grc Knowledge (mlunato47/claude-grc-plugin, 184 stars) and Information Security Manager Iso27001 (davila7/claude-code-templates, 33k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Soc2 Readiness?

mohitagw15856 (a GitHub user) maintains it in mohitagw15856/pm-claude-skills, which has 1,434 GitHub stars. The repository holds 1,348 skills in this directory. The repository was last updated on October 9, 2026.

Source: mohitagw15856/pm-claude-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.