When SOC 2 auditoria is 6 months out e o seu enterprise pipeline depends on o relatório, walk cada TSC control com infrastructure evidência pronto. — Claude Skill

SOC 2 conformidade Expert

SOC 2 Type I e Type II conformidade management covering todos Trust Services Criteria (TSC), infrastructure security validation, evidência collection, e end-para-end auditoria preparation.

SOC 2 Overview

Type I vs Type II

Start com Type I para validar control design, then transition para Type II dentro de 6 months.

Trust Services Criteria Summary

para detailed control requirements per category, see REFERENCE.md.

Readiness Assessment workflow

o agent guides organizations through SOC 2 readiness a partir de lacuna analysis through auditoria completion.

workflow: Phase 1 -- lacuna Analysis (Weeks 1-4)

1. Define scope -- determine which TSC categories para incluir (Security is mandatory), define system boundaries, identify subservice organizations (carve-out vs. inclusive), document principal service commitments.
2. Assess atual declarar -- inventário existing políticas e procedures, mapear atual controls para TSC requirements, interview processo responsáveis e control operators.
3. Run automatizado lacuna analysis using ¤KEEP0¤.
4. Document lacunas -- em falta controls, controls lacking evidência, controls não operating effectively.
5. priorizar lacunas by risco level e remediation effort.
6. Validation checkpoint: lacuna analysis covers todos in-scope TSC categories; each lacuna has severidade rating e remediation responsável assigned.

workflow: Phase 2 -- Remediation (Weeks 5-16)

1. Develop/update políticas -- information security política, supporting procedures per control domain, política rever e aprovação workflows.
2. Implement technical controls -- configure IdP com SSO/MFA enforcement, deploy endpoint security (MDM, EDR, disk encryption), implement SIEM logging e monitoring, configure backup e DR, harden cloud infrastructure.
3. Establish processos -- access rever procedures, change management workflow, incidente resposta procedures, fornecedor management program, security awareness training.
4. Set up evidência collection -- configure automatizado collection, establish repository structure, define refresh cadence per TSC category.
5. Validation checkpoint: todos identified lacunas remediated; technical controls verified via ¤KEEP0¤; evidência collection producing artifacts.

workflow: Phase 3 -- Pre-auditoria (Weeks 17-20)

1. Conduct internal readiness assessment -- mock auditoria against todos in-scope TSC, validar evidência completeness e qualidade, run infrastructure auditor para technical validation.
2. Remediate pre-auditoria findings -- address remaining lacunas, strengthen evidência.
3. Select e engage CPA firm -- negotiate scope, timeline, fees; schedule kickoff; preparar system description draft.
4. Validation checkpoint: Mock auditoria passes com no critical lacunas; system description reviewed; auditor engaged.

workflow: Phase 4 -- auditoria Execution

1. Type I auditoria (if applicable) -- auditor revê control design; management provides assertions; address findings antes Type II.
2. Type II observation period (3-12 months) -- controls operate consistently, evidência collected continuously, trimestral self-assessments, regular auditor verificar-ins.
3. Fieldwork (2-4 weeks) -- auditor selects samples, tests controls, interviews personnel; draft relatório rever; final relatório issuance.
4. Validation checkpoint: Clean opinion received; qualquer findings have management resposta e remediation plano.

evidência Collection Framework

evidência by TSC Category

Example: evidência Collection Command

# gerar evidência checklist para todos TSC categories
python scripts/evidence_collector.py --generate-checklist --categories all

# Track evidência status
python scripts/evidence_collector.py --status evidence-tracker.json

# Update specific evidência item
python scripts/evidence_collector.py --update evidence-tracker.json \
--item CC6.1-MFA --status collected

# gerar readiness dashboard
python scripts/evidence_collector.py --dashboard evidence-tracker.json

# Export para auditor rever
python scripts/evidence_collector.py --export evidence-tracker.json --format json

Automation Strategies

GRC Platforms: Vanta, Drata, Secureframe, Laika, AuditBoard -- automatizado evidência collection via API integrations, continuous control monitoring, auditor collaboration portals.

Infrastructure-as-evidência: Cloud configuration snapshots (AWS Config, Azure política, GCP Org políticas), Terraform declarar as configuration evidência, Git history as change management evidência, CI/CD pipeline logs as deployment control evidência.

Infrastructure Security Validation

o agent valida infrastructure configurations against SOC 2 requirements.

Quick Reference: Infrastructure verifica

para detailed per-provider control mappings, see REFERENCE.md.

Example: Infrastructure auditoria Command

# Full infrastructure auditoria
python scripts/soc2_infrastructure_auditor.py --config infra-config.json

# auditoria specific domains only
python scripts/soc2_infrastructure_auditor.py --config infra-config.json \
--domains dns tls cloud

# JSON output com severidade ratings
python scripts/soc2_infrastructure_auditor.py --config infra-config.json --format json

# gerar sample configuration template
python scripts/soc2_infrastructure_auditor.py --generate-template

auditoria Timeline

Typical Timeline (primeiro SOC 2)

Annual Renewal

• Begin renewal planning 3 months antes observation period ends
• Maintain continuous conformidade between auditoria periods
• Address prior-year findings antes novo observation period
• Bridge letters disponível para lacunas between relatórios

incidente resposta Requirements

IRP Structure

1. Preparation -- IR equipa defined, communication channels established, runbooks para common incidentes, jurídico/PR contacts on retainer.
2. Detection e Analysis -- monitoring/alerting cobertura, severidade classification (SEV1-SEV4), triagem procedures, escalamento matrix.
3. Containment, Eradication, Recovery -- isolate affected systems, preserve evidência, identify root cause, restore e validar.
4. Post-incidente -- blameless post-mortem dentro de 5 business days, lessons learned, control improvements, notification assessment (MTTD, MTTR, MTTC tracking).

para severidade level definitions e breach notification timelines, see REFERENCE.md.

Tools

SOC 2 Readiness Checker

# Full readiness assessment
python scripts/soc2_readiness_checker.py --config org-controls.json

# JSON output para programmatic usar
python scripts/soc2_readiness_checker.py --config org-controls.json --format json

# verificar specific TSC categories
python scripts/soc2_readiness_checker.py --config org-controls.json \
--categories security availability

# incluir cloud provider control mapping
python scripts/soc2_readiness_checker.py --config org-controls.json --cloud-mapping

evidência Collector

# gerar checklist e track status
python scripts/evidence_collector.py --generate-checklist --categories all
python scripts/evidence_collector.py --status evidence-tracker.json
python scripts/evidence_collector.py --dashboard evidence-tracker.json

Infrastructure Auditor

# validar infrastructure against SOC 2 requirements
python scripts/soc2_infrastructure_auditor.py --config infra-config.json
python scripts/soc2_infrastructure_auditor.py --config infra-config.json --format json

References

Troubleshooting

Success Criteria

• SOC 2 scope defined com todos applicable TSC categories selected, system boundaries documented, e subservice organizations identified (carve-out vs inclusive)
• lacuna analysis completed com cada identified lacuna assigned a severidade rating, remediation responsável, e target completion date
• Readiness pontuação de 80%+ across todos in-scope TSC categories antes engaging o CPA firm, trending para 95%+ antes Type II fieldwork
• evidência collection framework operational com centralized repository, defined refresh cadence per TSC category, e automatizado collection where possible
• Infrastructure auditoria passes com no critical ou high-severidade findings in DNS, TLS, cloud, endpoint, ou access control domains
• Type II observation period de at least 6 months com continuous control operation, trimestral self-assessments, e no significant control failures
• Clean SOC 2 Type II opinion received com qualquer findings addressed by management resposta e documented remediation planos

Scope & Limitations

In Scope:

• SOC 2 Type I e Type II readiness assessment against todos TSC categories (CC1-CC9, A1, PI1, C1, P1)
• Infrastructure security validation (DNS, TLS, cloud, endpoint, network, container, CI/CD, secrets)
• evidência collection framework generation e tracking
• lacuna analysis com severidade-rated findings e remediation guidance
• auditoria timeline planning e CPA firm engagement preparation
• incidente resposta plano structure e requirements
• Continuous conformidade program design

Out de Scope:

• CPA firm auditoria execution (o tools preparar para auditoria; o actual Type I/II relatório requires an independent CPA firm)
• SOC 1 (ICFR) assessment (SOC 1 covers financial reporting controls, não security/availability/privacy)
• SOC 3 relatório generation (SOC 3 is a public-facing summary derived a partir de SOC 2; it requires a completed SOC 2 auditoria)
• Penetration testing execution (usar infrastructure-conformidade-auditor ou engage a third-party pentest firm)
• GRC platform selection ou implementation (o skill is compatible com Vanta, Drata, Secureframe, etc., but does não implement them)
• jurídico advice on cliente contractual requirements para SOC 2 relatórios
• Physical security assessments (o infrastructure auditor covers logical controls; physical dados center auditorias require on-site assessment)

Integration Points

Tool Reference

soc2_readiness_checker.py

Evaluates organizational controls against SOC 2 Trust Services Criteria com per-category scoring.

evidence_collector.py

gera evidência collection checklists e tracks evidência gathering status.

soc2_infrastructure_auditor.py

auditorias infrastructure configurations against SOC 2 requirements com severidade-rated findings.