SOC 2 Gap Analysis

Use this skill to run a structured SOC 2 readiness review. Keep the skill behavioral: inspect current controls, sort findings by evidence quality and control quality, and produce a remediation-oriented report.

This skill is for readiness analysis, not legal advice and not an attestation. Never claim a company is "SOC 2 compliant" or "audit ready" unless the user explicitly provides current evidence that supports that statement.

Core Rules

1. Separate control gaps from evidence gaps.
2. Mark unknowns clearly instead of smoothing them over.
3. Scope the review before evaluating controls.
4. Prefer concrete artifacts over narrative claims.
5. Route policy drafting to soc2-policy-drafting and evidence chasing to soc2-evidence-collection when the task becomes document-heavy.

Workflow

1. Confirm scope