SOC 2 Readiness Skill

A SOC 2 audit fails on two things: missing controls and missing evidence of controls you actually run. This skill scopes the engagement to the right Trust Services Criteria, assesses each control's status honestly, scores readiness deterministically (so "we're basically ready" becomes a number), and turns the gaps into a prioritised, owned remediation plan with the evidence each control must produce.

Required Inputs

Ask for these only if they aren't already provided:

• Report type & period — SOC 2 Type I (point in time) or Type II (a window, usually 3–12 months).
• In-scope criteria — Security (always), plus any of Availability, Confidentiality, Processing Integrity, Privacy. Don't include criteria you can't evidence.
• Systems in scope — the product/infra boundary the report covers.
• Current control state — what's implemented, partially implemented, or missing (be honest; auditors test, they don't take your word).

Output Format

SOC 2 Readiness: [company] — [Type I/II], [period]