Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

SOC 2 Audit Prep · borghei | DecimalAI

borghei/soc2-audit-prep

NewSkillScoreMaintained

SOC 2 audit-prep playbook: the 4/8/12-week sprint to audit-ready for a Type I or Type II observation. Use when the audit is scheduled, when readiness assessment surfaced gaps and you need a sprint plan, or when evidence is missing or stale.

legalby borghei

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/borghei-soc2-audit-prep/SKILL.md

decimalai skills pull borghei-soc2-audit-prep --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/borghei-soc2-audit-prep/SKILL.md https://app.decimal.ai/s/borghei-soc2-audit-prep/SKILL.md

Raw file: /s/borghei-soc2-audit-prep/SKILL.md ↗ · machine-readable summary at /s/borghei-soc2-audit-prep.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 2h ago

Yes — +36% lift · at higher cost+74% tokens0% turns91% of whole cases pass with skill (20/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	73%	0%
case-02	✗→✓	▲ Improved	58%	0%
case-03	✗→✓	▲ Improved	61%	0%
case-07	✗→✓	▲ Improved	76%	0%
case-09	✗→✓	▲ Improved	74%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

borghei / claude-skills

ra-qm-team/audit-prep/soc2-audit-prep/SKILL.md

View on GitHub ↗

License MIT + Commons ClauseImported 8/3/2026Version v1Bundled 4 files · scripts

Skill contents

scripts/

references/

SKILL.md

SOC 2 Audit Prep

Operational playbook for SOC 2 audit preparation. Designed to be picked up 4-12 weeks before an audit and run as a sprint to closure. Pairs with our deep ra-qm-team/soc2-compliance-expert skill (which builds the program from scratch).

When to use this skill vs. soc2-compliance-expert:

This skill: audit scheduled in 4-12 weeks; gaps known; need to execute the sprint
soc2-compliance-expert: building the SOC 2 program; designing controls; multi-quarter effort

When to use this skill

| Situation | Skill applies | |-----------|---------------| | SOC 2 audit scheduled, need readiness sprint | Yes — start here | | Type I audit in 4-12 weeks | Yes — use 4 or 8-week sprint plan | | Type II observation period closing soon | Yes — use 12-week sprint plan | | Readiness assessment surfaced gaps | Yes — scripts/soc2_readiness_score.py + evidence_gap_finder.py | | Building SOC 2 program from scratch | Use ra-qm-team/soc2-compliance-expert instead |

The audit-prep sprint at a glance

4-week sprint (Type I, mostly ready)

Week 1: Inventory + scoping
  - Confirm Trust Services Criteria scope (always Security; plus chosen others)
  - Pull current evidence per criterion
  - Identify gaps via scripts/evidence_gap_finder.py
  - Auditor kickoff scheduled

Week 2: Gap closure
  - Policy updates / approvals
  - Technical control fixes (MFA universal, logging coverage, etc.)
  - Evidence retrieval (access reviews, change tickets, on-call records)
  - Auditor information request preparation

Week 3: Evidence finalization
  - All evidence packets compiled per criterion
  - Walkthroughs / interviews scheduled with key control owners
  - Findings remediation
  - Pre-audit checkpoint with auditor (informal)

Week 4: Audit week
  - Walkthroughs executed
  - Sample testing
  - Q&A
  - Management responses to findings

8-week sprint (Type I, gaps remaining)

Weeks 1-2: Inventory + scoping + gap identification (same as 4-week W1)
Weeks 3-5: Gap closure (policies, technical, process)
Weeks 6-7: Evidence finalization + walkthroughs
Week 8: Audit week

12-week sprint (Type II observation prep)

Weeks 1-2: Inventory + scope + gap identification + auditor kickoff
Weeks 3-4: Gap closure
Weeks 5-12: Observation period (controls operating; evidence accumulating)
After observation period: audit week

See references/evidence-collection-sprint-plan.md for the detailed week-by-week plans.

The pre-audit punch list

Standard pre-audit punch list, organized by Trust Services Criterion:

CC1-CC5 (Common Criteria — control environment)

] Information security policy approved + dated within 12 months
] Org chart current (reflects actual reporting lines)
] Risk assessment performed + documented within 12 months
] Board / leadership oversight evidence (minutes referencing security)
] Code of conduct signed by all employees
] Background checks documented for all hires

CC6 (Logical and Physical Access)

] SSO enforced for all production systems
] MFA universal (no exceptions documented for production access)
] Access review evidence (quarterly minimum)
] Privileged access management (PAM) for admin/root accounts
] Physical security evidence (office badge logs, data center attestation)
] Encryption at rest / in transit verified

CC7 (System Operations)

] Vulnerability management evidence (scans, remediation tracking)
] Monitoring and alerting documented + tested
] Incident response plan + documented incidents from past period
] Business continuity / DR plan + test evidence
] Backup verification (not just configured — tested restore)

CC8 (Change Management)

] Code change tickets with peer review + approval
] Production deployment evidence (who, what, when, approvers)
] Emergency change process documented + sample tickets

CC9 (Risk Mitigation / Vendors)

] Vendor inventory current
] Vendor due diligence evidence per vendor
] Vendor SOC 2 reports collected (annual)

A1 (Availability — if in scope)

] SLA monitoring + actuals
] Capacity planning evidence
] Recovery objective testing (RTO/RPO)

PI1 (Processing Integrity — if in scope)

] Data validation controls documented
] Error handling + reconciliation evidence

C1 (Confidentiality — if in scope)

] Data classification + handling procedures
] Encryption verified

P1 (Privacy — if in scope)

] Privacy notice published + dated
] Data subject rights process documented
] Consent management evidence

See references/soc2-pre-audit-punch-list.md for the detailed punch list with evidence templates per item.

Clarify First

Before running the audit-prep sprint, confirm these inputs. If any is unknown or vague, ASK — do not assume:

] Audit type — Type I (point-in-time) vs Type II (observation period) (sets the 4/8 vs 12-week sprint and the evidence-over-time requirement)
] TSC scope — which Trust Services Criteria beyond mandatory Security (Availability, Processing Integrity, Confidentiality, Privacy) (determines which punch-list sections apply)
] Readiness score / gap level — picks the 4-week vs 8-week vs 12-week sprint (or postpone)

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the sprint plan.

Quick start

Run readiness score: python3 scripts/soc2_readiness_score.py --config controls.yaml
Identify evidence gaps: python3 scripts/evidence_gap_finder.py --evidence evidence.yaml --tsc CC6
Pick sprint length based on score:

Score > 90: 4-week sprint
Score 75-90: 8-week sprint
Score < 75: 12-week sprint or postpone audit

Execute sprint per references/evidence-collection-sprint-plan.md
Pre-audit checkpoint with auditor 1 week before

Common audit-prep failures

No designated audit owner. Sprint flounders. Assign one person Day 1.
Treating evidence as one-time. Type II requires controls operating over observation period. Evidence must accumulate continuously, not just at the end.
Untested backups. Configuring backups isn't enough; you need restore test evidence.
Access review checked but not enforced. Reviews happen; access not actually removed when flagged.
Vendor SOC 2 reports missing or stale. Audit checks subservice org evidence.
No incident in observation period. Looks suspicious to auditors. Either you had none (unusual) or you're not detecting them.
Late discovery of carve-out vs inclusive subservice orgs. Re-scoping mid-sprint is painful.

Tooling

| Script | Purpose | |--------|---------| | scripts/soc2_readiness_score.py | Score current state (0-100) per TSC; identify pillars needing attention | | scripts/evidence_gap_finder.py | Cross-reference required evidence vs collected; output gap list with priorities |

References

soc2-pre-audit-punch-list.md — detailed punch list per TSC with evidence templates
evidence-collection-sprint-plan.md — 4/8/12-week sprint plans with week-by-week deliverables

Related skills

ra-qm-team/soc2-compliance-expert — deep SOC 2 program management (multi-quarter)
ra-qm-team/audit-prep/compliance-readiness — multi-framework readiness (SOC 2 + ISO 27001 + NIST)
ra-qm-team/infrastructure-compliance-auditor — automated infra scanning for evidence
engineering/observability-designer — logging / monitoring evidence

Want to see if borghei/soc2-audit-prep would activate on your phrasing? Try it before you install — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/20/2026, 21:40 UTC · 22 cases

Lift

+36%

91% vs 55%

Agent turns

1.0 vs 1.0

Tokens

+74%

4,106.09 vs 2,355.05

fail → pass · 8pass → pass · 12fail → fail · 2

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-05 Our enterprise clients are demanding both ISO 27001 certification and a SOC 2 Type II report simultaneously. We need a unified multi-framework readiness assessment to map controls across ISO 27001, SOC 2, and NIST CSF. How should we approach this?	pass→pass	22,639	18,495	-18%	1	1	0%	3,652	4,934	+35%	0	0	—
case-06 We want to write continuous automated security scanning scripts that audit our AWS Terraform infrastructure state files against SOC 2 CC6 benchmarks every night in CI/CD. How do we build this infrastructure scanning integration?	pass→pass	22,614	28,517	+26%	1	1	0%	3,680	7,789	+112%	0	0	—
case-01 Our SOC 2 Type I audit is coming up in about two months, and we need to get our team organized. Can you build us a week-by-week audit prep sprint plan along with an initial checklist covering the core trust services criteria? Please present the schedule clearly broken down by weekly milestones and outline what key evidence items we need to collect before kick-off.	fail→pass	21,109	24,461	+16%	1	1	0%	3,456	5,964	+73%	0	0	—
case-02 We are entering our SOC 2 Type II observation window soon and need a comprehensive pre-audit punch list organized by control areas like CC1-CC9 and Confidentiality. Please output a structured markdown checklist showing required evidence for each domain, plus steps for evaluating our current readiness score and evidence gaps.	fail→pass	25,976	27,630	+6%	1	1	0%	4,107	6,476	+58%	0	0	—
case-03 I'm leading security compliance and we have a SOC 2 audit scheduled in a few weeks. Can you outline an audit preparation strategy for us? Please include any initial questions you need answered to tailor the plan, a phased sprint schedule for evidence compilation, and a summary of common mistakes teams make during audit prep.	fail→pass	19,492	16,175	-17%	1	1	0%	2,708	4,368	+61%	0	0	—
case-04 We are an early-stage B2B SaaS company with 15 employees and no security policies in place. We want to design and build our SOC 2 compliance program from the ground up over the next year. Can you give us the full program design guide?	pass→pass	23,473	22,626	-4%	1	1	0%	3,654	5,494	+50%	0	0	—
case-07 We completed a preliminary readiness review for our upcoming SOC 2 Type I audit and received a readiness score of 94 out of 100. Our CISO thinks we need an 8-week sprint. Which sprint duration should we follow?	fail→pass	13,989	10,825	-23%	1	1	0%	2,076	3,650	+76%	0	0	—
case-08 Our team ran a readiness check for our SOC 2 Type I audit and scored 82 out of 100. We have several open remediation tickets in CC6 and CC8. Should we do a 4-week or an 8-week sprint?	pass→pass	16,053	9,896	-38%	1	1	0%	2,379	3,369	+42%	0	0	—
case-09 Our readiness evaluation resulted in a score of 62 out of 100 due to unwritten policies and missing access review evidence. Management wants to push through a 4-week audit prep sprint. What sprint timeline or action should we recommend?	fail→pass	14,208	10,980	-23%	1	1	0%	2,142	3,736	+74%	0	0	—
case-10 During our SOC 2 audit prep, our VP of Engineering requested an exception to skip MFA on production server SSH access for senior staff to speed up emergency incident response. Can we document this approved exception for CC6 compliance?	fail→pass	14,690	11,910	-19%	1	1	0%	2,215	3,770	+70%	0	0	—
case-11 We conduct semi-annual user access reviews for production systems and SaaS platforms. Is semi-annual review sufficient to satisfy SOC 2 CC6 requirements?	fail→fail	14,517	10,844	-25%	1	1	0%	2,199	3,652	+66%	0	0	—
case-12 Our DevOps team set up daily automated database backups to AWS S3 with lifecycle rules and encryption. Is showing active automated backup configuration evidence enough to pass CC7 audit testing?	pass→pass	12,371	10,454	-15%	1	1	0%	1,776	3,487	+96%	0	0	—
case-13 We evaluated our controls for an upcoming SOC 2 Type II audit and achieved a readiness score of exactly 75 out of 100. Our engineering manager wants to use a 4-week sprint. Which sprint duration should we select?	fail→fail	11,253	8,449	-25%	1	1	0%	1,657	3,481	+110%	0	0	—
case-14 Our lead developer frequently pushes small bug fixes directly to the production branch without code reviews to maintain deployment speed. What exact change management control evidence will the auditor demand for CC8?	pass→pass	16,400	11,922	-27%	1	1	0%	2,346	3,582	+53%	0	0	—
case-15 We maintain an up-to-date vendor inventory spreadsheet and perform initial security risk assessments when onboarding new SaaS vendors. What annual evidence must we gather from these vendors to satisfy CC9?	pass→pass	13,588	11,879	-13%	1	1	0%	2,009	3,880	+93%	0	0	—
case-16 Our Information Security Policy was formally approved by leadership 18 months ago, and no major security architecture changes occurred since. Can we present this existing policy for CC1-CC5 evidence?	pass→pass	11,533	7,338	-36%	1	1	0%	1,798	3,034	+69%	0	0	—
case-17 We completed a comprehensive cybersecurity risk assessment 16 months ago prior to our last funding round. Does this documented assessment fulfill the CC1-CC5 risk assessment requirement for our upcoming audit?	pass→pass	10,561	8,782	-17%	1	1	0%	1,600	3,320	+108%	0	0	—
case-18 We enforce MFA for all web dashboard logins, but developers SSH into production databases using SSH keys stored on their encrypted laptops without MFA. Does this setup satisfy SOC 2 CC6 logical access controls?	pass→pass	17,097	12,874	-25%	1	1	0%	2,343	3,760	+60%	0	0	—
case-19 When executing an 8-week SOC 2 audit prep sprint, at what point in the timeline should the team conduct the informal pre-audit checkpoint meeting with the auditor?	fail→pass	9,456	3,197	-66%	1	1	0%	1,465	2,572	+76%	0	0	—
case-20 We are adding the Availability (A1) Trust Services Criterion to our SOC 2 scope. Beyond SLA monitoring uptime reports, what key testing evidence must we prepare for the auditor?	pass→pass	14,930	11,963	-20%	1	1	0%	2,231	3,733	+67%	0	0	—
case-21 Our SOC 2 audit scope includes the Privacy (P1) criterion for the first time. What primary public-facing policy document must be verified and dated for this criterion?	pass→pass	4,393	4,039	-8%	1	1	0%	664	2,599	+291%	0	0	—
case-22 Our company scored 91 out of 100 on our pre-audit SOC 2 readiness review. Our team lead proposed an 8-week prep schedule to be extra safe. Which sprint duration should we select?	fail→pass	11,048	10,784	-2%	1	1	0%	1,654	3,684	+123%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +36 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 54.6%
Pass rate with the skill: 90.9%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/20/2026, 21:40 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-01

Prompt

Our SOC 2 Type I audit is coming up in about two months, and we need to get our team organized. Can you build us a week-by-week audit prep sprint plan along with an initial checklist covering the core trust services criteria? Please present the schedule clearly broken down by weekly milestones and outline what key evidence items we need to collect before kick-off.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signalsno signals yet

BenchmarkRun a verified benchmark with positive lift

Live evalNeeds ≥20 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

No signals yet — run a benchmark or collect evaluated traces to earn a score.

Verified on gemini-3.6-flash · re-tested today

Other measured skills in the registry, with their headline benchmark lift.