Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →borghei/soc2-compliance-expert
SOC 2 Type I and Type II compliance management against the Trust Services Criteria.
Passed 21 of 22 test cases with the skill, and 9 of 22 without it.
and 18 more in the full report
12 fixed9 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 12 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our security team wants to audit only our DNS, TLS, and cloud infrastructure configurations against SOC 2 controls using `infra-config.json` and output the results as structured JSON. What CLI command performs this targeted audit?
| Checked | Without skill | With skill |
|---|---|---|
| The command references scripts/soc2_infrastructure_auditor.py. | Missed | Passed |
| The command specifies --domains dns tls cloud. | Missed | Passed |
| The command includes --format json. | Passed | Passed |
The instructions your model reads when the skill loads.
SOC 2 Type I and Type II compliance management covering all Trust Services Criteria (TSC), infrastructure security validation, evidence collection, and end-to-end audit preparation.
| Aspect | Type I | Type II |
|---|---|---|
| Scope | Design of controls at a point in time | Design AND operating effectiveness over a period |
| Duration | Single date (snapshot) | Observation period (3-12 months, typically 6-12) |
| Cost | $20K-$60K (first audit) | $40K-$150K (first audit) |
| Timeline | 1-3 months | 6-15 months (includes observation period) |
| Customer Preference | Early-stage acceptable | Enterprise customers require |
Start with Type I to validate control design, then transition to Type II within 6 months.
| Category | Focus | Controls |
|---|---|---|
| CC1-CC5 | Common Criteria (COSO-based) | Control environment, communication, risk, monitoring, control activities |
| CC6 | Logical and Physical Access | Authentication, authorization, physical security, encryption |
| CC7 | System Operations | Vulnerability management, monitoring, incident response, BCP |
| CC8 | Change Management | Authorization, testing, deployment controls |
| CC9 | Risk Mitigation | Vendor management, business disruption, risk transfer |
| A1 | Availability | Capacity planning, DR, recovery testing |
| PI1 | Processing Integrity | Data validation, error handling, reconciliation |
| C1 | Confidentiality | Classification, encryption, disposal |
| P1 | Privacy | Notice, consent, data subject rights, retention |
For detailed control requirements per category, see REFERENCE.md.
test cases passed, vs 9 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.