Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →terminalskills/soc2-compliance
Achieve SOC 2 Type II compliance for SaaS — Trust Service Criteria, evidence collection, and controls implementation.
Passed 21 of 22 test cases with the skill, and 17 of 22 without it.
and 3 more in the full report
4 fixed17 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
What is the typical total time range required from starting initial readiness assessments to receiving a completed first SOC 2 Type II report?
| Checked | Without skill | With skill |
|---|---|---|
| The response estimates the total duration as 6 to 15 months. | Missed | Passed |
The instructions your model reads when the skill loads.
SOC 2 (System and Organization Controls 2) is an attestation framework from the AICPA for service organizations. An independent licensed CPA firm examines your controls against the Trust Services Criteria (the 2017 criteria with the revised points of focus issued in 2022) and issues a report. There is no SOC 2 "certificate" and no government registry: the deliverable is the auditor's report. A Type I report says controls were suitably designed at a point in time; a Type II report says they also operated effectively over an observation period. The AICPA sets no fixed minimum for that period; auditors commonly accept 3 months for a first report, 6 to 12 months is typical, and 12 months is the norm for renewals. Enterprise buyers often ask for a Type II report before signing.
| Criteria | Abbrev | Required? | Description |
|---|---|---|---|
| Security | CC | ✅ Always | Protection against unauthorized access |
| Availability | A | Optional | System available for operation and use |
| Confidentiality | C | Optional | Information designated as confidential is protected |
| Processing Integrity | PI | Optional | Processing is complete, valid, accurate, timely |
| Privacy | P | Optional | Personal information collected, used, retained, disclosed properly |
Most SaaS companies start with Security + Availability. Add Confidentiality if handling sensitive data; add Privacy if handling personal data covered by GDPR/CCPA.
test cases passed, vs 17 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.