SOC 2 Readiness Skill

A SOC 2 audit fails on two things: missing controls and missing evidence of controls you actually run. This skill scopes the engagement to the right Trust Services Criteria, assesses each control's status honestly, scores readiness deterministically (so "we're basically ready" becomes a number), and turns the gaps into a prioritised, owned remediation plan with the evidence each control must produce.

Required Inputs

Ask for these only if they aren't already provided:

• Report type & period — SOC 2 Type I (point in time) or Type II (a window, usually 3–12 months).
• In-scope criteria — Security (always), plus any of Availability, Confidentiality, Processing Integrity, Privacy. Don't include criteria you can't evidence.
• Systems in scope — the product/infra boundary the report covers.
• Current control state — what's implemented, partially implemented, or missing (be honest; auditors test, they don't take your word).

Output Format

SOC 2 Readiness: [company] — [Type I/II], [period]

1. Scope — the systems, the in-scope criteria, and explicitly what's out of scope.

2. Control status — a table grouped by criterion; status is met / partial / gap.

Criterion	Control	Status	Evidence it needs	Owner
Security (CC6)	Access reviews quarterly	partial	Signed access-review records	IT

3. Readiness score — overall and per-criterion %, from the helper script (so it's consistent, not vibes). State the bar: a readiness assessment isn't a pass, but <~85% means you're not audit-ready.

4. Prioritised gaps — ranked by risk × effort: what to fix first, the owner, and the target date.

5. Evidence plan — for a Type II especially: what evidence must be collected continuously over the period (you can't backfill a quarter of access reviews the week before the audit).