soc2-readiness

# SOC 2 Readiness Skill

A SOC 2 audit fails on two things: missing controls and missing *evidence* of controls you actually
run. This skill scopes the engagement to the right Trust Services Criteria, assesses each control's
status honestly, scores readiness deterministically (so "we're basically ready" becomes a number), and
turns the gaps into a prioritised, owned remediation plan with the evidence each control must produce.

## Required Inputs

Ask for these only if they aren't already provided:

- **Report type & period** — SOC 2 Type I (point in time) or Type II (a window, usually 3–12 months).
- **In-scope criteria** — Security (always), plus any of Availability, Confidentiality, Processing Integrity, Privacy. Don't include criteria you can't evidence.
- **Systems in scope** — the product/infra boundary the report covers.
- **Current control state** — what's implemented, partially implemented, or missing (be honest; auditors test, they don't take your word).

## Output Format

### SOC 2 Readiness: [company] — [Type I/II], [period]

**1. Scope** — the systems, the in-scope criteria, and explicitly what's out of scope.

**2. Control status** — a table grouped by criterion; status is `met` / `partial` / `gap`.

| Criterion | Control | Status | Evidence it needs | Owner |
|---|---|---|---|---|
| Security (CC6) | Access reviews quarterly | partial | Signed access-review records | IT |

**3. Readiness score** — overall and per-criterion %, from the helper script (so it's consistent, not vibes). State the bar: a readiness assessment isn't a pass, but <~85% means you're not audit-ready.

**4. Prioritised gaps** — ranked by risk × effort: what to fix first, the owner, and the target date.

**5. Evidence plan** — for a Type II especially: what evidence must be *collected continuously over the period* (you can't backfill a quarter of access reviews the week before the audit).

## Programmatic Helper

`scripts/soc2_score.py` (stdlib only) scores readiness from a control list so the number is
calculated, not estimated:

```bash
# controls.json: [{"criterion":"Security","control":"...","status":"met|partial|gap","weight":1}, ...]
python3 scripts/soc2_score.py controls.json
python3 scripts/soc2_score.py controls.json --json   # machine-readable, for chaining
```

It returns per-criterion and overall readiness (met=1.0, partial=0.5, gap=0) and lists the gaps.

## Quality Checks

- [ ] Only criteria the org can actually evidence are in scope (don't add Privacy to look thorough)
- [ ] Every control names the specific evidence an auditor would request
- [ ] The readiness score is computed from the control list, not asserted
- [ ] For Type II, the plan distinguishes "implement the control" from "accumulate evidence over the period"
- [ ] Gaps are prioritised by risk and have an owner and date — not a flat list

## Anti-Patterns

- [ ] Do not confuse a readiness assessment with a passed audit — readiness is self-assessed; the report comes from a licensed CPA firm
- [ ] Do not claim a control is "met" without the evidence to prove it — auditors test operating effectiveness, not intentions
- [ ] Do not over-scope criteria — every criterion you add is more controls to evidence; include only what's true and needed
- [ ] Do not leave gaps unowned or undated — an unowned gap is a gap that's still open at audit time
- [ ] Do not try to backfill Type II evidence — controls must demonstrably operate across the whole period

## Based On

AICPA SOC 2 Trust Services Criteria (Security, Availability, Confidentiality, Processing Integrity, Privacy).