Soc2 Compliance Automator

DevOps & Security

soc2-compliance-automator

Soc2 Compliance Automator is an Agent Skill for devops & security published in the a5c-ai/babysitter repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

SOC 2 Trust Services Criteria compliance automation for evidence collection, control mapping, and audit preparation

View on GitHub ↗

QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

Open your project in Codex.
Copy and paste the prompt below.
Review files and risks before approving any action.

Prompt to paste

Inspect the Agent Skill at https://github.com/a5c-ai/babysitter/blob/HEAD/library/specializations/security-compliance/skills/soc2-compliance-automator/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/soc2-compliance-automator, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

SOC 2 Compliance Automator Skill

Purpose

Automate SOC 2 Trust Services Criteria (TSC) compliance activities including control mapping, evidence collection, audit preparation, and continuous compliance monitoring.

Capabilities

Control Mapping

Map organizational controls to SOC 2 TSC requirements
Cover all five Trust Services Categories:
- Security (Common Criteria)
- Availability
- Processing Integrity
- Confidentiality
- Privacy
Generate control matrices with evidence requirements
Identify control gaps and coverage

Evidence Collection

Automate evidence gathering from cloud providers
Collect access control configurations (IAM, RBAC)
Capture security configurations and policies
Document change management processes
Archive audit logs and monitoring data
Screenshot automation for manual controls

Audit Preparation

Generate Type I and Type II audit packages
Prepare management assertion documents
Create system description documents
Organize evidence by control objective
Generate auditor-ready reports

Control Effectiveness Tracking

Monitor control implementation status
Track control testing results
Document control exceptions
Manage remediation activities
Calculate compliance scores

Continuous Compliance

Monitor control drift and changes
Alert on compliance deviations
Track evidence freshness
Generate compliance dashboards
Automate periodic control testing

Trust Services Categories

CC - Common Criteria (Security)

CC1: Control Environment
CC2: Communication and Information
CC3: Risk Assessment
CC4: Monitoring Activities
CC5: Control Activities
CC6: Logical and Physical Access Controls
CC7: System Operations
CC8: Change Management
CC9: Risk Mitigation

A - Availability

System availability commitments
Disaster recovery and business continuity
Capacity planning and monitoring

PI - Processing Integrity

Data processing accuracy
Completeness and timeliness
Error handling procedures

C - Confidentiality

Data classification
Encryption requirements
Access restrictions

P - Privacy

Privacy notice and consent
Data subject rights
Data retention and disposal

Integrations

Vanta: Automated security and compliance
Drata: Continuous compliance automation
Secureframe: Security compliance platform
AWS/Azure/GCP APIs: Cloud configuration evidence
Identity Providers: Access control evidence
SIEM Systems: Log and monitoring evidence

Target Processes

SOC 2 Compliance Audit Preparation
Continuous Compliance Monitoring
Security Control Assessment
Audit Readiness Review

Input Schema

{
  "type": "object",
  "properties": {
    "auditType": {
      "type": "string",
      "enum": ["Type1", "Type2"],
      "description": "SOC 2 audit type"
    },
    "trustCategories": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["Security", "Availability", "ProcessingIntegrity", "Confidentiality", "Privacy"]
      }
    },
    "auditPeriod": {
      "type": "object",
      "properties": {
        "startDate": { "type": "string", "format": "date" },
        "endDate": { "type": "string", "format": "date" }
      }
    },
    "cloudProviders": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["AWS", "Azure", "GCP"]
      }
    },
    "controlMatrix": {
      "type": "string",
      "description": "Path to existing control matrix"
    },
    "evidenceBasePath": {
      "type": "string",
      "description": "Base path for evidence storage"
    }
  },
  "required": ["auditType", "trustCategories"]
}

Output Schema

{
  "type": "object",
  "properties": {
    "assessmentId": {
      "type": "string"
    },
    "auditType": {
      "type": "string"
    },
    "assessmentDate": {
      "type": "string",
      "format": "date-time"
    },
    "trustCategories": {
      "type": "array"
    },
    "controlSummary": {
      "type": "object",
      "properties": {
        "totalControls": { "type": "integer" },
        "implemented": { "type": "integer" },
        "partiallyImplemented": { "type": "integer" },
        "notImplemented": { "type": "integer" },
        "notApplicable": { "type": "integer" }
      }
    },
    "evidenceStatus": {
      "type": "object",
      "properties": {
        "collected": { "type": "integer" },
        "pending": { "type": "integer" },
        "missing": { "type": "integer" }
      }
    },
    "gapAnalysis": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "controlId": { "type": "string" },
          "gap": { "type": "string" },
          "remediation": { "type": "string" },
          "priority": { "type": "string" }
        }
      }
    },
    "auditPackage": {
      "type": "object",
      "properties": {
        "controlMatrix": { "type": "string" },
        "evidenceFolder": { "type": "string" },
        "systemDescription": { "type": "string" },
        "managementAssertion": { "type": "string" }
      }
    },
    "complianceScore": {
      "type": "number"
    }
  }
}

Usage Example

skill: {
  name: 'soc2-compliance-automator',
  context: {
    auditType: 'Type2',
    trustCategories: ['Security', 'Availability', 'Confidentiality'],
    auditPeriod: {
      startDate: '2024-01-01',
      endDate: '2024-12-31'
    },
    cloudProviders: ['AWS', 'Azure']
  }
}