---
name: soc2-compliance-automator-4a85de781737
description: SOC 2 Trust Services Criteria compliance automation for evidence collection, control mapping, and audit preparation
allowed-tools:
  - Bash
  - Read
  - Write
  - Glob
  - Grep
  - WebFetch
graph:
  domains: [domain:security]
  specializations: [specialization:security-compliance]
  skillAreas: [skill-area:compliance-automation, skill-area:security-monitoring-siem]
  roles: [role:compliance-officer, role:security-engineer]
  workflows: [workflow:compliance-audit, workflow:security-audit]

---

# SOC 2 Compliance Automator Skill

## Purpose

Automate SOC 2 Trust Services Criteria (TSC) compliance activities including control mapping, evidence collection, audit preparation, and continuous compliance monitoring.

## Capabilities

### Control Mapping
- Map organizational controls to SOC 2 TSC requirements
- Cover all five Trust Services Categories:
  - Security (Common Criteria)
  - Availability
  - Processing Integrity
  - Confidentiality
  - Privacy
- Generate control matrices with evidence requirements
- Identify control gaps and coverage

### Evidence Collection
- Automate evidence gathering from cloud providers
- Collect access control configurations (IAM, RBAC)
- Capture security configurations and policies
- Document change management processes
- Archive audit logs and monitoring data
- Screenshot automation for manual controls

### Audit Preparation
- Generate Type I and Type II audit packages
- Prepare management assertion documents
- Create system description documents
- Organize evidence by control objective
- Generate auditor-ready reports

### Control Effectiveness Tracking
- Monitor control implementation status
- Track control testing results
- Document control exceptions
- Manage remediation activities
- Calculate compliance scores

### Continuous Compliance
- Monitor control drift and changes
- Alert on compliance deviations
- Track evidence freshness
- Generate compliance dashboards
- Automate periodic control testing

## Trust Services Categories

### CC - Common Criteria (Security)
- CC1: Control Environment
- CC2: Communication and Information
- CC3: Risk Assessment
- CC4: Monitoring Activities
- CC5: Control Activities
- CC6: Logical and Physical Access Controls
- CC7: System Operations
- CC8: Change Management
- CC9: Risk Mitigation

### A - Availability
- System availability commitments
- Disaster recovery and business continuity
- Capacity planning and monitoring

### PI - Processing Integrity
- Data processing accuracy
- Completeness and timeliness
- Error handling procedures

### C - Confidentiality
- Data classification
- Encryption requirements
- Access restrictions

### P - Privacy
- Privacy notice and consent
- Data subject rights
- Data retention and disposal

## Integrations

- **Vanta**: Automated security and compliance
- **Drata**: Continuous compliance automation
- **Secureframe**: Security compliance platform
- **AWS/Azure/GCP APIs**: Cloud configuration evidence
- **Identity Providers**: Access control evidence
- **SIEM Systems**: Log and monitoring evidence

## Target Processes

- SOC 2 Compliance Audit Preparation
- Continuous Compliance Monitoring
- Security Control Assessment
- Audit Readiness Review

## Input Schema

```json
{
  "type": "object",
  "properties": {
    "auditType": {
      "type": "string",
      "enum": ["Type1", "Type2"],
      "description": "SOC 2 audit type"
    },
    "trustCategories": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["Security", "Availability", "ProcessingIntegrity", "Confidentiality", "Privacy"]
      }
    },
    "auditPeriod": {
      "type": "object",
      "properties": {
        "startDate": { "type": "string", "format": "date" },
        "endDate": { "type": "string", "format": "date" }
      }
    },
    "cloudProviders": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["AWS", "Azure", "GCP"]
      }
    },
    "controlMatrix": {
      "type": "string",
      "description": "Path to existing control matrix"
    },
    "evidenceBasePath": {
      "type": "string",
      "description": "Base path for evidence storage"
    }
  },
  "required": ["auditType", "trustCategories"]
}
```

## Output Schema

```json
{
  "type": "object",
  "properties": {
    "assessmentId": {
      "type": "string"
    },
    "auditType": {
      "type": "string"
    },
    "assessmentDate": {
      "type": "string",
      "format": "date-time"
    },
    "trustCategories": {
      "type": "array"
    },
    "controlSummary": {
      "type": "object",
      "properties": {
        "totalControls": { "type": "integer" },
        "implemented": { "type": "integer" },
        "partiallyImplemented": { "type": "integer" },
        "notImplemented": { "type": "integer" },
        "notApplicable": { "type": "integer" }
      }
    },
    "evidenceStatus": {
      "type": "object",
      "properties": {
        "collected": { "type": "integer" },
        "pending": { "type": "integer" },
        "missing": { "type": "integer" }
      }
    },
    "gapAnalysis": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "controlId": { "type": "string" },
          "gap": { "type": "string" },
          "remediation": { "type": "string" },
          "priority": { "type": "string" }
        }
      }
    },
    "auditPackage": {
      "type": "object",
      "properties": {
        "controlMatrix": { "type": "string" },
        "evidenceFolder": { "type": "string" },
        "systemDescription": { "type": "string" },
        "managementAssertion": { "type": "string" }
      }
    },
    "complianceScore": {
      "type": "number"
    }
  }
}
```

## Usage Example

```javascript
skill: {
  name: 'soc2-compliance-automator',
  context: {
    auditType: 'Type2',
    trustCategories: ['Security', 'Availability', 'Confidentiality'],
    auditPeriod: {
      startDate: '2024-01-01',
      endDate: '2024-12-31'
    },
    cloudProviders: ['AWS', 'Azure']
  }
}
```


---
Source attribution: a5c-ai
Original project: https://github.com/a5c-ai/babysitter
License: MIT
License information: https://opensource.org/license/mit
Original upstream instructions; downloaded from Mega AI Hub.

## Upstream license notice

MIT License

Copyright (c) 2026 Gabriel Moreira

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.



# Mega AI Hub resource metadata

Creator / publisher: a5c-ai
Original project: https://github.com/a5c-ai/babysitter
Attribution basis: Upstream repository explicitly recorded in package mirror path

Fields of work: Development & Engineering, Finance & Accounting, Legal, Operations, Sales
Roles: Auditor, Business Development, Compliance Officer, Operations Manager, Security Engineer
Specialties: API
Tools: AWS, Azure, GCP, Drata, Secureframe, Vanta
Country applicability: Country not specified
Classification basis: Source catalog labels
Instruction SHA-256: 14caf64285fa82adb4af5efb2dbc55f15e48e39cb997547307d594c2d1cf6e8a