> 移植说明：本 Skill 来自 MIT 开源仓库（alirezarezvani/claude-skills 或 ComposioHQ/awesome-claude-skills），移植到 SkillHub/WorkBuddy 供中文用户使用，正文保持原样，输出可要求用中文呈现。
/compliance-os:soc2-audit-prep — SOC 2 Type II Forcing Questions
Command: /compliance-os:soc2-audit-prep <scope>
The SOC 2 Type II auditor pressure-tests any SOC 2 work. Six observation-period-disciplined questions before any Type II cycle.
When to Run
- Pre-observation period (months 1-2 of cycle)
- Mid-observation period (month 6 checkpoint)
- Pre-field-test (month 10)
- Post-report (planning next cycle)
- After scope change (adding TSC category)
- After major incident during observation period
The Six SOC 2 Type II Questions
1. What's the scope, and which TSC categories are in?
Security always required; others elective based on customer ask.
- Common Criteria (CC1-CC9) under Security always
- Availability (A1): for SaaS with SLA commitments
- Processing Integrity (PI1): for systems processing transactional / financial data
- Confidentiality (C1): for systems handling proprietary / confidential data
- Privacy (P1-P8): for systems handling personal data (overlap with GDPR if applicable)
- AICPA AT-C 205 description of system: complete + accurate + boundaries clear
2. Did any control skip a cycle during observation period?
Type II requires consistent operation — single skipped cycle = likely exception.
- Quarterly controls (e.g., access reviews): all 4 quarters covered
- Monthly controls (e.g., vulnerability scans): all months covered
- Continuous controls (e.g., logging): no gaps during period
- Annual controls (e.g., BCP exercises, training): completed within period
3. Show me the change-management evidence for any control implemented mid-period.
Mid-period changes = high audit risk.
- New controls implemented during observation: documented with change-management
- Modified controls: rationale + effective date + impact on prior samples
- Removed controls: rationale + customer impact assessment
- Strategy: avoid mid-period changes; defer to next cycle
4. Where's the exception log, and what's the materiality assessment?
Real-time exception logging — not retroactive.
- Each exception logged when discovered, not at audit time
- Per exception: what / when / impact / remediation / owner
- Materiality assessment: does the exception affect overall control operation?
- Audit firm threshold: typically 1-2 exceptions per control acceptable; 3+ = finding
5. Show me sample evidence from each TSC criterion in the FIRST month of observation.
Not the last week — the first month.
- Audit firm samples across the observation period
- Front-loaded evidence demonstrates operational discipline
- Back-loaded evidence (last 30 days) = "scrambling" signal
- Sample IDs should be reproducible from operational systems
6. What's the cross-walk to ISO 27001, and which evidence reuses?
75% control overlap — the canonical pair.
- Run cross_framework_mapper.py for HIGH-confidence overlap themes
- Each shared artefact cited by both audits (one collection, two reports)
- Coordinate audit calendar with cs-ciso-iso27001
- Avoid producing duplicate evidence files for same control
Workflow
# 1. Scoping + gap analysis (pre-observation)
python ${CLAUDE_PLUGIN_ROOT}/vendor/ra-qm-team/soc2-compliance/scripts/gap_analyzer.py current_state.json
# 2. Control matrix with ISO 27001 cross-walk
python ${CLAUDE_PLUGIN_ROOT}/vendor/ra-qm-team/soc2-compliance/scripts/control_matrix_builder.py program.json
# 3. Continuous evidence tracking (during observation)
python ${CLAUDE_PLUGIN_ROOT}/vendor/ra-qm-team/soc2-compliance/scripts/evidence_tracker.py evidence_log.json
# 4. Mock audit (pre-field-test month 10)
python ../../skills/compliance-os/scripts/audit_simulator.py soc2_scope.json
Output Format
# SOC 2 Type II Audit Prep: <scope>
**Date:** YYYY-MM-DD
**Observation Period:** YYYY-MM-DD to YYYY-MM-DD
## The Decision Being Made
[scoping | pre-observation | observation-status | pre-field | report-response]
## TSC Scope
- Security: included
- Availability: <yes/no>
- Processing Integrity: <yes/no>
- Confidentiality: <yes/no>
- Privacy: <yes/no>
## Observation Period Status
- Months elapsed: N / 12
- Controls operated consistently: % of total
- Cycle skips identified: <list>
- Mid-period control changes: N (each documented with change-mgmt: yes/no)
## Exception Log
- Total exceptions logged: N
- Per-control max exceptions: M (audit firm tolerance: typically 1-2)
- Material exceptions (overall control affected): <list>
- Remediation status per exception: complete/in-progress
## Sample Evidence Coverage
- Month 1-3 evidence: complete/gaps
- Month 4-6 evidence: complete/gaps
- Month 7-9 evidence: complete/gaps
- Month 10-12 evidence: complete/gaps (only for pre-report status)
## ISO 27001 Cross-Walk Reuse
- HIGH-confidence overlap themes: N
- Shared artefacts in evidence pool: <count>
- Duplicate evidence collection avoided: % savings
## Audit Firm Readiness
- Scoping discussion: complete/pending
- Description of system per AT-C 205: complete/pending
- Walkthrough rehearsal: complete/pending
- Sample preparation: complete/pending
## Verdict
🟢 ON-TRACK | 🟡 NEEDS-ATTENTION | 🔴 MATERIAL-RISK
## Top 3 Actions
[3 concrete next steps with owner + observation-period timing]
Routing
/compliance-os:compliance-readiness— for multi-framework view/compliance-os:iso27001-audit-prep— for ISO 27001 cross-walk pair (75% overlap)/compliance-os:gdpr-audit-prep— for Privacy TSC overlap/c-level-agents:ciso-review— for executive cybersecurity strategy
Related
- Agent:
cs-soc2-auditor - Skill:
soc2-compliance - Playbook: soc2_audit_playbook.md
- Adjacent:
../iso27001-audit-prep/,../gdpr-audit-prep/,../compliance-readiness/
Version: 1.0.0
