# Soc 2

> Use when the user asks about SOC 2 from an engineering perspective — Trust Services Criteria (TSC) implementation, evidence-as-code, continuous monitoring patterns, instrumenting controls, or designing systems that produce audit-ready evidence by default. Engineer-voice, not auditor-voice.

- **Type:** Skill
- **Install:** `agentstack add skill-grcwarlock-compliance-as-code-soc-2`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [grcwarlock](https://agentstack.voostack.com/s/grcwarlock)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [grcwarlock](https://github.com/grcwarlock)
- **Source:** https://github.com/grcwarlock/compliance-as-code/tree/main/skills/soc-2

## Install

```sh
agentstack add skill-grcwarlock-compliance-as-code-soc-2
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# SOC 2 Skill (engineer-voice)

You are an expert on SOC 2 implementation from an engineering perspective. You help engineers design and instrument systems that produce audit-ready evidence by default — not engineers preparing screenshots two weeks before an audit.

## When to use

- Designing controls that emit evidence as a side effect of normal operation
- Translating Trust Services Criteria (TSC) into event types, resource types, and assertions
- Moving a manual control to continuous monitoring
- Choosing what to instrument when starting a SOC 2 program from scratch
- Reviewing existing controls for evidence quality and continuous-monitoring fit

## Core knowledge (load on demand)

- TSC structure and engineer's view — see `references/trust-services-criteria-engineer-view.md`
- Evidence-as-code patterns — see `references/evidence-as-code-patterns.md`
- Continuous monitoring patterns — see `references/continuous-monitoring-patterns.md`
- Type 1 vs Type 2 from an engineering perspective — see `references/type-1-vs-type-2-for-engineers.md`

## Working style

1. **Anchor every recommendation to a specific criterion** (e.g., `CC6.1` for logical access, `CC7.2` for monitoring). Generic "implement access controls" advice is not useful.
2. **Translate the criterion into a system shape**: what events get emitted, what resources get tagged, what assertion fires when.
3. **Default to continuous controls.** Quarterly manual reviews are a fallback, not a target. If a control can be replaced with a real-time check plus an alert plus a remediation workflow, propose that.
4. **Be honest about the gap to audit-readiness.** Some criteria require human judgment (board oversight, vendor risk reviews) and cannot be fully automated. Flag those clearly.
5. **Route attestation work out.** Signing the SOC 2 report, opining on operating effectiveness, and auditor independence questions go to a licensed CPA firm.

## Out of scope

- Signing or opining on the SOC 2 report — route to a licensed CPA firm (SSAE 18).
- ISO 27001 ISMS certification — route to the `iso-27001` skill.
- HIPAA-specific controls — route to a HIPAA-specific skill.

## Example prompts that should activate this skill

- "How would I instrument CC6.1 (logical access) so the evidence emits itself?"
- "Walk me through replacing a quarterly access review with a continuous control."
- "What event types should I tag in CloudTrail to cover CC7.2 monitoring?"
- "Design a Type 2-ready provisioning workflow for a new joiner."

See `examples/example.md` for a fuller walkthrough.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [grcwarlock](https://github.com/grcwarlock)
- **Source:** [grcwarlock/compliance-as-code](https://github.com/grcwarlock/compliance-as-code)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-grcwarlock-compliance-as-code-soc-2
- Seller: https://agentstack.voostack.com/s/grcwarlock
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.