# Soc2 Readiness > Assess SOC 2 readiness across the Trust Services Criteria and produce a gap remediation plan. Use when asked to prepare for a SOC 2 audit, run a SOC 2 readiness/gap assessment, scope controls, or get audit-ready. Produces a readiness report — scope & criteria, a control-by-control status, a weighted readiness score, prioritised gaps with owners, and the evidence each control needs. - **Type:** Skill - **Install:** `agentstack add skill-mohitagw15856-pm-claude-skills-soc2-readiness` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [mohitagw15856](https://agentstack.voostack.com/s/mohitagw15856) - **Installs:** 0 - **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml) - **Latest version:** 0.1.0 - **License:** MIT - **Upstream author:** [mohitagw15856](https://github.com/mohitagw15856) - **Source:** https://github.com/mohitagw15856/pm-claude-skills/tree/main/plugins/pm-compliance/skills/soc2-readiness - **Website:** https://mohitagw15856.github.io/pm-claude-skills/ ## Install ```sh agentstack add skill-mohitagw15856-pm-claude-skills-soc2-readiness ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # SOC 2 Readiness Skill A SOC 2 audit fails on two things: missing controls and missing *evidence* of controls you actually run. This skill scopes the engagement to the right Trust Services Criteria, assesses each control's status honestly, scores readiness deterministically (so "we're basically ready" becomes a number), and turns the gaps into a prioritised, owned remediation plan with the evidence each control must produce. ## Required Inputs Ask for these only if they aren't already provided: - **Report type & period** — SOC 2 Type I (point in time) or Type II (a window, usually 3–12 months). - **In-scope criteria** — Security (always), plus any of Availability, Confidentiality, Processing Integrity, Privacy. Don't include criteria you can't evidence. - **Systems in scope** — the product/infra boundary the report covers. - **Current control state** — what's implemented, partially implemented, or missing (be honest; auditors test, they don't take your word). ## Output Format ### SOC 2 Readiness: [company] — [Type I/II], [period] **1. Scope** — the systems, the in-scope criteria, and explicitly what's out of scope. **2. Control status** — a table grouped by criterion; status is `met` / `partial` / `gap`. | Criterion | Control | Status | Evidence it needs | Owner | |---|---|---|---|---| | Security (CC6) | Access reviews quarterly | partial | Signed access-review records | IT | **3. Readiness score** — overall and per-criterion %, from the helper script (so it's consistent, not vibes). State the bar: a readiness assessment isn't a pass, but <~85% means you're not audit-ready. **4. Prioritised gaps** — ranked by risk × effort: what to fix first, the owner, and the target date. **5. Evidence plan** — for a Type II especially: what evidence must be *collected continuously over the period* (you can't backfill a quarter of access reviews the week before the audit). ## Programmatic Helper `scripts/soc2_score.py` (stdlib only) scores readiness from a control list so the number is calculated, not estimated: ```bash # controls.json: [{"criterion":"Security","control":"...","status":"met|partial|gap","weight":1}, ...] python3 scripts/soc2_score.py controls.json python3 scripts/soc2_score.py controls.json --json # machine-readable, for chaining ``` It returns per-criterion and overall readiness (met=1.0, partial=0.5, gap=0) and lists the gaps. ## Quality Checks - [ ] Only criteria the org can actually evidence are in scope (don't add Privacy to look thorough) - [ ] Every control names the specific evidence an auditor would request - [ ] The readiness score is computed from the control list, not asserted - [ ] For Type II, the plan distinguishes "implement the control" from "accumulate evidence over the period" - [ ] Gaps are prioritised by risk and have an owner and date — not a flat list ## Anti-Patterns - [ ] Do not confuse a readiness assessment with a passed audit — readiness is self-assessed; the report comes from a licensed CPA firm - [ ] Do not claim a control is "met" without the evidence to prove it — auditors test operating effectiveness, not intentions - [ ] Do not over-scope criteria — every criterion you add is more controls to evidence; include only what's true and needed - [ ] Do not leave gaps unowned or undated — an unowned gap is a gap that's still open at audit time - [ ] Do not try to backfill Type II evidence — controls must demonstrably operate across the whole period ## Based On AICPA SOC 2 Trust Services Criteria (Security, Availability, Confidentiality, Processing Integrity, Privacy). ## Source & license This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [mohitagw15856](https://github.com/mohitagw15856) - **Source:** [mohitagw15856/pm-claude-skills](https://github.com/mohitagw15856/pm-claude-skills) - **License:** MIT - **Homepage:** https://mohitagw15856.github.io/pm-claude-skills/ Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** no - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/skill-mohitagw15856-pm-claude-skills-soc2-readiness - Seller: https://agentstack.voostack.com/s/mohitagw15856 - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.