soc2-compliance

Name: soc2-compliance
Author: BagelHole

42stars4forks

How to install soc2-compliance?

bagelhole/devops-security-agent-skills/soc2-compliance

$npx -y skills add BagelHole/DevOps-Security-Agent-Skills --skill soc2-compliance

Installs into the current project.

Summary

Implement SOC 2 Trust Services Criteria. Configure security, availability, and processing integrity controls. Use when achieving SOC 2 certification.

Files · 1

View on GitHub

SKILL.md

1	# SOC 2 Compliance
2
3	Implement SOC 2 Trust Services Criteria controls, evidence collection, and continuous compliance monitoring for Type I and Type II audits.
4
5	## When to Use
6
7	- Preparing for a SOC 2 Type I or Type II audit
8	- Mapping existing controls to Trust Services Criteria
9	- Automating evidence collection for auditor requests
10	- Building continuous compliance monitoring into CI/CD
11	- Onboarding new services and ensuring SOC 2 control coverage
12
13	## Trust Services Criteria Detailed Checklist
14
15	```yaml
16	security_common_criteria:
17	CC1_control_environment:
18	CC1.1: "Management demonstrates commitment to integrity and ethical values"
19	CC1.2: "Board exercises oversight of internal controls"
20	CC1.3: "Management establishes structure, authority, and responsibility"
21	CC1.4: "Commitment to competence - hire and retain qualified personnel"
22	CC1.5: "Individuals are held accountable for internal control responsibilities"
23	evidence:
24	- Code of conduct document
25	- Organizational chart
26	- Job descriptions with security responsibilities
27	- Board meeting minutes discussing security
28	- Background check policy and records
29
30	CC2_communication:
31	CC2.1: "Entity obtains or generates relevant quality information"
32	CC2.2: "Entity internally communicates information including objectives and responsibilities"
33	CC2.3: "Entity communicates with external parties"
34	evidence:
35	- Security awareness training records
36	- Internal security newsletters or updates
37	- Customer-facing security documentation
38	- Status page and incident communication records
39
40	CC3_risk_assessment:
41	CC3.1: "Entity specifies objectives clearly to identify and assess risks"
42	CC3.2: "Entity identifies risks to achievement of objectives"
43	CC3.3: "Entity considers potential for fraud"
44	CC3.4: "Entity identifies and assesses significant changes"
45	evidence:
46	- Annual risk assessment report
47	- Risk register with ratings and treatment plans
48	- Fraud risk assessment documentation
49	- Change management records
50
51	CC4_monitoring:
52	CC4.1: "Entity selects, develops, and performs ongoing/separate evaluations"
53	CC4.2: "Entity evaluates and communicates internal control deficiencies"
54	evidence:
55	- Continuous monitoring dashboard screenshots
56	- Internal audit reports
57	- Vulnerability scan results
58	- Penetration test reports
59
60	CC5_control_activities:
61	CC5.1: "Entity selects and develops control activities to mitigate risks"
62	CC5.2: "Entity selects and develops technology-based controls"
63	CC5.3: "Entity deploys control activities through policies and procedures"
64	evidence:
65	- Information security policy
66	- Access control procedures
67	- Change management procedures
68	- Encryption standards documentation
69
70	CC6_logical_access:
71	CC6.1: "Logical access security over protected information assets"
72	CC6.2: "Prior to access, users are registered and authorized"
73	CC6.3: "Access to data, software, functions, and other IT resources is authorized and modified"
74	CC6.6: "Logical access security measures against threats from outside system boundaries"
75	CC6.7: "Transmission of data between parties is protected"
76	CC6.8: "Controls to prevent or detect unauthorized or malicious software"
77	evidence:
78	- IAM credential report
79	- MFA enforcement configuration
80	- Access review completion records
81	- Firewall and WAF configurations
82	- TLS/encryption configurations
83	- Endpoint protection deployment records
84
85	CC7_system_operations:
86	CC7.1: "Detect anomalies and potential security incidents"
87	CC7.2: "Monitor system components for anomalies"
88	CC7.3: "Evaluate detected events and determine incidents"
89	CC7.4: "Respond to identified security incidents"
90	CC7.5: "Identify and remediate security incidents"
91	evidence:
92	- SIEM alert rules and dashboards
93	- Monitoring configuration (CloudWatch, Datadog, etc.)
94	- Incident response plan
95	- Incident tickets and post-mortems
96
97	CC8_change_management:
98	CC8.1: "Entity authorizes, designs, develops, configures, documents, tests, approves, and implements changes"
99	evidence:
100	- Change management policy
101	- Pull request approval requirements
102	- CI/CD pipeline configurations
103	- Deployment records with approvals
104
105	CC9_risk_mitigation:
106	CC9.1: "Entity identifies, selects, and develops risk mitigation activities"
107	CC9.2: "Entity assesses and manages risks associated with vendors"
108	evidence:
109	- Risk treatment plans
110	- Vendor assessment records
111	- Business associate agreements
112	- Insurance certificates
113
114	availability_criteria:
115	A

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

soc2-compliance

42stars4forks

View on GitHub

How to install soc2-compliance?

bagelhole/devops-security-agent-skills/soc2-compliance

$npx -y skills add BagelHole/DevOps-Security-Agent-Skills --skill soc2-compliance

Installs into the current project.

Summary

Implement SOC 2 Trust Services Criteria. Configure security, availability, and processing integrity controls. Use when achieving SOC 2 certification.

Files · 1

View on GitHub

SKILL.md

1	# SOC 2 Compliance
2
3	Implement SOC 2 Trust Services Criteria controls, evidence collection, and continuous compliance monitoring for Type I and Type II audits.
4
5	## When to Use
6
7	- Preparing for a SOC 2 Type I or Type II audit
8	- Mapping existing controls to Trust Services Criteria
9	- Automating evidence collection for auditor requests
10	- Building continuous compliance monitoring into CI/CD
11	- Onboarding new services and ensuring SOC 2 control coverage
12
13	## Trust Services Criteria Detailed Checklist
14
15	```yaml
16	security_common_criteria:
17	CC1_control_environment:
18	CC1.1: "Management demonstrates commitment to integrity and ethical values"
19	CC1.2: "Board exercises oversight of internal controls"
20	CC1.3: "Management establishes structure, authority, and responsibility"
21	CC1.4: "Commitment to competence - hire and retain qualified personnel"
22	CC1.5: "Individuals are held accountable for internal control responsibilities"
23	evidence:
24	- Code of conduct document
25	- Organizational chart
26	- Job descriptions with security responsibilities
27	- Board meeting minutes discussing security
28	- Background check policy and records
29
30	CC2_communication:
31	CC2.1: "Entity obtains or generates relevant quality information"
32	CC2.2: "Entity internally communicates information including objectives and responsibilities"
33	CC2.3: "Entity communicates with external parties"
34	evidence:
35	- Security awareness training records
36	- Internal security newsletters or updates
37	- Customer-facing security documentation
38	- Status page and incident communication records
39
40	CC3_risk_assessment:
41	CC3.1: "Entity specifies objectives clearly to identify and assess risks"
42	CC3.2: "Entity identifies risks to achievement of objectives"
43	CC3.3: "Entity considers potential for fraud"
44	CC3.4: "Entity identifies and assesses significant changes"
45	evidence:
46	- Annual risk assessment report
47	- Risk register with ratings and treatment plans
48	- Fraud risk assessment documentation
49	- Change management records
50
51	CC4_monitoring:
52	CC4.1: "Entity selects, develops, and performs ongoing/separate evaluations"
53	CC4.2: "Entity evaluates and communicates internal control deficiencies"
54	evidence:
55	- Continuous monitoring dashboard screenshots
56	- Internal audit reports
57	- Vulnerability scan results
58	- Penetration test reports
59
60	CC5_control_activities:
61	CC5.1: "Entity selects and develops control activities to mitigate risks"
62	CC5.2: "Entity selects and develops technology-based controls"
63	CC5.3: "Entity deploys control activities through policies and procedures"
64	evidence:
65	- Information security policy
66	- Access control procedures
67	- Change management procedures
68	- Encryption standards documentation
69
70	CC6_logical_access:
71	CC6.1: "Logical access security over protected information assets"
72	CC6.2: "Prior to access, users are registered and authorized"
73	CC6.3: "Access to data, software, functions, and other IT resources is authorized and modified"
74	CC6.6: "Logical access security measures against threats from outside system boundaries"
75	CC6.7: "Transmission of data between parties is protected"
76	CC6.8: "Controls to prevent or detect unauthorized or malicious software"
77	evidence:
78	- IAM credential report
79	- MFA enforcement configuration
80	- Access review completion records
81	- Firewall and WAF configurations
82	- TLS/encryption configurations
83	- Endpoint protection deployment records
84
85	CC7_system_operations:
86	CC7.1: "Detect anomalies and potential security incidents"
87	CC7.2: "Monitor system components for anomalies"
88	CC7.3: "Evaluate detected events and determine incidents"
89	CC7.4: "Respond to identified security incidents"
90	CC7.5: "Identify and remediate security incidents"
91	evidence:
92	- SIEM alert rules and dashboards
93	- Monitoring configuration (CloudWatch, Datadog, etc.)
94	- Incident response plan
95	- Incident tickets and post-mortems
96
97	CC8_change_management:
98	CC8.1: "Entity authorizes, designs, develops, configures, documents, tests, approves, and implements changes"
99	evidence:
100	- Change management policy
101	- Pull request approval requirements
102	- CI/CD pipeline configurations
103	- Deployment records with approvals
104
105	CC9_risk_mitigation:
106	CC9.1: "Entity identifies, selects, and develops risk mitigation activities"
107	CC9.2: "Entity assesses and manages risks associated with vendors"
108	evidence:
109	- Risk treatment plans
110	- Vendor assessment records
111	- Business associate agreements
112	- Insurance certificates
113
114	availability_criteria:
115	A

People who liked this also viewed

6 picks

Type