soc2-compliance-automator

# SOC 2 Compliance Automator Skill

## Purpose

Automate SOC 2 Trust Services Criteria (TSC) compliance activities including control mapping, evidence collection, audit preparation, and continuous compliance monitoring.

## Capabilities

### Control Mapping
- Map organizational controls to SOC 2 TSC requirements
- Cover all five Trust Services Categories:
  - Security (Common Criteria)
  - Availability
  - Processing Integrity
  - Confidentiality
  - Privacy
- Generate control matrices with evidence requirements
- Identify control gaps and coverage

### Evidence Collection
- Automate evidence gathering from cloud providers
- Collect access control configurations (IAM, RBAC)
- Capture security configurations and policies
- Document change management processes
- Archive audit logs and monitoring data
- Screenshot automation for manual controls

### Audit Preparation
- Generate Type I and Type II audit packages
- Prepare management assertion documents
- Create system description documents
- Organize evidence by control objective
- Generate auditor-ready reports

### Control Effectiveness Tracking
- Monitor control implementation status
- Track control testing results
- Document control exceptions
- Manage remediation activities
- Calculate compliance scores

### Continuous Compliance
- Monitor control drift and changes
- Alert on compliance deviations
- Track evidence freshness
- Generate compliance dashboards
- Automate periodic control testing

## Trust Services Categories

### CC - Common Criteria (Security)
- CC1: Control Environment
- CC2: Communication and Information
- CC3: Risk Assessment
- CC4: Monitoring Activities
- CC5: Control Activities
- CC6: Logical and Physical Access Controls
- CC7: System Operations
- CC8: Change Management
- CC9: Risk Mitigation

### A - Availability
- System availability commitments
- Disaster recovery and business continuity
- Capacity planning and monitoring

### PI - Processing Integrity
- Data processing accuracy
- Completeness and timeliness
- Error handling procedures

### C - Confidentiality
- Data classification
- Encryption requirements
- Access restrictions

### P - Privacy
- Privacy notice and consent
- Data subject rights
- Data retention and disposal

## Integrations

- **Vanta**: Automated security and compliance
- **Drata**: Continuous compliance automation
- **Secureframe**: Security compliance platform
- **AWS/Azure/GCP APIs**: Cloud configuration evidence
- **Identity Providers**: Access control evidence
- **SIEM Systems**: Log and monitoring evidence

## Target Processes

- SOC 2 Compliance Audit Preparation
- Continuous Compliance Monitoring
- Security Control Assessment
- Audit Readiness Review

## Input Schema

```json
{
  "type": "object",
  "properties": {
    "auditType": {
      "type": "string",
      "enum": ["Type1", "Type2"],
      "description": "SOC 2 audit type"
    },
    "trustCategories": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["Security", "Availability", "ProcessingIntegrity", "Confidentiality", "Privacy"]
      }
    },
    "auditPeriod": {
      "type": "object",
      "properties": {
        "startDate": { "type": "string", "format": "date" },
        "endDate": { "type": "string", "format": "date" }
      }
    },
    "cloudProviders": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["AWS", "Azure", "GCP"]
      }
    },
    "controlMatrix": {
      "type": "string",
      "description": "Path to existing control matrix"
    },
    "evidenceBasePath": {
      "type": "string",
      "description": "Base path for evidence storage"
    }
  },
  "required": ["auditType", "trustCategories"]
}
```

## Output Schema

```json
{
  "type": "object",
  "properties": {
    "assessmentId": {
      "type": "string"
    },
    "auditType": {
      "type": "string"
    },
    "assessmentDate": {
      "type": "string",
      "format": "date-time"
    },
    "trustCategories": {
      "type": "array"
    },
    "controlSummary": {
      "type": "object",
      "properties": {
        "totalControls": { "type": "integer" },
        "implemented": { "type": "integer" },
        "partiallyImplemented": { "type": "integer" },
        "notImplemented": { "type": "integer" },
        "notApplicable": { "type": "integer" }
      }
    },
    "evidenceStatus": {
      "type": "object",
      "properties": {
        "collected": { "type": "integer" },
        "pending": { "type": "integer" },
        "missing": { "type": "integer" }
      }
    },
    "gapAnalysis": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "controlId": { "type": "string" },
          "gap": { "type": "string" },
          "remediation": { "type": "string" },
          "priority": { "type": "string" }
        }
      }
    },
    "auditPackage": {
      "type": "object",
      "properties": {
        "controlMatrix": { "type": "string" },
        "evidenceFolder": { "type": "string" },
        "systemDescription": { "type": "string" },
        "managementAssertion": { "type": "string" }
      }
    },
    "complianceScore": {
      "type": "number"
    }
  }
}
```

## Usage Example

```javascript
skill: {
  name: 'soc2-compliance-automator',
  context: {
    auditType: 'Type2',
    trustCategories: ['Security', 'Availability', 'Confidentiality'],
    auditPeriod: {
      startDate: '2024-01-01',
      endDate: '2024-12-31'
    },
    cloudProviders: ['AWS', 'Azure']
  }
}
```