Use soc2-evidence-map

Map an organisation's controls to the SOC 2 Trust Services Criteria in scope (Security always, plus Availability, Confidentiality, Processing Integrity or Privacy if…

Map an organisation's controls to the SOC 2 Trust Services Criteria in scope (Security always, plus Availability, Confidentiality, Processing Integrity or Privacy if chosen), and for each control list the evidence an auditor will ask for, the system it lives in, the owner, how often it is produced, and the gaps — distinguishing Type I (designed and in place at a date) from Type II (operating over a period, sampled from a full population) — as a table and a CSV the team can work from.

Reach for it when the user is preparing for a SOC 2 audit or readiness assessment, says "SOC 2 evidence", "map our controls to the TSC", "what will the auditor ask for", "SOC 2 gap analysis".

Install it

npx skilldrop-cli install soc2-evidence-map                 # Claude Code, your user folder
npx skilldrop-cli install soc2-evidence-map --project       # Claude Code, this repo
npx skilldrop-cli install soc2-evidence-map --ide cursor    # or kiro, codex, antigravity, copilot

It is part of the Governance, risk and compliance pack: --pack grc installs it with its neighbours.

Ask for it

Say it the way you would to a colleague. Requests like these route to it:

• "Map our controls to the SOC 2 Trust Services Criteria and tell me what evidence the auditor will ask for"
• "We're moving from SOC 2 Type I to Type II, what do we need to start recording?"
• "Build a SOC 2 gap analysis spreadsheet with owners and systems for each control"
• "What evidence do we need for CC6.2 and CC8.1 in our SOC 2 audit?"

Requests like these belong to a different skill, so it shouldn't answer them:

• "Build a STRIDE threat model for our new data pipeline"
• "Create a risk register for the company with a heat map"
• "Write the non-functional requirements for availability and security of the billing service"

If another skill answers instead, ask for this one by name: "use soc2-evidence-map".

Check what you get

A good result:

• Every criterion in scope has a control or is listed as a gap. The coverage table shows it.
• Every control is written as who, what, how often, with what record. No adjectives in place of a mechanism.
• Evidence is specific to the report type: Type I names design evidence; Type II names the population, its source system, and the per-sample record.
• Criteria IDs appear only where reference.md gives them; anything else is described in words.
• System, owner and frequency are filled for every row, or the blank is itself a gap.
• Status is honest: a control with no record, or one that started mid-period, is not in place.
• Proposed controls are marked proposed, never presented as existing.

See a worked example

• northwind type2 security

Use something else when

• Finding security threats in a system design: use threat-model
• Scoring business risks for a risk committee: use risk-register; SOC 2's risk assessment criteria expect one, and this map can point to it
• A GDPR assessment of one processing activity: use dpia
• Writing the security or reliability targets for a service: use nfr-spec
• A policy for staff use of AI tools: use ai-usage-policy

Where a loop runs it

• Stage evidence of the comply loop

Next

• SKILL.md, the instructions the agent reads
• Its page on the site
• Related: ai-usage-policy, dpia, nfr-spec, risk-register, threat-model

Edit this page on GitHub · View source