soc2-audit-prep

原文涵盖的主题

• /compliance-os:soc2-audit-prep — SOC 2 Type II Forcing Questions
• When to Run
• The Six SOC 2 Type II Questions
• 1. What's the scope, and which TSC categories are in?
• 2. Did any control skip a cycle during observation period?
• 3. Show me the change-management evidence for any control implemented mid-period.
• 4. Where's the exception log, and what's the materiality assessment?
• 5. Show me sample evidence from each TSC criterion in the FIRST month of observation.

Command: /compliance-os:soc2-audit-prep The SOC 2 Type II auditor pressure-tests any SOC 2 work. Six observation-period-disciplined questions before any Type II cycle. Pre-observation period (months 1-2 of cycle) Mid-observation period (month 6 checkpoint) Pre-field-test (month 10) Post-report (planning next cycle) After scope change (adding TSC category) After major incident during observation period Security always required; others elective based on customer ask. Common Criteria (CC1-CC9) under Security always Availability (A1): for SaaS with SLA commitments Processing Integrity (PI1): for systems processing transactional / financial data Confidentiality (C1): for systems handling proprietary / confidential data Privacy (P1-P8): for systems handling personal data (overlap with GDPR if applicable) AICPA AT-C 205 description of system: complete + accurate + boundaries clear Type II requires consistent operation — single skipped cycle = likely exception. Quarterly controls (e.g., access reviews): all 4 quarters covered Monthly controls (e.g., vulnerability scans): all months covered Continuous controls (e.g., logging): no gaps during period Annual controls (e.g., BCP exercises, trai

这里只展示节选，请以完整原文和当前要求为准。