/service-auditor-prep

description: Generate complete auditor-ready evidence package for SOC 2

SOC 2 Service Auditor Preparation

Generates a comprehensive, auditor-ready evidence package for SOC 2 Type I or Type II audits, including automated evidence collection, organization by TSC control, PBC (Provided By Client) list generation, and evidence matrix.

Usage

/soc2:service-auditor-prep [period] [options]

Arguments

• `$1` - Audit period (optional): "2024", "2024-Q1-Q4", or "2024-01-01:2024-12-31" (default: current year)
• `$2` - Options (optional): `--type=type1|type2`, `--output-dir=path`, `--controls=CC6,CC7`, `--format=zip|tar`

Examples

# Generate full year Type II package
/soc2:service-auditor-prep 2024 --type=type2

# Generate specific quarter Type I
/soc2:service-auditor-prep 2024-Q4 --type=type1

# Specific controls only
/soc2:service-auditor-prep 2024 --controls=CC6,CC7,CC8

# Custom output directory
/soc2:service-auditor-prep 2024 --output-dir=/mnt/secure-drive/soc2-audit

# Generate and compress as zip
/soc2:service-auditor-prep 2024 --format=zip

Output

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SOC 2 SERVICE AUDITOR EVIDENCE PACKAGE GENERATOR
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Organization: Your Company, Inc.
Audit Period: January 1, 2024 - December 31, 2024 (12 months)
Audit Type: Type II (Period Testing)
Trust Service Criteria: Security (CC1-CC9)
Package Date: 2025-01-28
Auditor: Example Audit LLP

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
PHASE 1: EVIDENCE COLLECTION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Collecting automated evidence from AWS...

✓ CC6.1 - Access Control
  ✓ IAM users list (Q1 2024)                      → iam-users-2024-Q1.json
  ✓ IAM users list (Q2 2024)                      → iam-users-2024-Q2.json
  ✓ IAM users list (Q3 2024)                      → iam-users-2024-Q3.json
  ✓ IAM users list (Q4 2024)                      → iam-users-2024-Q4.json
  ✓ IAM credential report (quarterly snapshots)   → credential-report-*.csv
  ✓ Access Analyzer findings (full period)        → access-analyzer-2024.json
  ✓ CloudTrail IAM events (full period)           → cloudtrail-iam-2024.json.gz
  ✓ MFA status report (quarterly)                 → mfa-status-*.json
  Total: 16 files, 124 MB

✓ CC6.7 - Encryption at Rest
  ✓ S3 bucket encryption config (all 50 buckets)  → s3-encryption-config.json
  ✓ RDS encryption config (all 12 instances)      → rds-encryption-config.json
  ✓ EBS encryption config (all 89 volumes)        → ebs-encryption-config.json
  ✓ KMS key usage (customer-managed keys)         → kms-keys-config.json
  Total: 4 files, 2.1 MB

✓ CC6.8 - Encryption in Transit
  ✓ ALB listener configuration (HTTPS only)       → alb-https-config.json
  ✓ CloudFront TLS configuration                  → cloudfront-tls-config.json
  ✓ ACM certificate inventory                     → acm-certificates.json
  ✓ SSL Labs scan results (monthly)               → ssl-labs-*.json
  Total: 16 files, 8.4 MB

✓ CC7.1 - System Monitoring
  ✓ CloudWatch alarms configuration               → cloudwatch-alarms.json
  ✓ GuardDuty findings (full period)              → guardduty-findings-2024.json
  ✓ Security Hub compliance status                → security-hub-2024.json
  ✓ SNS notification logs                         → sns-notifications-2024.json
  Total: 4 files, 45 MB

✓ CC7.2 - Audit Logging
  ✓ CloudTrail configuration                      → cloudtrail-config.json
  ✓ CloudWatch Logs retention policy              → logs-retention-config.json
  ✓ S3 access logs (full period)                  → s3-access-logs-2024.tar.gz
  ✓ VPC Flow Logs (samples from each quarter)     → vpc-flow-logs-*.json
  Total: 8 files, 2.4 GB

✓ CC7.5 - Backup and Recovery
  ✓ RDS backup configuration                      → rds-backups-config.json
  ✓ S3 versioning configuration                   → s3-versioning-config.json
  ✓ AMI backup inventory                          → ami-backups-2024.json
  ✓ DR test results (quarterly)                   → dr-test-*.pdf
  Total: 8 files, 124 MB

✓ CC8.1 - Change Management
  ✓ Terraform state changes (full period)         → terraform-changes-2024.json
  ✓ AWS Config change history                     → config-changes-2024.json
  ✓ GitHub commit history                         → github-commits-2024.json
  ✓ Jira change tickets (all approved changes)    → jira-changes-2024.csv
  Total: 4 files, 89 MB

Automated Evidence Summary:
  Total Files: 64
  Total Size: 2.8 GB
  Collection Time: 14 minutes
  Missing: 0 files (100% complete)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
PHASE 2: MANUAL EVIDENCE ORGANIZATION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Please provide the following manual evidence:

Required Policies (11 documents):
□ Information Security Policy (v2.1 or later, signed)
  → Copy to: ./evidence/policies/information-security-policy.pdf

□ Access Control Policy (v1.8 or later, signed)
  → Copy to: ./evidence/policies/access-control-policy.pdf

□ Change Management Policy (v1.4 or later, signed)
  → Copy to: ./evidence/policies/change-management-policy.pdf

□ Incident Response Policy (v2.0 or later, signed)
  → Copy to: ./evidence/policies/incident-response-policy.pdf

□ Disaster Recovery Plan (v3.2 or later, signed)
  → Copy to: ./evidence/policies/disaster-recovery-plan.pdf

□ Acceptable Use Policy (v1.6 or later, signed)
  → Copy to: ./evidence/policies/acceptable-use-policy.pdf

□ Data Classification Policy (v1.2 or later, signed)
  → Copy to: ./evidence/policies/data-classification-policy.pdf

□ Encryption Policy (v1.5 or later, signed)
  → Copy to: ./evidence/policies/encryption-policy.pdf

□ Vendor Management Policy (v1.3 or later, signed)
  → Copy to: ./evidence/policies/vendor-management-policy.pdf

□ Business Continuity Plan (v2.8 or later, signed)
  → Copy to: ./evidence/policies/business-continuity-plan.pdf

□ Risk Management Policy (v1.9 or later, signed)