soc2-trust-criteria-mapper

What problem does it solve?

This Skill prevents teams from scoping the wrong SOC 2 engagement by clarifying what system is in scope, which Trust Services Criteria categories belong in the report, and whether Type 1 or Type 2 is the right path.

Core Features & Use Cases

• Engagement scoping: Defines the system boundary, customer commitments, and report driver so the SOC 2 ask is properly framed.
• Category selection: Includes Security as the baseline and adds Availability, Processing Integrity, Confidentiality, or Privacy only when the commitment trace justifies it.
• Type decision support: Helps choose Type 1 versus Type 2, checks window feasibility, and hands the evidence window to the right downstream workflow.
• Control mapping: Maps SOC 2 criteria to existing controls and notes gaps, subservice organizations, and complementary controls.
• Use case: A SaaS company with uptime commitments needs to know whether to scope Availability into the report and whether to pursue a Type 1 or Type 2 examination first.

Quick Start

Ask the skill to scope our SOC 2 report for this product, identify the applicable trust categories, and recommend Type 1 or Type 2 with a feasible evidence window.