<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-soc2-trust-criteria
description: >-
  Audit SOC 2 Type II Trust Service Criteria across Security, Availability,
  Processing Integrity, Confidentiality, and Privacy categories. Automate
  evidence collection for Common Criteria CC1-CC9 with continuous monitoring.
domain: cybersecurity
subdomain: compliance-audit
tags:
  - soc2
  - trust-service-criteria
  - common-criteria
  - evidence-collection
  - compliance
  - audit
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Auditing SOC 2 Trust Criteria

## Overview

SOC 2 Type II evaluates an organization's controls over a 6-12 month observation
period against AICPA Trust Service Criteria. This skill automates evidence
collection for Common Criteria (CC1-CC9) and optional categories, producing
auditor-ready artifacts for CPA firm engagement.

Mode: `[MODE: BLUE]` — Evidence collection and control validation.

## Prerequisites

| Requirement | Details |
|---|---|
| InSpec (`gem install inspec`) | Required |
| AWS/GCP/Azure CLI (cloud evidence) | Required |
| Vanta/Drata API access (optional — SaaS compliance platforms) | Required |
| `jq` for JSON processing | Required |

## Key Concepts

### Trust Service Criteria Map

```
SOC 2 Trust Service Criteria:
├── Security (Common Criteria — always required)
│   ├── CC1: Control Environment
│   │   └── Board oversight, integrity values, HR policies
│   ├── CC2: Communication and Information
│   │   └── Internal/external communication of policies
│   ├── CC3: Risk Assessment
│   │   └── Risk identification, fraud risk, change impact
│   ├── CC4: Monitoring Activities
│   │   └── Ongoing monitoring, deficiency evaluation
│   ├── CC5: Control Activities
│   │   └── Control selection, technology controls, policy deployment
│   ├── CC6: Logical and Physical Access Controls
│   │   ├── CC6.1: Logical access security (IAM, MFA, RBAC)
│   │   ├── CC6.2: User provisioning/deprovisioning
│   │   ├── CC6.3: Role-based access, least privilege
│   │   ├── CC6.6: External threat boundaries
│   │   ├── CC6.7: Data movement restrictions
│   │   └── CC6.8: Malware prevention
│   ├── CC7: System Operations
│   │   ├── CC7.1: Vulnerability detection (scanning, patching)
│   │   ├── CC7.2: Anomaly monitoring (SIEM, IDS)
│   │   ├── CC7.3: Security event evaluation
│   │   └── CC7.4: Incident response execution
│   ├── CC8: Change Management
│   │   └── CC8.1: Change authorization, testing, approval
│   └── CC9: Risk Mitigation
│       └── CC9.1: Vendor risk, insurance, recovery
├── Availability (optional — SLA and uptime)
├── Processing Integrity (optional — data accuracy)
├── Confidentiality (optional — data protection)
└── Privacy (optional — personal information)
```

### Automated Evidence Collection

```bash
# CC6.1 — IAM configuration evidence
aws iam get-account-authorization-details --output json > /tmp/iam-config.json
aws iam generate-credential-report
aws iam get-credential-report --output json | jq '.Content' | \
  base64 -d > /tmp/credential-report.csv

# CC6.2 — User provisioning evidence (recent access changes)
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=CreateUser \
  --max-results 100 --output json > /tmp/user-provisioning.json

# CC7.1 — Vulnerability scan evidence
aws inspector2 list-findings --filter-criteria \
  '{"findingStatus":[{"comparison":"EQUALS","value":"ACTIVE"}]}' \
  --output json > /tmp/vuln-findings.json

# CC7.2 — SIEM/monitoring evidence
aws cloudwatch describe-alarms --state-value ALARM --output json > /tmp/alarms.json

# CC8.1 — Change management evidence (GitHub PRs with approvals)
gh pr list --state merged --limit 50 --json number,title,reviews,mergedAt \
  > /tmp/change-mgmt.json
```

### InSpec Profile — SOC 2 Common Criteria

```ruby
# controls/soc2_cc6.rb
control 'soc2-cc6.1-mfa' do
  impact 1.0
  title 'CC6.1 — MFA enabled for all IAM users'
  desc 'Logical access controls include multi-factor authentication.'
  tag soc2: 'CC6.1'
  tag nist: ['IA-2(1)']

  aws_iam_users.entries.each do |user|
    describe aws_iam_user(user.user_name) do
      it { should have_mfa_enabled }
    end
  end
end

control 'soc2-cc6.3-least-privilege' do
  impact 0.7
  title 'CC6.3 — No IAM users with AdministratorAccess'
  desc 'Role-based access enforces least privilege.'
  tag soc2: 'CC6.3'

  describe aws_iam_policies.where(policy_name: 'AdministratorAccess') do
    its('attachment_count') { should be <= 2 }
  end
end

# controls/soc2_cc7.rb
control 'soc2-cc7.2-logging' do
  impact 1.0
  title 'CC7.2 — CloudTrail enabled for anomaly monitoring'
  desc 'System operations include security event monitoring.'
  tag soc2: 'CC7.2'

  describe aws_cloudtrail_trails do
    it { should exist }
  end

  aws_cloudtrail_trails.trail_arns.each do |trail|
    describe aws_cloudtrail_trail(trail) do
      it { should be_logging }
      it { should be_multi_region_trail }
    end
  end
end
```

## Workflow

### Step 1: Collect Evidence Per Criteria

```bash
node scripts/agent.js --action collect --criteria cc6,cc7,cc8 \
  --environment aws --output /tmp/soc2-evidence.json
```

### Step 2: Validate Controls

```bash
node scripts/agent.js --action validate --profile ./controls/ \
  --output /tmp/soc2-validation.json
```

### Step 3: Generate Auditor Report

```bash
node scripts/agent.js --action report --input /tmp/soc2-validation.json \
  --output /tmp/soc2-report.json
```

## Verification

- [ ] Common Criteria CC1-CC9 have mapped evidence
- [ ] MFA enforced for all users (CC6.1)
- [ ] Access provisioning/deprovisioning tracked (CC6.2)
- [ ] Vulnerability scanning active (CC7.1)
- [ ] SIEM/log monitoring in place (CC7.2)
- [ ] Change management with approvals documented (CC8.1)
- [ ] Observation period covers 6-12 months for Type II
- [ ] Optional criteria (A, PI, C, P) scoped and evidenced if included

## References

- [AICPA Trust Service Criteria](https://www.aicpa.org/resources/decommissioned/trust-services-criteria)
- [SOC 2 Reporting Guide](https://us.aicpa.org/interestareas/frc/assuranceadvisoryservices/socforserviceorganizations)
