soc2-trust-services-criteria

SOC 2 Trust Services Criteria

Overview

This skill maps technical and operational controls to AICPA Trust Services Criteria (TSC) used in SOC 2 examinations. The Security category (Common Criteria CC1.0–CC9.0) is mandatory for all SOC 2 reports. Additional categories apply based on report scope:

Category	Prefix	When in scope
Security	CC	Always
Availability	A	Uptime/performance commitments
Confidentiality	C	Confidential information protection
Processing Integrity	PI	Complete/valid processing
Privacy	P	Personal information lifecycle

For AI agent and MCP architectures, focus areas include CC6 (logical access), CC7 (system operations/monitoring), CC8 (change management), CC9 (risk mitigation), and category-specific criteria when processing customer or PHI-adjacent data.

When to Use

Use this skill when:

• Scoping a SOC 2 audit or readiness assessment
• Gap analysis against TSC for agent platforms, MCP integrations, or compliance tooling
• Mapping existing controls (IAM, logging, change management) to CC/A/C/PI/P points of focus
• Preparing control narratives for auditors
• Determining which TSC categories apply to a product or internal system
• Cross-walking HIPAA or PCI controls to SOC 2 for unified compliance programs

Do not use this skill when:

• Collecting screenshots and exports (use soc2-evidence-collection)
• Implementing CCM dashboards (use soc2-ccm-continuous-monitoring)
• HIPAA BAA legal review (use hipaa-baa-vendor-assessment)

Core Process

Execute steps in order.

Step 1: Report scope definition

1. Document system description boundaries:
   • Agent runtime, skills repository, MCP servers, evidence store, identity provider
   • Cloud regions, subservice organizations (carve-out vs inclusive method)
2. Select TSC categories in scope (minimum: Security).
3. Define trust boundaries: where customer data enters, processes, exits.
4. Artifact: soc2-scope-{id}.json.