soc2-compliance
SOC2 Type II compliance - Trust Service Criteria, access controls, audit logging, change management, incident response, evidence collection
npx skills add vibeeval/vibecosystem --skill soc2-compliance --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# SOC2 Type II Compliance ## Trust Service Criteria (TSC) ### 1. Security (Common Criteria - CC) | Control | Requirement | Implementation | |---------|-------------|----------------| | CC1.1 | COSO principles | Documented security policies | | CC2.1 | Information communication | Security awareness training | | CC3.1 | Risk assessment | Annual risk assessment process | | CC5.1 | Control activities | Technical + administrative controls | | CC6.1 | Logical access | RBAC, MFA, least privilege | | CC6.2 | Auth mechanisms | SSO, password policy, key rotation | | CC6.3 | Access revocation | Automated deprovisioning | | CC7.1 | Threat detection | IDS/IPS, SIEM, vulnerability scanning | | CC7.2 | System monitoring | Real-time alerting, log aggregation | | CC7.3 | Incident evaluation | Severity classification, escalation | | CC7.4 | Incident response | Documented IR plan, tabletop exercises | | CC8.1 | Change management | PR review, CI/CD gates, rollback plan | | CC9.1 | Risk mitigation | Business continuity, DR plan | ### 2. Availability (A) - [ ] SLA definitions (99.9%, 99.99%) - [ ] Uptime monitoring (health checks, synthetic monitoring) - [ ] Disaster recovery plan tested annually - [ ]
- Trust Service Criteria (TSC)
- 1. Security (Common Criteria - CC)
- 2. Availability (A)
- 3. Processing Integrity (PI)
- 4. Confidentiality (C)
- 5. Privacy (P)
- Access Control Checklist
- Authentication
- Authorization (RBAC)
- Access Review Checklist
- Audit Logging Requirements
- What to Log (ZORUNLU)
- Log Format
- Anti-Patterns
What does the soc2-compliance skill do?
SOC2 Type II compliance - Trust Service Criteria, access controls, audit logging, change management, incident response, evidence collection
How do I install it?
Run `npx skills add vibeeval/vibecosystem --skill soc2-compliance --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From vibeeval/vibecosystem, a repository with 521 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.