Skip to content

Skills tagged SOC 2

29 skills relate to SOC 2. The tag says which framework a skill relates to; the skills contain no text from it.

Acceptable use policy draftingUse this skill when a company needs rules for how staff use company systems, data, devices and AI tools, or asks "write our acceptable use policy", "AUP for employees", "can staff use ChatGPT at…Policies and documentationGeneral, ISO 27001, SOC 2Tristan Roth
Access review campaign prepUse this skill when a periodic user access review is due, an auditor asked for access review evidence, or someone says "prepare the access review", "run the quarterly user recertification", "who…EvidenceISO 27001, SOC 2, HIPAA, PCI DSSTristan Roth
Auditor interview prepUse this skill when process owners, engineers or executives will be interviewed in an external or internal audit and need to be ready, or when someone asks "prepare the team for the auditor…Audit prep and responseISO 27001, SOC 2, GeneralTristan Roth
Auditor sample preparationUse this skill when an external audit, attestation examination or assessment is coming and the team wants populations and evidence ready for the samples the auditor will pull, or asks "prepare for…Audit prep and responseISO 27001, SOC 2, PCI DSSTristan Roth
Backup restore test evidenceUse this skill when a restore test is due, an auditor or customer asks for proof that backups can be recovered, or someone says "plan a restore test", "prove we can recover in time", "our backups…EvidenceISO 27001, SOC 2, DORA, HIPAATristan Roth
Change management evidence samplingUse this skill when an auditor will test change management, or the team wants to know before they do, and asks "sample our production changes", "check our PR approvals", "do we have segregation of…EvidenceSOC 2, ISO 27001Tristan Roth
Continuity tabletop designUse this skill when a company must test its incident response or continuity plan without breaking anything, because an audit, a customer, a regulator or the plan itself calls for an exercise, and…Incidents and continuityISO 27001, SOC 2, DORA, NIS 2Tristan Roth
Control owner RACIUse this skill when controls have no clear owner, or "security" owns everything, and the team asks "who owns each control", "build a RACI for our controls", "assign control owners", "nobody knows who…Statement of applicabilityISO 27001, SOC 2, GeneralTristan Roth
Customer security questionnaire answersUse this skill when a customer or prospect has sent a security questionnaire, due diligence form or vendor assessment and someone asks "answer this security questionnaire", "fill in the customer's…Vendors and third partiesGeneral, SOC 2, ISO 27001, GDPRTristan Roth
Evidence freshness checkUse this skill when an audit, attestation period or customer review is coming and someone asks "is our evidence up to date", "check the evidence folder before the auditor sees it", "which screenshots…EvidenceGeneral, ISO 27001, SOC 2Tristan Roth
Evidence request list builderUse this skill when an auditor, assessor or regulator has sent a request list and the team asks "turn the auditor's request list into tasks", "who needs to provide what", "build the evidence…EvidenceISO 27001, SOC 2, NIS 2, DORATristan Roth
First gap assessmentUse this skill when a company starts a compliance programme and needs to know how far it is from a framework, and asks "run a gap analysis", "how ready are we for the audit", "baseline us against the…Gap and readinessGeneral, ISO 27001, SOC 2, HIPAA, NIS 2, ISO 42001Tristan Roth
GRC setup reviewUse this skill when someone wants to know where to start with the grcskills library, or asks "review my GRC setup", "what should I fix before the audit", "which compliance skills do I need", "audit…Gap and readinessGeneral, ISO 27001, SOC 2, GDPR, NIS 2, DORA, ISO 42001, EU AI ActTristan Roth
Incident response plan draftingUse this skill when a company has no incident response plan, has one copied from a template that names teams it does not have, or an auditor, customer or insurer asks for it, and the team says "write…Incidents and continuityISO 27001, SOC 2, HIPAA, NIS 2Tristan Roth
Incident severity triageUse this skill when something is happening now: an alert, a suspicious login, a ransomware note, data sent to the wrong customer, an outage that might be an attack, and someone asks "how bad is…Incidents and continuityGeneral, ISO 27001, SOC 2, NIS 2, DORATristan Roth
Internal audit programme planningUse this skill when a company needs its internal audit programme for the certification or examination cycle, or asks "plan our internal audits", "internal audit schedule for the year", "audit…Audit prep and responseISO 27001, ISO 27701, ISO 42001, SOC 2Tristan Roth
Logging and monitoring evidence packUse this skill when an auditor, customer or regulator will ask how security events are logged and watched, and someone says "prepare logging evidence", "show we monitor alerts", "what do we log and…EvidenceISO 27001, SOC 2, NIS 2Tristan Roth
Multi-framework overlap mapUse this skill when a company answers to two or more frameworks and is collecting the same evidence twice, and asks "map our controls across frameworks", "crosswalk between our certification and our…Gap and readinessGeneral, ISO 27001, SOC 2, NIS 2, NIST CSF, GDPRTristan Roth
Nonconformity root cause and corrective actionUse this skill when an internal or external audit raised a nonconformity, finding, exception or observation and the team must answer it, or asks "write the corrective action plan", "root cause for…Audit prep and responseISO 27001, ISO 27701, ISO 42001, SOC 2, GeneralTristan Roth
Policy gap review against practiceUse this skill when a team suspects its policies describe a company that does not exist, before an audit or customer review, or asks "do our policies match what we actually do", "check the policy…Policies and documentationGeneral, ISO 27001, SOC 2Tristan Roth
Policy review cycle refreshUse this skill when the periodic policy review is due or overdue, or someone asks "run the annual policy review", "our policies are out of date", "re-approve the policies before the audit", "what…Policies and documentationGeneral, ISO 27001, SOC 2Tristan Roth
Post-incident reviewUse this skill when an incident or a serious near miss is closed and the team must learn from it, or an auditor asks for lessons learned, and someone says "run the post-mortem", "post-incident…Incidents and continuityGeneral, ISO 27001, SOC 2Tristan Roth
Risk register first passUse this skill when a team needs its first information security risk register, or has one that is a copied catalogue nobody owns, and asks "build our risk register", "draft a risk assessment", "what…RiskISO 27001, SOC 2, NIS 2, DORA, GeneralTristan Roth
Risk register hygiene reviewUse this skill when an existing risk register needs a check before an audit, a management review or a new owner takes it over, or when someone asks "clean up our risk register", "is our risk register…RiskGeneral, ISO 27001, SOC 2Tristan Roth
Risk treatment plan draftingUse this skill when a risk register has treatment decisions but no plan anyone can execute, or when someone asks "write the risk treatment plan", "turn the risk register into actions", "what do we do…RiskISO 27001, SOC 2, GeneralTristan Roth
Secure development policy from the pipelineUse this skill when an engineering team needs a secure development policy, or has one that does not match how code really ships, and asks "write our secure SDLC policy", "secure development policy…Policies and documentationISO 27001, SOC 2, Cyber Resilience ActTristan Roth
Security policy draftingUse this skill when a company needs its information security policy set written or rebuilt, or asks "write our security policies", "draft the information security policy", "we need policies for the…Policies and documentationISO 27001, SOC 2, HIPAA, GDPRTristan Roth
Vendor security questionnaire triageUse this skill when a supplier has returned a security questionnaire, assurance report, certificate or trust pack and someone asks "review this vendor's answers", "is this supplier safe to use"…Vendors and third partiesGeneral, ISO 27001, SOC 2, GDPRTristan Roth
Vendor tieringUse this skill when a company needs to decide how much assessment each supplier deserves, or asks "tier our vendors", "which suppliers are critical", "we have 200 vendors and cannot assess them all"…Vendors and third partiesGeneral, ISO 27001, SOC 2, DORA, NIS 2Tristan Roth