SOC 2 evidence collector

Gathers audit evidence for SOC 2 and similar control frameworks from connected systems — access reviews, change logs, backup confirmations, training records — mapped to the control checklist with timestamps and provenance. Use when the user mentions SOC 2, audit prep, evidence collection, control testing, compliance audit season, or an auditor request list.

Audit season turns your best engineers into screenshot artists for six weeks. The evidence exists — in the systems, with timestamps — and the work is pure collection against a known list. That is not a job for your staff engineers. This skill walks the control checklist, pulls the artifacts from source, and builds the evidence book with provenance an auditor can verify — humans review, nobody screenshots.

When to run

Audit-window kickoff: full collection pass against the control list (recommended)
Continuous mode: monthly evidence snapshots so audit season becomes a review, not a scramble
On demand: "pull the evidence for CC6.1" / an auditor follow-up request

Computer scopes

Docs: the control framework checklist and evidence-requirements map (the rulebook)
Connected systems, read-only, as mapped per control: identity provider (access reviews, MFA config), code host (change management, review enforcement), infra (backup jobs, logs), HR/LMS (training completion), ticketing (incident and change records)
Evidence store: the structured evidence book (write)

Workflow

Load the control checklist and its evidence map: for each control, what artifact, from which system, covering which period, in what form.
Collect per control: pull the artifact from source with system-of-origin metadata, collection timestamp, and coverage-period stamps. Native exports over renderings; the provenance chain is the point.
Grade completeness per control: complete / partial / missing — with the specific gap named (wrong period, missing system, artifact type mismatch). No control is "probably fine."
Flag evidence that reveals control *failures* (lapsed reviews, unenforced policies) to the compliance owner immediately and separately — collection is neutral, but burying is not.
Assemble the evidence book keyed to the checklist; produce the gap list with owners and the auditor-request cross-reference. Humans review and submit; the skill never talks to the auditor.

Guardrails

Autonomy: L1. Read-only against all evidence sources; the evidence book is drafted for compliance-owner review; nothing transmits externally without a human.
Evidence is collected as-is: no editing, no cropping, no favorable selection. Gaps and failures are reported, never patched cosmetically.
Access is scoped to the evidence map; this skill holds no standing credentials beyond it.

Output

The evidence book (per-control artifacts with provenance) → completeness dashboard → gap list with owners → control-failure flags (separate, immediate) → auditor-request cross-reference.

Eval fixtures

Set: sandbox control list of 25 controls across 5 systems with seeded evidence, including 4 coverage-period gaps, 2 missing artifacts, and 2 seeded control failures.
Rubric: collection completeness; gap grading exactness; both control failures escalated separately; provenance metadata present on every artifact.
Ship gate: gap-detection recall 100%; failure-escalation compliance 100%; provenance coverage 100%.

Run soc 2 evidence collector on your own data.

MORE SKILLS

Governance, Security & Compliance · L0

Agent audit reporter

Produces the periodic governance digest of all agent and skill activity — actions taken by autonomy level, approvals granted and by whom, guardrail triggers, denials, and anomalies — from GStack's audit logs. Use when the user mentions AI governance reporting, agent audit, "what did the agents do this week," compliance review of automation, or board/CISO reporting on AI usage.

Governance, Security & Compliance · L0

Agent audit reporter

Produces the periodic governance digest of all agent and skill activity — actions taken by autonomy level, approvals granted and by whom, guardrail triggers, denials, and anomalies — from GStack's audit logs. Use when the user mentions AI governance reporting, agent audit, "what did the agents do this week," compliance review of automation, or board/CISO reporting on AI usage.

Governance, Security & Compliance · L2 block / L1 release

PII redaction gate

Scans outbound content — messages, exports, attachments, drafts leaving trusted boundaries — for PII/PHI and blocks flagged items pending human approval, with inline redaction suggestions. Use when the user mentions PII protection, data loss prevention, redaction, outbound compliance, or safe data sharing with external parties.

Governance, Security & Compliance · L2 block / L1 release

PII redaction gate

Scans outbound content — messages, exports, attachments, drafts leaving trusted boundaries — for PII/PHI and blocks flagged items pending human approval, with inline redaction suggestions. Use when the user mentions PII protection, data loss prevention, redaction, outbound compliance, or safe data sharing with external parties.