VanaraVANARAagentsSubscribe — $10/mo
proskillv2.0.0✓ verified

soc2-readiness

Get audit-ready for SOC 2 — scope the Trust Services Criteria, build a controls-to-evidence matrix, write the policies auditors check, choose Type I vs Type II, and close the gaps that fail audits. Deep reference with worked examples and a runnable coverage check.

$npx vanara install soc2-readiness

Included with Vanara Pro ($10/mo) — unlocks all 206 items. See pricing →

Overview

SOC 2 is an attestation that you operate the security controls you claim — and, crucially, that you can *prove* they operated. Readiness is not a document you write the week before; it is a set of controls running long enough to leave an evidence trail an auditor can sample. This skill is the engineering-side reference for getting there: scoping, the controls→evidence discipline, policies, the aud

What it covers

Details

Tier
Pro — $10/mo
Version
2.0.0
Depth
5 references · 2 examples · 1 runnable scripts
Verification
1/1 runnable checks passing ✓
Runs on
Your own Claude Code — no API keys
api-paginationImplement correct, fast API pagination — cursor vs offset trade-offs, opaque cursor encoding, stable sort keys, page-size limits, total-count costs, and consumer-side iteration that survives inserts, deletes, and retries. With runnable cursor checks.app-store-optimizationHow to optimize an app-store listing (ASO) for discovery and conversion — title, subtitle, keywords, screenshots, icon, ratings, and the metadata that drives installs. A deep reference with worked Apple and Google listings and a runnable listing linter.audit-loggingDesign tamper-evident audit logs that satisfy security and compliance — what to record (who/what/when/where/outcome), what to never log (secrets/PII), structured immutable events, hash-chaining for tamper-evidence, retention, and access control. A deep reference with runnable validation.background-jobsDesign background job systems that don't lose or double work — enqueue-after-commit, retry policies with jitter, idempotent handlers, visibility timeouts, priority lanes, scheduled and recurring jobs, worker scaling, and observability for async work. With a runnable retry-policy check.backup-and-recoveryDesign and operate a tested backup and disaster-recovery strategy — the 3-2-1 rule, RPO/RTO targets, full vs incremental vs differential, point-in-time recovery, encryption, offsite/immutable copies, retention, and the restore drills that prove a backup actually works.c4-diagrammingDocument software architecture with the C4 model (Context, Container, Component, Code) as text-based diagrams in version control. Covers the four abstraction levels, notation discipline, when to draw each level (and when to stop), supplementary diagrams, and Mermaid/Structurizr tooling.
← All skills