{ "schema": "aiblocks-page/1", "id": "agency-security-compliance-auditor", "type": "agent", "name": "Compliance auditor agent", "summary": "Check your security setup against SOC 2, ISO 27001, HIPAA or PCI-DSS. Get a gap table, an auditor proof list and a fix order.", "headline": "Compliance auditor agent", "subhead": "Name the framework you are aiming for, such as SOC 2, and describe how your team handles logins, access, changes and incidents. It checks each control the way an auditor would. You get a gap table, a proof list and a fix order.", "job": { "id": "check-contracts", "name": "Check contracts and rules" }, "level": "intermediate", "thinking": "high", "tested": true, "updated": "2026-11-03", "first_published": "2026-10-26", "inputs": [ { "type": "question", "required": true, "label": "Question", "what": "the problem, decision or piece of work you want help with, and what a good outcome looks like" }, { "type": "policy", "required": false, "label": "Policy", "what": "a written policy or set of rules, such as a returns policy, a privacy policy or a staff handbook section, with the date it starts" }, { "type": "audit_report", "required": false, "label": "Audit report", "what": "findings with evidence, severity, missing inputs and next actions" } ], "outputs": [ { "type": "audit_report", "required": true, "label": "Audit report", "what": "findings with evidence, severity, missing inputs and next actions" }, { "type": "plan", "required": true, "label": "Plan", "what": "a dated plan: what to do, in what order, with a decision rule for each step" } ], "you_give": [ "The framework you are aiming for, such as SOC 2, ISO 27001, HIPAA or PCI-DSS, and your audit date if you have one", "The systems and tools in scope, such as your cloud host, login tool, ticket tool and code host", "Your policies, or a plain description of how you handle logins, access reviews, joiners and leavers, changes, monitoring and incidents", "Your last audit report or list of findings (optional)", "Your team size and who owns security (optional)" ], "you_get": [ "A scope note that says what is in and out of the review", "A gap table, one row per control, marked Met, Partly met, Not met or No evidence", "A proof list that says what an auditor will ask for, where it lives and how often to collect it", "A fix plan in order, with each job marked small, medium or large", "Questions to put to your auditor" ], "use_when": [ "A customer asks for your SOC 2 report and you have not started.", "You plan an audit in a few months and want to know how far away you are.", "Your last audit found problems and you need a plan to close them before the next one.", "A security questionnaire asks for proof and you do not know what evidence you hold." ], "skip_when": [ "You need a real certification or report. Only an independent auditor can give one.", "You want a plain evidence checklist for one framework, with no review of your setup. Use the Compliance readiness checklist builder.", "You sell cloud software to the US government and need FedRAMP. Use the FedRAMP and RMF compliance planner." ], "output_sample": { "input": [ "The framework you are aiming for, and your audit dates", "The systems and tools in scope", "Your policies, or a description of how each control works today", "Your last audit findings (optional)" ], "prerequisites": [ "An AI that can read files, if you attach policies or exports" ], "output": [ { "name": "Scope", "contains": "The framework, audit period, what is in scope and what is left out, with reasons." }, { "name": "Gap table", "contains": "One row per control, marked Met, Partly met, Not met or No evidence, with fix steps and size." }, { "name": "Proof list", "contains": "For each control, the proof an auditor asks for, where it lives and how often to collect it." }, { "name": "Fix plan", "contains": "The jobs in order of risk and audit timeline, each with an owner role and a size." }, { "name": "Readiness tally", "contains": "A count of controls by status. It counts only the controls you gave proof about." }, { "name": "Questions for your auditor", "contains": "Points to settle with the auditor, such as scope limits and how much proof is enough." } ] }, "output_shape": "SCOPE\n Framework | Audit type and period | In scope | Out of scope \n\nGAP TABLE\n | | | | | | | \n\nPROOF LIST\n | | | | \n\nFIX PLAN (in order)\n | | | \n\nREADINESS TALLY\n Met | Partly met | Not met | No evidence | out of controls reviewed\n\nQUESTIONS FOR YOUR AUDITOR\n | ", "how_to_use": [ "Download the pack from this page and add it to your AI as a skill. If you cannot, paste SKILL.md into a new chat, then paste references/source-agent.md.", "Say which framework and audit type you are aiming for, and your audit dates if you know them.", "List the systems in scope, then paste your policies or describe how each control works today. It cannot log in to your tools, so export any proof you want it to read.", "Type \"Run a readiness review. Mark a control Met only if you showed me proof. Tell me what an auditor would ask for.\"", "Work through the Not met and No evidence rows in order. Save the proof as you go.", "Run the review again before the real audit, and send the questions list to your auditor." ], "checks": [ "The result addresses your actual task and cites the evidence used.", "Examples, role-play experience and targets are kept separate from verified results.", "Claims of tests, memory, tool access or completed actions match what actually happened." ], "next": [ { "name": "Card payment security checker", "url": "https://useaiblocks.com/skills/card-payment-security-checker", "why": "Card payment security checker" }, { "name": "Trade compliance checklist builder", "url": "https://useaiblocks.com/skills/trade-compliance-checklist", "why": "Trade compliance checklist builder" } ], "source": { "by": "Michael Sitarzewski and Agency Agents contributors", "repo": "msitarzewski/agency-agents", "url": "https://github.com/msitarzewski/agency-agents/blob/b37b5bb33b78f2c1d6567d98e25ca818e3259219/security/security-compliance-auditor.md", "licence": "MIT", "original_name": "Compliance Auditor", "commit": "b37b5bb33b78f2c1d6567d98e25ca818e3259219" }, "credits": [ { "title": "Compliance Auditor", "by": "Michael Sitarzewski and Agency Agents contributors", "url": "https://github.com/msitarzewski/agency-agents/blob/b37b5bb33b78f2c1d6567d98e25ca818e3259219/security/security-compliance-auditor.md", "used": "Original agent profile, preserved in references/source-agent.md; AI Blocks adds setup and review instructions." } ], "files": [ "LICENSE", "references/source-agent.md", "SETUP.md", "source.json" ], "links": { "page": "https://useaiblocks.com/agents/agency-security-compliance-auditor", "markdown": "https://useaiblocks.com/agents/agency-security-compliance-auditor.md", "json": "https://useaiblocks.com/agents/agency-security-compliance-auditor.json", "instructions": "https://useaiblocks.com/skills/agency-security-compliance-auditor/SKILL.md", "download": "https://useaiblocks.com/skills/agency-security-compliance-auditor.zip", "api_item": "https://useaiblocks.com/api/v1/items/agency-security-compliance-auditor", "api_document": "https://useaiblocks.com/api/v1/documents/agent/agency-security-compliance-auditor", "mcp": "https://useaiblocks.com/mcp" } }