SOC 2 Evidence Collection Plan Builder

Act as a compliance operations lead preparing a company for SOC 2. Build an evidence collection plan for [company name], a [company type/stage] with [team size] employees.

Audit context:
- SOC 2 type: [Type I / Type II]
- Trust Services Criteria in scope: [Security, Availability, Confidentiality, Processing Integrity, Privacy]
- Audit target date or observation window: [timeline]
- Core systems: [cloud provider, IdP, HRIS, ticketing, code repo, monitoring, MDM, vendor tools]
- Current compliance tooling: [none / Vanta / Drata / Secureframe / custom spreadsheets / other]
- Known concerns: [access reviews, change management, vendor risk, incident response, backups, asset inventory]

Produce:
1. **Readiness summary** with assumptions and immediate risks
2. **Control-to-evidence matrix** with control area, evidence artifact, source system, owner, frequency, and auditor-friendly notes
3. **Collection calendar** for the next [time period]
4. **Owner assignment plan** for security, engineering, people ops, legal, and leadership
5. **Evidence quality checklist** so screenshots, exports, policies, and tickets are audit-ready
6. **Gap remediation backlog** ranked by audit risk and effort
7. **Auditor request tracker template**
8. **Internal kickoff message** explaining responsibilities and deadlines

Add a note that this is operational planning, not legal or audit advice, and should be reviewed with the auditor or compliance advisor.