SOC 2 readiness tracker
By Toolspoke
Reads your Vanta tests and controls each Monday and posts readiness per framework, what is failing, and who owns the fix to Slack.
Needs a Toolspoke account. You choose which project it installs into.
- Vanta + Slack
- Required integrations
- Runs on a schedule
- Mondays at 10am by default
- Post one message
- What its last step does
- Nothing destructive
- 0 of 21 actions in its tools
On this page
The short version
- What it is
- A ready-made Toolspoke agent that reads your compliance programme in Vanta each week and tells Slack how close you are to audit.
- What it reads
- Frameworks, automated tests and controls in Vanta, and people, devices or vendors only where a failing test points at them.
- Where it posts
- One Slack channel, chosen when you set it up.
- What it reports
- Readiness per framework with the week-on-week change, newly failing tests, every failing test grouped by control with its owner and fix, and what was fixed.
- How often
- Mondays at 10am once you switch it on.
- What it never does
- Change a test, control or record in Vanta, post device details or email addresses, or message people directly.
- What you need
- A Toolspoke account, a Manage Vanta application with read access, and a Slack workspace.
What SOC 2 readiness tracker does
SOC 2 readiness tracker is an AI agent that reads your Vanta account every Monday and posts one Slack message with your readiness per framework, what is failing, and who owns each fix.
Preparing for a SOC 2 audit is mostly a long list of small fixes owned by different people. Vanta shows the list, but someone has to open it, work out what changed since last week and tell each owner. That person is usually busy with the audit itself.
A readiness score on its own does not help much. What helps is knowing which tests started failing this week, which control each belongs to, who owns it and what fixes it.
SOC 2 readiness tracker reads every test in the frameworks you choose, works out the share that pass, and compares it with its own post from last week. It reads each failing test for Vanta's remediation guidance, groups the failures under their controls and names the owner.
In practice, every Monday morning you get one message:
- Readiness per framework, with last week's figure and the change
- Tests that started failing this week, listed first
- Every failing test under its control, with the owner and what fixes it
- Tests that were fixed since last week
How it works
SOC 2 readiness tracker works in four steps each Monday: it reads the frameworks and tests, looks closer at what fails, groups it by control and posts one message. All of it comes from the agent's written instructions, which you can read and edit after you install it.
Step 1: Read the tests
It reads every test in the chosen frameworks and works out readiness.
Step 2: Find last week
It reads its own post from last Monday for the earlier figures.
Step 3: Group by control
It reads each failing test and its control, owner and remediation.
Step 4: Post one message
Readiness first, then what is new, then the rest by control.
It works out readiness from the tests
For each framework, readiness is the share of tests with status OK, leaving out tests that are deactivated or not applicable. The post shows the counts behind the percentage, so you can check it against Vanta.
It remembers last week by reading Slack
The agent keeps no memory between runs. It reads the channel with read_channel_history, finds its own post from last Monday and takes the figures and the list of failing tests from it. That is how it knows what is newly failing. On the first run it says there is nothing to compare with.
It groups failures under controls
A control is the requirement and a test is the check that it holds. Each failing test is read with get_test for the remediation guidance, then listed under its control with get_control for the owner. A test that supports several controls is listed once.
It names owners, not devices
When a test points at laptops, people or vendors, the agent counts how many are affected and names each owner. It does not post serial numbers, operating systems, email addresses or anyone's training status. The limits are listed under what it will never do.
What a Monday message looks like
A message from SOC 2 readiness tracker is a single Slack post. Readiness comes first, then the tests that started failing this week, then the rest grouped by control, then what was fixed.
Larkfield
Channels
- # compliance
- # engineering
- # it-ops
- # general
# compliance
SOC 2 Type II: 91% (129 of 142 tests passing), up 3 points on last week's 88%.
Newly failing (2)
- Laptops have disk encryption (control: Endpoint security, owner Ana Silva). 3 laptops without encryption, owners Tom Reid, Priya Shah and Leo Grant. Fix: turn on FileVault through your device management.
- Offboarding completed in time (control: Access removal, owner Dev Patel). 1 leaver's accounts still active after 3 days. Fix: finish the offboarding checklist in Vanta.
Still failing (9 across 6 controls)
- Vendor risk management (owner Sam Okoro): 2 vendors overdue for security review, failing for 2 weeks.
- Security awareness training (owner Ana Silva): 4 people with training overdue.
- Change management (owner Dev Patel): 3 pull requests merged without review in the last 30 days.
Fixed since last week (4)
MFA enforced on cloud console, Backups tested, Password policy accepted, Logging retention set.
- Newly failing
Tests that were not in last week's list. These are the ones most likely to be a surprise to their owner.
- Still failing
The rest of the failing tests, grouped by control, with the owner and how long each has been failing.
- Fixed
Tests that turned
OKsince last week, so the owners who fixed them can see it counted.
Why it always posts
Unlike an alert, this is a weekly status. It posts every Monday, even when nothing changed, because a steady score is still something the audit lead wants to see.
If Vanta cannot be read, it posts that once and stops, so a missing report is never mistaken for a quiet week.
Who uses SOC 2 readiness tracker
SOC 2 readiness tracker suits any company working towards an audit in Vanta where the fixes are spread across several people. The examples use made-up names.
A CTO running the first audit
Hana Mori leads engineering at a 30-person startup and owns the SOC 2 project on top of her job. She no longer opens Vanta on Monday to work out what changed. The post tells her.
A compliance lead handing out work
Marcus Bell manages compliance across two frameworks. Failures grouped by control, with the owner on each line, mean he can forward the post rather than write his own.
A founder reporting to the board
Eva Lindqvist wants one number per framework and whether it is moving. The week-on-week change gives her that without a dashboard.
An IT manager fixing devices
Kofi Mensah owns laptops and accounts. He watches for device and offboarding tests, which name the people to chase without exposing anyone's machine details in the channel.
What SOC 2 readiness tracker connects to
SOC 2 readiness tracker connects to two tools: it reads Vanta and reads and posts to Slack. You connect each one yourself, and Toolspoke stores the connection encrypted, so the agent never sees the credential.
Vanta
RequiredRead compliance tests, controls, policies, evidence documents, frameworks, vendors, people, and monitored devices.
Authentication: OAuth client credentials
Slack
RequiredSearch conversations and send messages to your workspace.
Authentication: Bot token
| Tool | What SOC 2 readiness tracker does | What it cannot do |
|---|---|---|
| Vanta | Reads frameworks, tests and controls (list_frameworks, list_tests, get_test, list_controls, get_control), and people, devices and vendors where a test points at them (list_people, list_monitored_computers, list_vendors). | Change anything in Vanta: every action the connector has is a read. It cannot mark a test as not applicable, edit a control or update a record. |
| Slack | Reads the chosen channel for last week's post and posts one message (read_channel_history, send_message). | Delete messages: the connector has no delete action. It can also edit the bot's messages, schedule messages and react, and the agent is told to do none of them. |
That the agent cannot change your compliance programme is a property of the Vanta connector, which offers only reads. Vanta's own API can create and update vendors, documents and people records, and none of that is offered here.
The Vanta connector reads people's names, email addresses and device details. The agent is told to post only an owner's name and the failing check, which is an instruction, not a lock. Vanta's people and device reads are kept out of the activity log, so the log shows that they were read, not what came back.
If you want Slack locked down further, a project can switch off Slack's edit, schedule and reaction actions. The access control guide explains how.
What SOC 2 readiness tracker will never do
SOC 2 readiness tracker is told never to change anything in Vanta, never to post device or personal details, and never to message people directly. It reads and reports to one channel.
- Change anything in Vanta, or ask anyone to mark a test as not applicable to raise the score.
- Post device serial numbers, UDIDs, operating system versions, email addresses, job titles or anyone's training or policy status.
- Message a person directly, or mention people with @.
- Call the programme "audit ready" or promise a pass.
- Edit or delete an earlier post.
Why it does not change Vanta
A compliance record that an agent can edit is a record an auditor cannot trust. The Vanta connector offers only reads, so the agent cannot mark a test as not applicable to raise the score, and it is told never to suggest it either.
What it keeps out of Slack
A compliance channel is often read by more people than Vanta is. Device serial numbers, operating system versions, email addresses and a person's training status stay in Vanta.
Why it never claims you are ready
A percentage of passing tests is not an audit result. The agent reports the numbers and never calls the programme audit ready or promises a pass. That judgement belongs to your auditor and the person running the audit.
If something goes wrong
If Vanta cannot be read, post that once and stop. If last week's post cannot be found, report this week's figures and say the change is unknown. If a test has no owner, write "no owner" in place of a name, because an unowned failing test is itself worth knowing.
These are written into SOC 2 readiness tracker's instructions. They guide the agent, but they are not a permission. What it is allowed to touch is set by the access you grant.
SOC 2 readiness tracker reads Vanta and reports what it finds. Every fix, and every decision about scope, stays with a person.
When SOC 2 readiness tracker runs
SOC 2 readiness tracker runs on Mondays at 10am, but only after you switch its schedule on. It arrives switched off, so nothing runs and nothing is charged until you decide.
- Each run reads every test in the frameworks you chose.
- It compares with its own post from the Monday before.
- It posts every week, even when nothing changed.
- If Vanta cannot be read, it posts that once.
Each run uses model credit from your workspace balance, so it makes one run a week. A programme with several frameworks and many failing tests costs more, because there is more to read. The Vanta and Slack calls themselves are free.
Your copy is an ordinary agent in your project. You can pause its schedule there, run it once on demand, change the day and time and edit its instructions. The agent's page lists recent runs and their cost.
How to set up SOC 2 readiness tracker
To track audit readiness in Slack, add SOC 2 readiness tracker to a Toolspoke project, connect Vanta and Slack, choose your frameworks and switch on the schedule. It takes a few minutes, and nothing runs until the last step.
Step 1: Create a Toolspoke account or sign in
Choose Use this agent. If you are new, you will be asked to sign up first, and you come straight back to this agent afterwards.
Step 2: Add it to a project
Pick the project it should live in. You get your own editable copy, and you can see the two tools it brings before anything connects.
Step 3: Connect Vanta
In Vanta's Developer Console, create a Manage Vanta application, not a Build Integrations one, and paste its client id and secret. Use it only for this connection, because Vanta allows one active token per application.
Step 4: Connect Slack
Choose Sign in with Slack and approve the Toolspoke app. For a private channel, add the Toolspoke bot to it first, so it can post and read its own earlier posts.
Step 5: Choose frameworks and channel
Name the frameworks to track and the channel in the instructions. If you name no framework, it tracks every framework in the account and says so.
Step 6: Switch on the schedule
The schedule arrives switched off. Run it once to see a message, then switch it on. The second run is the first with a week-on-week change.
Make SOC 2 readiness tracker fit your programme
SOC 2 readiness tracker's instructions are plain English and you can edit them after you install it. Installing copies the agent, so your edits stay with your copy. Open the agent in Toolspoke and tell the builder what to change, and it rewrites the instructions.
Paste any sentence below into the builder chat, or say the same thing in your own words.
Track SOC 2 only and ignore ISO 27001.
Run on Tuesdays at 8 AM instead.
This changes when the agent wakes up, so the builder edits its schedule, not the instructions.
Also list policies awaiting approval with list_policies.The Vanta connector already has this read, so no new access is needed.
List only newly failing tests and the readiness figures. Leave out the rest.
Mark any test that has failed for more than four weeks in bold.
None of these edits touches the Never rules. They change what SOC 2 readiness tracker reads and reports, not what the connections allow.
How it compares to other options
SOC 2 readiness tracker beats the alternatives when you want a weekly summary of what changed, grouped by owner, in the channel where the work is handed out. It loses to them when you need an alert the moment a test fails.
| Compared on | SOC 2 readiness tracker | Vanta's own dashboard | Vanta's Slack alerts | A weekly manual update |
|---|---|---|---|---|
| Week-on-week change | Yes, from last week's post | Trend charts | No | If you keep notes |
| Grouped by control and owner | Yes | Yes, when you filter | Per test | If you write it |
| Says what fixes each test | Yes, one line each | Yes, per test | Sometimes | If you look it up |
| Arrives without anyone opening Vanta | Yes | No | Yes | No |
| Can change Vanta | No, the connector cannot | Yes | No | Up to you |
| Arrives as it happens | No, weekly | Live | Yes | No |
| Setup effort | Connect two accounts | None | A few settings | An hour a week |
Vanta's own dashboard is the place to do the work: it has every detail and the controls to change scope. This agent is a summary of it, not a replacement.
Vanta's alerts are better when you want to know the moment a single test fails. They arrive one at a time and do not say what changed over the week.
Frequently asked questions
Can SOC 2 readiness tracker change anything in Vanta?
No. Every action the Vanta connector offers is a read, so the connection cannot change a test, a control or any record.
How does it know what changed since last week?
It reads its own post from the previous Monday in the same channel and compares. On its first run it says there is nothing to compare with yet.
How is readiness worked out?
As the share of tests with status OK in each framework, leaving out tests that are deactivated or not applicable. The post shows the counts behind the figure.
Does it post employees' device details?
It is told not to. It names the owner and the failing check, and leaves serial numbers, operating systems and email addresses in Vanta.
Does it work with ISO 27001 or HIPAA?
Yes. It tracks whichever frameworks your Vanta account has, by name. Choose them when you set it up.
Will it tag owners in Slack?
Not as shipped. It is told not to mention people, so the channel decides who follows up. You can ask the builder to change that.
Is SOC 2 readiness tracker free?
It has no price of its own, and every Toolspoke plan includes agents. Tool calls cost nothing, but each run draws on your usage balance. Pricing has the details.
Know where the audit stands every Monday
Connect Vanta and Slack, choose your frameworks and switch on the schedule. Your first readiness report lands on Monday at 10am.