Compliance Manager: Prepare for SOC 2 and ISO 27001
Know your control gaps before the audit, with drafts ready for review.
The Compliance Manager is the SOC 2 readiness specialist in the Ai1 platform by MyZone AI: it scopes your assessment, records control gaps, maps the work to ISO 27001 and drafts evidence plans and policies for your reviewer to approve.
You find out where you really stand before you book an auditor, so the audit holds fewer surprises.
One effort, two frameworks
Controls are mapped between the two frameworks, so the same work and evidence count toward both.
Policies that fit you
Ready-to-review policy drafts are tailored to how your business actually runs, not copied from a generic pack.
Honest customer wording
What you tell customers about security matches what is really in place, so you never overpromise.
Meet your agent
Get to know Tendai
Tendai likes repairing old radios and patiently finding the loose connection. For your business, he scopes readiness work, records gaps honestly and drafts practical policies and evidence plans, leaving sign-off to your people.
AI agent. Fictional persona; not a real person.
Tendai, the persona of the Compliance Manager
Name
Tendai M.
Role
Compliance Manager
Experience
27 years
Work history
Information security coordinator at a regional payroll bureau Compliance readiness manager at a business services cooperative
Personality
Honest about gaps, keeps sign-off with people
Based in
Bulawayo, Zimbabwe
Why Tendai has a personality
AI does better work as a specific expert, so the Compliance Manager works as Tendai (Compliance Manager, Bulawayo, Zimbabwe). You can rename Tendai or change the personality, experience and profile settings at any time.
Your services, systems, documents and answers about current controls
Gap review
Each control gets an honest status, including needs owner confirmation
Shared work
A control map links SOC 2 and ISO 27001 readiness work
Evidence plan
Proof to gather, owner roles and an ordered readiness plan
Policy drafts
Wording tailored to your business, labelled for review
Your control
Your reviewer signs off; the agent never certifies your business
Capabilities
What the Compliance Manager does for you
Scopes your readiness work
Pins down the services, data and systems in scope, the commitments you make to customers and which framework and report type you are aiming for.
Runs a control-by-control review
A guided interview goes through each control and records an honest status: in place, partial, planned, not in place or needs owner confirmation.
Maps SOC 2 to ISO 27001
Shows where the two frameworks overlap, so you can plan once and build evidence that serves both.
Builds your evidence checklist
Lists the proof an auditor will expect for each control, and which role on your team owns it.
Plans the work in order
A readiness plan sequences the fixes, names owner roles and passes key dates to your compliance calendar.
Drafts policies and customer statements
Policy drafts tailored to your business, and careful security wording for customers, each with a clear status label and a sign-off line.
How the Compliance Manager differs from starting with a generic policy pack
A generic policy pack can look complete while leaving the real gaps unclear. Compliance Manager starts with your scope and a guided control interview. It records honest statuses, maps the overlap between SOC 2 and ISO 27001, and lists the evidence and owner roles needed next. Policies and customer wording are tailored drafts with sign-off lines. Your reviewer approves their use; the agent never claims certification or acts as an auditor.
How this differs from the Data & Privacy Governance Officer: Use Data & Privacy Governance Officer instead when you need privacy data maps, retention rules or consent work, rather than readiness assessments and policy drafts.
How it works
From your request to a finished result
It runs inside your Ai1 system and works in the tools you already use. You ask, it works, it reports, and it stops for your OK where it matters.
Tap the diagram to enlarge it
Step 1: Scope
You agree what is in scope: services, data, systems and the framework you are working toward.
Step 2: Interview
It walks your team through the controls one by one and records each status honestly. A guess is marked as needing confirmation.
Step 3: Map and plan
It maps the controls across both frameworks, lists the evidence needed and builds a readiness plan in order.
Step 4: Draft
It drafts the policies and any customer-facing wording, every draft clearly labelled as a draft.
You approve
Step 5: Sign off
Your named reviewer checks each draft and signs it off. Nothing is adopted, sent or published until they do.
When to use it
Hand these situations to the Compliance Manager
Illustrative photo. List the evidence needed to show how payroll records are protected.
If this is you…
…here's what it does
A big customer asks if you have SOC 2
It scopes your readiness work and shows the gaps between where you are and where an auditor will expect you to be.
You need an information security policy
It drafts one tailored to your business, ready for your reviewer to edit and approve.
You want ISO 27001 as well as SOC 2
It maps the controls across both, so one programme of work covers the overlap.
Sales wants a line about your security
It drafts careful wording that matches what is really in place, with an owner sign-off line on every statement.
Your old policies are years out of date
Paste them in and it drafts updated versions that reflect how you work today.
What you get
A readiness scope for SOC 2, ISO 27001 or both
A gap assessment with an honest status for each control
A control map between SOC 2 and ISO 27001
An evidence checklist with owner roles
A readiness plan, in order, with owner roles
Policy drafts and customer statement drafts, each with a sign-off line
What it won't do
✕Give legal advice or review contracts and data agreementsHandled by: The Lawyer
✕Run technical scans or vulnerability testsHandled by: The Security Agent
✕Fill in security questionnaires or vendor assessmentsHandled by: Not in this version
✕Certify you or sign off your controlsHandled by: A licensed auditor or certification body
Example readiness gap assessment
Example: SOC 2 readiness gap assessment
Example with a fictional company. Names, people and figures are invented to show the agent's output. Any resemblance to a real company or person is unintended.
What it was asked: Where do we stand on SOC 2, starting with how we protect customer payroll data, and what do we have to fix first?
Example report
Readiness at a glanceGap register: the 10 controls to fix firstReadiness plan: three phases over 20 weeksDrafts for sign-off: customer wording and a policy
What it found: 3 findings, with the numbers
Of 42 controls assessed, 24 are in place, 12 are partial or planned, 3 are not in place and 3 still need an owner to confirm the answer.
The three missing controls are production access reviews (14 people hold admin access), a tested backup restore and reviews of the 6 suppliers that hold client data.
A 20-week plan closes the missing controls in the first 6 weeks, and four customer statements are drafted for owner sign-off instead of any compliance claim.
This is an illustrative example of the gap assessment Compliance Manager is being built to produce: scope, honest control statuses, a readiness plan with an ISO 27001 mapping, and drafts for sign-off. It was written by hand from the agent's design for an invented company with invented controls and figures. No real systems, audit firm or people were involved, and nothing was adopted, sent or published. Run date: .
Want a readiness gap assessment like this for your own policies? Book a Compliance walkthrough.
Runs the technical checks that sit behind many of your security controls.
Common questions
Frequently asked questions about the Compliance Manager
What should security policy drafts make clear before a reviewer signs off?
They should fit how the business works, remain clearly labelled as drafts and show who must approve them. Compliance Manager drafts policies and customer statements with a sign-off line. A draft policy is readiness work, not a claim that the business is compliant or certified.
How does a compliance gap assessment help teams gather audit evidence?
It connects an honest control status to the proof still needed and the role responsible for gathering it. Compliance Manager builds that evidence checklist alongside an ordered readiness plan, so your team can see what to prepare. It supports readiness; it does not issue an audit report or certification.
What does SOC 2 readiness with Compliance Manager look like?
It scopes the work, interviews your team control by control, records an honest status for each one, maps SOC 2 to ISO 27001 and builds a plan and an evidence checklist. Your reviewer approves every draft.
Will it certify us or tell customers we are compliant?
No. It is readiness support. Only a licensed audit firm issues a SOC 2 report and only a certification body issues an ISO certificate. It never claims you are compliant or certified.
Which ISO standard does it cover?
ISO/IEC 27001, the information security standard. It starts with data protection, the part most customers ask about first.
Can it fill in a customer's security questionnaire?
Not in this version. It can run a readiness assessment or draft your policies instead, which makes those questionnaires much easier to answer later.
Does it need access to our systems?
No. It works from your team's answers and the documents you choose to share. It never asks for passwords or system access.
Is the Compliance Manager available now?
Not yet. Your Ai1 team will tell you when the Compliance Manager is ready for your account. You can talk to us today about your SOC 2 or ISO 27001 plans.
About Ai1
How much does Ai1 cost?
Two paths, one platform. Build it yourself on a developer plan, or let our team run your AI operations for you. Every plan runs on its own private server, and every price is shown in full. See Ai1 pricing →
Do I get just the Compliance Manager, or the whole platform?
The whole platform. The Compliance Manager is not sold on its own: every Ai1 agent, including this one, is included on Developer Pro and every Fully Managed option, with no per-agent charge. Developer Core includes the development agents. Compare plans →
Legal & Compliance
Research & Analytics
Marketing
Learning & Development
Product & Engineering