# Compliance Manager: Prepare for SOC 2 and ISO 27001 > The Compliance Manager is the SOC 2 readiness specialist in the Ai1 platform by MyZone AI: it scopes your assessment, records control gaps, maps the work to ISO 27001 and drafts evidence plans and policies for your reviewer to approve. Canonical page: https://myzone.ai/pages/agents/ai-compliance-manager-agent Part of Ai1, by MyZone AI. Book a Compliance walkthrough: https://calendly.com/d/ct6h-tcy-8qf/ai1-demo?a1=Compliance%20Manager&utm_source=myzone.ai&utm_medium=agent-page&utm_content=ai-compliance-manager-agent-final Last updated: 2026-10-14. Reviewed by the MyZone AI team. Know your control gaps before the audit, with drafts ready for review. ## At a glance - **You bring:** Your services, systems, documents and answers about current controls - **Gap review:** Each control gets an honest status, including needs owner confirmation - **Shared work:** A control map links SOC 2 and ISO 27001 readiness work - **Evidence plan:** Proof to gather, owner roles and an ordered readiness plan - **Policy drafts:** Wording tailored to your business, labelled for review - **Your control:** Your reviewer signs off; the agent never certifies your business ## What the Compliance Manager does - **Scopes your readiness work:** Pins down the services, data and systems in scope, the commitments you make to customers and which framework and report type you are aiming for. - **Runs a control-by-control review:** A guided interview goes through each control and records an honest status: in place, partial, planned, not in place or needs owner confirmation. - **Maps SOC 2 to ISO 27001:** Shows where the two frameworks overlap, so you can plan once and build evidence that serves both. - **Builds your evidence checklist:** Lists the proof an auditor will expect for each control, and which role on your team owns it. - **Plans the work in order:** A readiness plan sequences the fixes, names owner roles and passes key dates to your compliance calendar. - **Drafts policies and customer statements:** Policy drafts tailored to your business, and careful security wording for customers, each with a clear status label and a sign-off line. ## How the Compliance Manager differs from starting with a generic policy pack A generic policy pack can look complete while leaving the real gaps unclear. Compliance Manager starts with your scope and a guided control interview. It records honest statuses, maps the overlap between SOC 2 and ISO 27001, and lists the evidence and owner roles needed next. Policies and customer wording are tailored drafts with sign-off lines. Your reviewer approves their use; the agent never claims certification or acts as an auditor. How this differs from the Data & Privacy Governance Officer (https://myzone.ai/pages/agents/ai-data-privacy-agent): Use Data & Privacy Governance Officer instead when you need privacy data maps, retention rules or consent work, rather than readiness assessments and policy drafts. ## How it works 1. **Scope** (Before the assessment): You agree what is in scope: services, data, systems and the framework you are working toward. 2. **Interview** (During the control interview): It walks your team through the controls one by one and records each status honestly. A guess is marked as needing confirmation. 3. **Map and plan** (Once the gaps are recorded): It maps the controls across both frameworks, lists the evidence needed and builds a readiness plan in order. 4. **Draft** (With the plan in place): It drafts the policies and any customer-facing wording, every draft clearly labelled as a draft. 5. **Sign off** (you approve) (Before any draft is used): Your named reviewer checks each draft and signs it off. Nothing is adopted, sent or published until they do. ## When to use it - **A big customer asks if you have SOC 2:** It scopes your readiness work and shows the gaps between where you are and where an auditor will expect you to be. - **You need an information security policy:** It drafts one tailored to your business, ready for your reviewer to edit and approve. - **You want ISO 27001 as well as SOC 2:** It maps the controls across both, so one programme of work covers the overlap. - **Sales wants a line about your security:** It drafts careful wording that matches what is really in place, with an owner sign-off line on every statement. - **Your old policies are years out of date:** Paste them in and it drafts updated versions that reflect how you work today. ## What you get - A readiness scope for SOC 2, ISO 27001 or both - A gap assessment with an honest status for each control - A control map between SOC 2 and ISO 27001 - An evidence checklist with owner roles - A readiness plan, in order, with owner roles - Policy drafts and customer statement drafts, each with a sign-off line ## Example: SOC 2 readiness gap assessment Example with a fictional company. Names, people and figures are invented to show the agent's output. Any resemblance to a real company or person is unintended. What it was asked: Where do we stand on SOC 2, starting with how we protect customer payroll data, and what do we have to fix first? This is an illustrative example of the gap assessment Compliance Manager is being built to produce: scope, honest control statuses, a readiness plan with an ISO 27001 mapping, and drafts for sign-off. It was written by hand from the agent's design for an invented company with invented controls and figures. No real systems, audit firm or people were involved, and nothing was adopted, sent or published. Run date: 14 October 2026. ### What it found - Of 42 controls assessed, 24 are in place, 12 are partial or planned, 3 are not in place and 3 still need an owner to confirm the answer. - The three missing controls are production access reviews (14 people hold admin access), a tested backup restore and reviews of the 6 suppliers that hold client data. - A 20-week plan closes the missing controls in the first 6 weeks, and four customer statements are drafted for owner sign-off instead of any compliance claim. ## Guardrails - Your Ai1 team will tell you when the Compliance Manager is ready for your account. - It is readiness support, not an auditor, a certification body or a lawyer. Only a licensed audit firm issues a SOC 2 report. - It never claims you are compliant or certified. Every customer statement needs your owner's sign-off. - Every policy and plan is a draft for your named reviewer. Nothing is adopted, submitted or published by the agent. - It never contacts auditors, vendors or customers, and it never asks for passwords or system access. ## Frequently asked questions ### What should security policy drafts make clear before a reviewer signs off? They should fit how the business works, remain clearly labelled as drafts and show who must approve them. Compliance Manager drafts policies and customer statements with a sign-off line. A draft policy is readiness work, not a claim that the business is compliant or certified. ### How does a compliance gap assessment help teams gather audit evidence? It connects an honest control status to the proof still needed and the role responsible for gathering it. Compliance Manager builds that evidence checklist alongside an ordered readiness plan, so your team can see what to prepare. It supports readiness; it does not issue an audit report or certification. ### What does SOC 2 readiness with Compliance Manager look like? It scopes the work, interviews your team control by control, records an honest status for each one, maps SOC 2 to ISO 27001 and builds a plan and an evidence checklist. Your reviewer approves every draft. ### Will it certify us or tell customers we are compliant? No. It is readiness support. Only a licensed audit firm issues a SOC 2 report and only a certification body issues an ISO certificate. It never claims you are compliant or certified. ### Which ISO standard does it cover? ISO/IEC 27001, the information security standard. It starts with data protection, the part most customers ask about first. ### Can it fill in a customer's security questionnaire? Not in this version. It can run a readiness assessment or draft your policies instead, which makes those questionnaires much easier to answer later. ### Does it need access to our systems? No. It works from your team's answers and the documents you choose to share. It never asks for passwords or system access. ### Is the Compliance Manager available now? Not yet. Your Ai1 team will tell you when the Compliance Manager is ready for your account. You can talk to us today about your SOC 2 or ISO 27001 plans. ## More on this topic - [Locking Down AI Agents: The 10-Point Security Checklist Every CTO Needs](https://myzone.ai/pages/blog/ai-agent-security): AI agents are powerful,and vulnerable. Learn the 10 critical security steps to lock down your AI agents before they become your biggest liability. ## About Ai1 Ai1 is the AI operations platform by MyZone AI, where each client runs on its own private server. The Compliance Manager is not sold on its own: every Ai1 agent, including this one, is included on Developer Pro and every Fully Managed option, with no per-agent charge. Developer Core includes the development agents. Pricing: https://myzone.ai/pages/services/ai1-pricing. Security: https://myzone.ai/pages/security.