aviskaar/compliance-governance
skills/compliance-governance/SKILL.md
Use this skill when you need regulatory compliance strategy, framework gap analysis, audit preparation, policy management, or risk governance across SOC 2, NIST CSF, ISO 27001, HIPAA, SOX, GDPR, CCPA, EU AI Act, PCI-DSS, or industry-specific standards. Trigger for compliance program buildout, audit readiness, regulatory change management, or cross-framework harmonization.
$ install --global
skillsauthnpx skillsauth add aviskaar/open-org compliance-governanceInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 12, 2026, 3:45 AM254.1s2 files scanned
SKILL.md
- name:
- compliance-governance
- description:
- Use this skill when you need regulatory compliance strategy, framework gap analysis, audit preparation, policy management, or risk governance across SOC 2, NIST CSF, ISO 27001, HIPAA, SOX, GDPR, CCPA, EU AI Act, PCI-DSS, or industry-specific standards. Trigger for compliance program buildout, audit readiness, regulatory change management, or cross-framework harmonization.
- license:
- Apache-2.0
- author:
- aviskaar
- version:
- 1.0
- tags:
- [compliance, governance, soc2, nist, iso27001, hipaa, sox, gdpr, ccpa, eu-ai-act, pci-dss, risk-management]
Compliance & Governance — VP Compliance & Governance
Role
VP Compliance & Governance owns the enterprise regulatory compliance posture, policy framework, audit lifecycle, and cross-framework control harmonization. This skill ensures the organization meets all mandatory obligations, anticipates regulatory change, and maintains audit-ready evidence at all times.
Compliance Framework Universe
Tier 1 — Mandatory (Legally Binding)
| Framework | Applicability | Regulatory Body | |---|---|---| | GDPR | EU personal data processing | European Data Protection Board | | HIPAA/HITECH | US healthcare PHI | HHS Office for Civil Rights | | SOX | US public companies (financial reporting) | SEC / PCAOB | | PCI-DSS v4.0 | Payment card data | PCI Security Standards Council | | CCPA/CPRA | California consumer data | California AG / CPPA | | EU AI Act | AI systems serving EU | EU AI Office | | DORA | EU financial entities digital resilience | ESAs |
Tier 2 — Industry Standard (Audit-Required)
| Framework | Scope | Certification Body | |---|---|---| | SOC 2 Type II | Service organizations, trust principles | AICPA-licensed CPA | | ISO 27001:2022 | ISMS certification | Accredited CB (BSI, DNV, etc.) | | ISO 27017 | Cloud service controls | Accredited CB | | ISO 27018 | Cloud PII protection | Accredited CB | | ISO 42001 | AI management system | Accredited CB | | NIST CSF 2.0 | Cybersecurity framework | Self-attested / third-party | | NIST SP 800-53 Rev5 | Federal/FedRAMP | 3PAO | | FedRAMP | US federal cloud | FedRAMP PMO |
Tier 3 — Industry-Specific (delegate to industry-compliance)
- FFIEC / OCC guidelines (Banking)
- FINRA / SEC cybersecurity rules (Finance)
- FDA 21 CFR Part 11 (Life Sciences)
- HITRUST CSF (Healthcare)
- NERC CIP (Energy)
- ITAR / EAR (Defense/Aerospace)
Phase 1 — Compliance Obligation Mapping
Inputs required: | Input | Description | |---|---| | Organization profile | Jurisdictions, industries, customer types | | Data inventory | Data types processed, stored, transmitted | | Technology stack | Cloud providers, SaaS tools, data processors | | Business activities | Payment processing, healthcare data, AI systems | | Customer contracts | Enterprise agreements with compliance clauses |
Actions:
- Map all applicable frameworks to organization profile.
- Identify overlapping controls across frameworks (harmonization opportunities).
- Classify obligations: mandatory vs. voluntary vs. contractual.
- Define compliance calendar with all audit windows, renewal dates, regulatory deadlines.
- Assign framework owners within organization.
Output: Compliance Obligation Register + Harmonized Control Framework
Phase 2 — Control Framework Design
Unified Control Library approach — map one control to multiple frameworks:
Example: Encryption at Rest
├── SOC 2: CC6.1 (Logical Access Controls)
├── ISO 27001: A.8.24 (Use of cryptography)
├── NIST CSF: PR.DS-1 (Data-at-rest protected)
├── HIPAA: §164.312(a)(2)(iv) (Encryption)
├── GDPR: Art. 32 (Appropriate technical measures)
└── PCI-DSS: Req 3.5 (Protect stored account data)
Control categories (NIST SP 800-53 aligned):
- Access Control (AC)
- Awareness and Training (AT)
- Audit and Accountability (AU)
- Configuration Management (CM)
- Contingency Planning (CP)
- Identification and Authentication (IA)
- Incident Response (IR)
- Maintenance (MA)
- Media Protection (MP)
- Physical Protection (PE)
- Planning (PL)
- Personnel Security (PS)
- Risk Assessment (RA)
- System and Services Acquisition (SA)
- System and Communications Protection (SC)
- System and Information Integrity (SI)
- Supply Chain Risk Management (SR)
Phase 3 — SOC 2 Program
Trust Service Criteria (TSC) coverage:
| Criteria | Scope | Key Controls | |---|---|---| | Security (CC) | All audits | Access controls, encryption, monitoring, change mgmt | | Availability (A) | SLA-critical systems | Uptime SLOs, DR, capacity planning | | Processing Integrity (PI) | Data processing systems | Input/output validation, error handling | | Confidentiality (C) | Sensitive data | Encryption, NDA, data classification | | Privacy (P) | Personal data | Notice, consent, retention, subject rights |
SOC 2 audit readiness checklist:
- [ ] All controls documented with owner, frequency, evidence type
- [ ] Evidence collection automated where possible (GRC platform integration)
- [ ] Control testing completed 90 days before audit window
- [ ] Exception register reviewed and remediated or risk-accepted
- [ ] Vendor SOC 2 reports reviewed for all critical third parties
- [ ] Management assertion drafted and legal-reviewed
- [ ] Complementary User Entity Controls (CUECs) documented
Delegate to compliance-auditor for evidence collection and testing execution.
Phase 4 — GDPR & Privacy Governance
GDPR compliance requirements:
| Requirement | Implementation | |---|---| | Lawful basis | Document legal basis for each processing activity | | Data Subject Rights | DSAR process: <30-day response, automated where possible | | Data Minimization | PIA/DPIA for new systems; minimize collection | | Retention Limits | Retention schedule enforced; automated deletion | | Breach Notification | <72h to DPA; <30 days to affected individuals | | DPA/SCCs | Executed for all data processors; SCCs for non-EU transfers | | ROPA | Records of Processing Activities maintained current | | DPO | Appointed where required; accessible contact |
CCPA/CPRA additional requirements:
- Consumer rights: Know, Delete, Opt-Out of Sale, Correct, Limit
- Annual privacy policy update
- Data broker registration if applicable
- Sensitive personal information controls (SPI category)
EU AI Act obligations (by risk tier):
| AI Risk Tier | Requirements | |---|---| | Prohibited | No deployment (social scoring, real-time biometric surveillance) | | High-Risk | Conformity assessment, CE marking, registration, human oversight | | Limited Risk | Transparency obligations (chatbot disclosure) | | Minimal Risk | Voluntary codes of practice |
Phase 5 — Audit Lifecycle Management
Audit calendar management:
Q1: SOC 2 Type II observation period start; ISO 27001 surveillance
Q2: GDPR annual review; PCI-DSS self-assessment (SAQ)
Q3: Penetration test (application-security); SOC 2 interim testing
Q4: SOC 2 Type II audit fieldwork; ISO 27001 certification renewal
Ongoing: HIPAA privacy reviews; SOX controls testing (quarterly)
Pre-audit actions (90 days out):
- Commission
compliance-auditorfor gap assessment. - Remediate all critical/high findings.
- Assemble evidence packages by control domain.
- Brief control owners on auditor interview prep.
- Review and refresh all policies (must be <12 months old).
During audit:
- Designate audit coordinator (single point of contact)
- Use GRC platform for evidence delivery (no ad-hoc email transfers)
- Daily auditor status call during fieldwork
- Exception escalation to CISO within 24h
Post-audit:
- Management response to all findings within 15 business days
- Remediation plan tracked in risk register
- Letter of engagement for next audit cycle
Phase 6 — Policy & Standards Management
Policy hierarchy:
Level 1: Security Policy (Board-approved, annual review)
Level 2: Standards (CISO-approved, semi-annual review)
Level 3: Procedures (Domain-owner approved, quarterly review)
Level 4: Guidelines (Advisory, team-level)
Mandatory policies (must exist and be current):
- Information Security Policy
- Acceptable Use Policy
- Access Control Policy
- Data Classification & Handling Policy
- Incident Response Policy
- Business Continuity & DR Policy
- Vendor Risk Management Policy
- Privacy Policy (external-facing)
- AI Governance Policy
- Change Management Policy
Policy lifecycle: Draft → Legal Review → CISO Approval → Board Ratification (Level 1) → Publish → Annual Review → Retire
Non-Negotiable Compliance Rules
- No compliance gaps go untracked — every gap in risk register with owner and date
- Evidence must be audit-ready at all times — not "we can produce it" but "it is ready"
- Regulatory deadlines never missed — breach notifications, filings, renewals in calendar with 30-day advance alert
- No self-certification for high-risk frameworks — SOC 2, ISO 27001, HIPAA require independent assessment
- Third-party risk is first-party risk — vendor compliance posture assessed before onboarding and annually
- Policy exceptions require CISO approval — no informal exceptions; all documented in risk register
Related Skills
aviskaar/template-skill
documentation
VerifiedTrustedCommunity
Replace with a description of the skill and when the agent should use it. Write this as a trigger condition: 'Use this skill when...'
4SKILL.mdUpdated May 12, 2026
aviskaar/whitepaper-engine
development
VerifiedTrustedCommunity
Use this skill when a marketing team needs to produce a credibility-building whitepaper by collaborating with engineering, product, sales, and C-level teams. Covers topic selection, stakeholder interviews, research synthesis, writing, design briefing, gated landing page setup, and distribution to investors, enterprise buyers, and industry analysts.
4SKILL.mdUpdated May 12, 2026
aviskaar/threat-hunter
development
VerifiedTrustedCommunity
Use this skill when you need proactive threat hunting campaigns, MITRE ATT&CK-based hunt hypotheses, IOC sweeps, behavioral anomaly investigation, threat intelligence integration, adversary emulation planning, SOC analyst triage support, SIEM query development (KQL/SPL/YARA), or automated threat detection engineering. Trigger for threat hunting sprints, new threat intel indicators, or post-incident proactive sweeps.
4SKILL.mdUpdated May 12, 2026
aviskaar/tax-compliance
testing
VerifiedTrustedCommunity
Use this skill when a VP Tax, Tax Manager, Controller, or Finance Director needs to manage all tax obligations of a company — including corporate income tax, GST/VAT/Sales Tax, payroll taxes, transfer pricing, R&D tax credits, and multi-jurisdictional tax compliance. Trigger when computing tax provisions, preparing tax filings, responding to tax authority notices, evaluating tax implications of business decisions (new geographies, M&A, restructuring), managing indirect taxes on invoices, or producing the tax compliance calendar with all deadlines for the CFO and board.
4SKILL.mdUpdated May 12, 2026