implementing-compliance

Name: implementing-compliance
Author: ancoleman

49installs59forks

How to install implementing-compliance?

ancoleman/ai-design-components/implementing-compliance

$npx -y skills add ancoleman/ai-design-components --skill implementing-compliance

Installs into the current project.

Summary

Implement and maintain compliance with SOC 2, HIPAA, PCI-DSS, and GDPR using unified control mapping, policy-as-code enforcement, and automated evidence collection. Use when building systems requiring regulatory compliance, implementing security controls across multiple framework

Files · 1

View on GitHub

SKILL.md

1	# Compliance Frameworks
2
3	Implement continuous compliance with major regulatory frameworks through unified control mapping, policy-as-code enforcement, and automated evidence collection.
4
5	## Purpose
6
7	Modern compliance is a continuous engineering discipline requiring technical implementation of security controls. This skill provides patterns for SOC 2 Type II, HIPAA, PCI-DSS 4.0, and GDPR compliance using infrastructure-as-code, policy automation, and evidence collection. Focus on unified controls that satisfy multiple frameworks simultaneously to reduce implementation effort by 60-80%.
8
9	## When to Use
10
11	Invoke when:
12	- Building SaaS products requiring SOC 2 Type II for enterprise sales
13	- Handling healthcare data (PHI) requiring HIPAA compliance
14	- Processing payment cards requiring PCI-DSS validation
15	- Serving EU residents and processing personal data under GDPR
16	- Implementing security controls that satisfy multiple compliance frameworks
17	- Automating compliance evidence collection and audit preparation
18	- Enforcing compliance policies in CI/CD pipelines
19
20	## Framework Selection
21
22	### Tier 1: Trust & Security Certifications
23
24	SOC 2 Type II
25	- Audience: SaaS vendors, cloud service providers
26	- When required: Enterprise B2B sales, handling customer data
27	- Timeline: 6-12 month observation period
28	- 2025 updates: Monthly control testing, AI governance, 72-hour breach disclosure
29
30	ISO 27001
31	- Audience: Global enterprises
32	- When required: International business, government contracts
33	- Timeline: 3-6 month certification, annual surveillance
34
35	### Tier 2: Industry-Specific Regulations
36
37	HIPAA (Healthcare)
38	- Audience: Healthcare providers, health tech handling PHI
39	- When required: Processing Protected Health Information
40	- 2025 focus: Zero Trust Architecture, EDR/XDR, AI assessments
41
42	PCI-DSS 4.0 (Payment Card Industry)
43	- Audience: Merchants, payment processors
44	- When required: Processing, storing, transmitting cardholder data
45	- Effective: April 1, 2025 (mandatory)
46	- Key changes: Client-side security, 12-char passwords, enhanced MFA
47
48	### Tier 3: Privacy Regulations
49
50	GDPR (EU Privacy)
51	- Audience: Organizations processing EU residents' data
52	- When required: EU customers/users (extraterritorial)
53	- 2025 updates: 48-hour breach reporting, 6% revenue fines, AI transparency
54
55	CCPA/CPRA (California Privacy)
56	- Audience: Businesses serving California residents
57	- When required: Revenue >$25M, or 100K+ CA residents, or 50%+ revenue from data sales
58
59	For detailed framework requirements, see references/soc2-controls.md, references/hipaa-safeguards.md, references/pci-dss-requirements.md, and references/gdpr-articles.md.
60
61	## Universal Control Implementation
62
63	### Unified Control Strategy
64
65	Implement controls once, map to multiple frameworks. Reduces effort by 60-80%.
66
67	Implementation Priority:
68	1. Encryption (ENC-001, ENC-002): AES-256 at rest, TLS 1.3 in transit
69	2. Access Control (MFA-001, RBAC-001): MFA, RBAC, least privilege
70	3. Audit Logging (LOG-001): Centralized, immutable, 7-year retention
71	4. Monitoring (MON-001): SIEM, intrusion detection, alerting
72	5. Incident Response (IR-001): Detection, escalation, breach notification
73
74	### Control Categories
75
76	Identity & Access:
77	- Multi-factor authentication for privileged access
78	- Role-based access control with least privilege
79	- Quarterly access reviews
80	- Password policy: 12+ characters, complexity
81
82	Data Protection:
83	- Encryption: AES-256 (rest), TLS 1.3 (transit)
84	- Data classification and tagging
85	- Retention policies aligned with regulations
86	- Data minimization
87
88	Logging & Monitoring:
89	- Centralized audit logging (all auth and data access)
90	- 7-year retention (satisfies all frameworks)
91	- Immutable storage (S3 Object Lock)
92	- Real-time alerting
93
94	Network Security:
95	- Network segmentation and VPC isolation
96	- Firewalls with deny-by-default
97	- Intrusion detection/prevention
98	- Regular vulnerability scanning
99
100	Incident Response:
101	- Documented incident response plan
102	- Automated detection and alerting
103	- Breach notification: HIPAA 60d, GDPR 48h, SOC 2 72h, PCI-DSS immediate
104
105	Business Continuity:
106	- Automated backups with defined RPO/RTO
107	- Multi-region disaster recovery
108	- Regular failover testing
109
110	For complete control implementations, see references/control-mapping-matrix.md.
111
112	## Compliance as Code
113
114	### Policy Enforcement with OPA
115
116	Enforce compliance policies in CI/CD before infrastructure deployment.
117
118	Architecture:
119	```
120	Git Push → Terraform Plan → JSON → OPA Evaluation
121	├─► Pass → Deploy
122	└─► Fail → Block
123	```
124
125	**Example: Encryp

People who liked this also viewed

6 picks

Type

implementing-compliance

49installs59forks

View on GitHub

How to install implementing-compliance?

ancoleman/ai-design-components/implementing-compliance

$npx -y skills add ancoleman/ai-design-components --skill implementing-compliance

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Compliance Frameworks
2
3	Implement continuous compliance with major regulatory frameworks through unified control mapping, policy-as-code enforcement, and automated evidence collection.
4
5	## Purpose
6
7	Modern compliance is a continuous engineering discipline requiring technical implementation of security controls. This skill provides patterns for SOC 2 Type II, HIPAA, PCI-DSS 4.0, and GDPR compliance using infrastructure-as-code, policy automation, and evidence collection. Focus on unified controls that satisfy multiple frameworks simultaneously to reduce implementation effort by 60-80%.
8
9	## When to Use
10
11	Invoke when:
12	- Building SaaS products requiring SOC 2 Type II for enterprise sales
13	- Handling healthcare data (PHI) requiring HIPAA compliance
14	- Processing payment cards requiring PCI-DSS validation
15	- Serving EU residents and processing personal data under GDPR
16	- Implementing security controls that satisfy multiple compliance frameworks
17	- Automating compliance evidence collection and audit preparation
18	- Enforcing compliance policies in CI/CD pipelines
19
20	## Framework Selection
21
22	### Tier 1: Trust & Security Certifications
23
24	SOC 2 Type II
25	- Audience: SaaS vendors, cloud service providers
26	- When required: Enterprise B2B sales, handling customer data
27	- Timeline: 6-12 month observation period
28	- 2025 updates: Monthly control testing, AI governance, 72-hour breach disclosure
29
30	ISO 27001
31	- Audience: Global enterprises
32	- When required: International business, government contracts
33	- Timeline: 3-6 month certification, annual surveillance
34
35	### Tier 2: Industry-Specific Regulations
36
37	HIPAA (Healthcare)
38	- Audience: Healthcare providers, health tech handling PHI
39	- When required: Processing Protected Health Information
40	- 2025 focus: Zero Trust Architecture, EDR/XDR, AI assessments
41
42	PCI-DSS 4.0 (Payment Card Industry)
43	- Audience: Merchants, payment processors
44	- When required: Processing, storing, transmitting cardholder data
45	- Effective: April 1, 2025 (mandatory)
46	- Key changes: Client-side security, 12-char passwords, enhanced MFA
47
48	### Tier 3: Privacy Regulations
49
50	GDPR (EU Privacy)
51	- Audience: Organizations processing EU residents' data
52	- When required: EU customers/users (extraterritorial)
53	- 2025 updates: 48-hour breach reporting, 6% revenue fines, AI transparency
54
55	CCPA/CPRA (California Privacy)
56	- Audience: Businesses serving California residents
57	- When required: Revenue >$25M, or 100K+ CA residents, or 50%+ revenue from data sales
58
59	For detailed framework requirements, see references/soc2-controls.md, references/hipaa-safeguards.md, references/pci-dss-requirements.md, and references/gdpr-articles.md.
60
61	## Universal Control Implementation
62
63	### Unified Control Strategy
64
65	Implement controls once, map to multiple frameworks. Reduces effort by 60-80%.
66
67	Implementation Priority:
68	1. Encryption (ENC-001, ENC-002): AES-256 at rest, TLS 1.3 in transit
69	2. Access Control (MFA-001, RBAC-001): MFA, RBAC, least privilege
70	3. Audit Logging (LOG-001): Centralized, immutable, 7-year retention
71	4. Monitoring (MON-001): SIEM, intrusion detection, alerting
72	5. Incident Response (IR-001): Detection, escalation, breach notification
73
74	### Control Categories
75
76	Identity & Access:
77	- Multi-factor authentication for privileged access
78	- Role-based access control with least privilege
79	- Quarterly access reviews
80	- Password policy: 12+ characters, complexity
81
82	Data Protection:
83	- Encryption: AES-256 (rest), TLS 1.3 (transit)
84	- Data classification and tagging
85	- Retention policies aligned with regulations
86	- Data minimization
87
88	Logging & Monitoring:
89	- Centralized audit logging (all auth and data access)
90	- 7-year retention (satisfies all frameworks)
91	- Immutable storage (S3 Object Lock)
92	- Real-time alerting
93
94	Network Security:
95	- Network segmentation and VPC isolation
96	- Firewalls with deny-by-default
97	- Intrusion detection/prevention
98	- Regular vulnerability scanning
99
100	Incident Response:
101	- Documented incident response plan
102	- Automated detection and alerting
103	- Breach notification: HIPAA 60d, GDPR 48h, SOC 2 72h, PCI-DSS immediate
104
105	Business Continuity:
106	- Automated backups with defined RPO/RTO
107	- Multi-region disaster recovery
108	- Regular failover testing
109
110	For complete control implementations, see references/control-mapping-matrix.md.
111
112	## Compliance as Code
113
114	### Policy Enforcement with OPA
115
116	Enforce compliance policies in CI/CD before infrastructure deployment.
117
118	Architecture:
119	```
120	Git Push → Terraform Plan → JSON → OPA Evaluation
121	├─► Pass → Deploy
122	└─► Fail → Block
123	```
124
125	**Example: Encryp

People who liked this also viewed

6 picks

Type