19-grc-compliance

Name: 19-grc-compliance
Author: Masriyan

190stars37forks

How to install 19-grc-compliance?

masriyan/claude-code-cybersecurity-skill/19-grc-compliance

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 19-grc-compliance

Installs into the current project.

Summary

Governance, risk, and compliance — risk assessment and scoring, control mapping across NIST CSF 2.0 / ISO 27001:2022 / SOC 2 / CIS Controls v8, gap analysis, audit evidence preparation, and security policy generation

Files · 1

View on GitHub

SKILL.md

1	# GRC & Compliance
2
3	## Purpose
4
5	Enable Claude to operate as a governance, risk, and compliance partner: quantify and prioritize risk, map controls across the major frameworks, run gap analyses, prepare audit evidence, and draft clear, tailored security policies. Claude turns scattered control requirements into a single cross-framework view so one piece of evidence can satisfy many obligations.
6
7	> Advisory scope: This skill produces risk analysis, control mappings, and policy drafts to support a security/compliance program. It is decision-support, not legal advice or a certification. A qualified auditor or counsel should validate before formal attestation.
8
9	---
10
11	## Activation Triggers
12
13	This skill activates when the user asks about:
14	- Risk assessment, risk register, risk scoring, or treatment plans
15	- NIST CSF 2.0, NIST SP 800-53, ISO/IEC 27001:2022, SOC 2, PCI DSS 4.0, HIPAA, GDPR, CIS Controls v8
16	- Control mapping or crosswalk between frameworks
17	- Gap analysis against a standard or readiness for an audit/certification
18	- Audit evidence collection, control narratives, or an SoA (Statement of Applicability)
19	- Security policy, standard, or procedure drafting
20	- Third-party / vendor risk assessment
21	- Compliance posture reporting to leadership or a board
22
23	---
24
25	## Prerequisites
26
27	```bash
28	pip install pyyaml
29	```
30
31	No external tools required — this skill is primarily analytical and document-generation focused. Claude reads existing policies, configs, and evidence directly.
32
33	---
34
35	## Core Capabilities
36
37	### 1. Risk Assessment & Scoring
38
39	When asked to assess risk, run a structured, repeatable method:
40	1. Asset & context — identify assets, owners, data classification, and business impact (CIA).
41	2. Threats & vulnerabilities — enumerate relevant threat sources (map to MITRE ATT&CK where useful) and existing weaknesses.
42	3. Likelihood × Impact — score on a defined scale (e.g., 1–5 each) → inherent risk. Apply control effectiveness → residual risk. Support qualitative (heat map) and, where data exists, quantitative (single-loss/annualized-loss, or FAIR-style ranges) views.
43	4. Risk treatment — choose Mitigate / Transfer / Avoid / Accept; assign owner, due date, and the controls that move residual risk to within appetite.
44	5. Produce a risk register (see Output Standards) and a treatment plan ranked by residual risk.
45
46	Use `scripts/risk_register.py` to score and rank a YAML/CSV risk list and emit a heat-map summary.
47
48	### 2. Cross-Framework Control Mapping
49
50	Maintain one control statement mapped to many frameworks so evidence is reused, not duplicated. Anchor on NIST CSF 2.0 functions (GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER) and crosswalk outward:
51
52	\| Need \| Framework \| Anchor \|
53	\|------\|-----------\|--------\|
54	\| Program governance \| NIST CSF 2.0 \| GV / ID / PR / DE / RS / RC \|
55	\| Certifiable ISMS \| ISO/IEC 27001:2022 \| Annex A (93 controls, 4 themes) \|
56	\| Service-org attestation \| SOC 2 \| Trust Services Criteria (CC1–CC9, A/C/PI/P) \|
57	\| Federal / detailed controls \| NIST SP 800-53 Rev.5 \| 20 control families \|
58	\| Cardholder data \| PCI DSS 4.0 \| 12 requirements \|
59	\| Prioritized baseline \| CIS Controls v8 \| 18 controls / IG1–IG3 \|
60
61	Use `scripts/control_mapper.py` to crosswalk a control or to show, for a chosen framework, which related-framework requirements a single control satisfies.
62
63	### 3. Gap Analysis & Audit Readiness
64
65	When asked for a gap analysis:
66	1. Select the target framework and scope (systems, locations, data).
67	2. Assess each control: Implemented / Partial / Not Implemented / Not Applicable, with evidence reference.
68	3. Compute coverage % per domain/function and overall.
69	4. For each gap: required action, owner, effort, and target date → remediation roadmap.
70	5. For ISO 27001, produce a Statement of Applicability (control, applicable Y/N, justification, status).
71
72	### 4. Audit Evidence & Control Narratives
73
74	- Build an evidence index: control → required artifact → location/owner → cadence (e.g., quarterly access review export, change tickets, training records, scan reports).
75	- Draft control narratives auditors expect: what the control is, who operates it, frequency, and how it's evidenced.
76	- Flag common audit failures: stale access reviews, missing change-management tickets, untested IR/BCP plans, no log retention proof, unowned exceptions.
77
78	### 5. Security Policy & Standard Generation
79
80	Draft tailored, plain-language policy documents with a consistent structure (Purpose, Scope, Policy Statements, Roles & Responsibilities, Enforcement, Exceptions, Review cadence, Mapped controls). Common s

People who liked this also viewed

6 picks

Type

19-grc-compliance

190stars37forks

View on GitHub

How to install 19-grc-compliance?

masriyan/claude-code-cybersecurity-skill/19-grc-compliance

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 19-grc-compliance

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# GRC & Compliance
2
3	## Purpose
4
5	Enable Claude to operate as a governance, risk, and compliance partner: quantify and prioritize risk, map controls across the major frameworks, run gap analyses, prepare audit evidence, and draft clear, tailored security policies. Claude turns scattered control requirements into a single cross-framework view so one piece of evidence can satisfy many obligations.
6
7	> Advisory scope: This skill produces risk analysis, control mappings, and policy drafts to support a security/compliance program. It is decision-support, not legal advice or a certification. A qualified auditor or counsel should validate before formal attestation.
8
9	---
10
11	## Activation Triggers
12
13	This skill activates when the user asks about:
14	- Risk assessment, risk register, risk scoring, or treatment plans
15	- NIST CSF 2.0, NIST SP 800-53, ISO/IEC 27001:2022, SOC 2, PCI DSS 4.0, HIPAA, GDPR, CIS Controls v8
16	- Control mapping or crosswalk between frameworks
17	- Gap analysis against a standard or readiness for an audit/certification
18	- Audit evidence collection, control narratives, or an SoA (Statement of Applicability)
19	- Security policy, standard, or procedure drafting
20	- Third-party / vendor risk assessment
21	- Compliance posture reporting to leadership or a board
22
23	---
24
25	## Prerequisites
26
27	```bash
28	pip install pyyaml
29	```
30
31	No external tools required — this skill is primarily analytical and document-generation focused. Claude reads existing policies, configs, and evidence directly.
32
33	---
34
35	## Core Capabilities
36
37	### 1. Risk Assessment & Scoring
38
39	When asked to assess risk, run a structured, repeatable method:
40	1. Asset & context — identify assets, owners, data classification, and business impact (CIA).
41	2. Threats & vulnerabilities — enumerate relevant threat sources (map to MITRE ATT&CK where useful) and existing weaknesses.
42	3. Likelihood × Impact — score on a defined scale (e.g., 1–5 each) → inherent risk. Apply control effectiveness → residual risk. Support qualitative (heat map) and, where data exists, quantitative (single-loss/annualized-loss, or FAIR-style ranges) views.
43	4. Risk treatment — choose Mitigate / Transfer / Avoid / Accept; assign owner, due date, and the controls that move residual risk to within appetite.
44	5. Produce a risk register (see Output Standards) and a treatment plan ranked by residual risk.
45
46	Use `scripts/risk_register.py` to score and rank a YAML/CSV risk list and emit a heat-map summary.
47
48	### 2. Cross-Framework Control Mapping
49
50	Maintain one control statement mapped to many frameworks so evidence is reused, not duplicated. Anchor on NIST CSF 2.0 functions (GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER) and crosswalk outward:
51
52	\| Need \| Framework \| Anchor \|
53	\|------\|-----------\|--------\|
54	\| Program governance \| NIST CSF 2.0 \| GV / ID / PR / DE / RS / RC \|
55	\| Certifiable ISMS \| ISO/IEC 27001:2022 \| Annex A (93 controls, 4 themes) \|
56	\| Service-org attestation \| SOC 2 \| Trust Services Criteria (CC1–CC9, A/C/PI/P) \|
57	\| Federal / detailed controls \| NIST SP 800-53 Rev.5 \| 20 control families \|
58	\| Cardholder data \| PCI DSS 4.0 \| 12 requirements \|
59	\| Prioritized baseline \| CIS Controls v8 \| 18 controls / IG1–IG3 \|
60
61	Use `scripts/control_mapper.py` to crosswalk a control or to show, for a chosen framework, which related-framework requirements a single control satisfies.
62
63	### 3. Gap Analysis & Audit Readiness
64
65	When asked for a gap analysis:
66	1. Select the target framework and scope (systems, locations, data).
67	2. Assess each control: Implemented / Partial / Not Implemented / Not Applicable, with evidence reference.
68	3. Compute coverage % per domain/function and overall.
69	4. For each gap: required action, owner, effort, and target date → remediation roadmap.
70	5. For ISO 27001, produce a Statement of Applicability (control, applicable Y/N, justification, status).
71
72	### 4. Audit Evidence & Control Narratives
73
74	- Build an evidence index: control → required artifact → location/owner → cadence (e.g., quarterly access review export, change tickets, training records, scan reports).
75	- Draft control narratives auditors expect: what the control is, who operates it, frequency, and how it's evidenced.
76	- Flag common audit failures: stale access reviews, missing change-management tickets, untested IR/BCP plans, no log retention proof, unowned exceptions.
77
78	### 5. Security Policy & Standard Generation
79
80	Draft tailored, plain-language policy documents with a consistent structure (Purpose, Scope, Policy Statements, Roles & Responsibilities, Enforcement, Exceptions, Review cadence, Mapped controls). Common s

People who liked this also viewed

6 picks

Type