grc-engineering-suite

Editable draw.io diagram patterns for GRC system boundaries, evidence flows, control maps, risk treatment, audits, crosswalks, TPRM, POA&M, data flows, RACI, and operating models.

13 skills · 13 commands

Maps IaC to compliance controls, generates policies, collects evidence, reviews PRs

7 skills · 19 commands

Build and deploy a professional portfolio website for GRC engineers — certifications, frameworks, audit experience, and AWS hosting.

7 skills · 7 commands

Translate findings, risks, and metrics into narratives leadership reads. Reference implementation of the Reporting category from RFC #38.

5 skills · 4 commands

ISO 27001 Annex A controls and ISMS implementation guidance

1 skill · 8 commands

NIST 800-53 control families and baseline selection (Low/Moderate/High)

1 skill · 8 commands

SOC 2 Trust Service Criteria expertise and Type I/II assessment support

1 skill · 7 commands

CMMC v2.0 (DoD contractors) with 5 levels and C3PAO assessment prep

2 skills · 5 commands

Evidence review, control validation, and audit workpaper generation for external auditors

3 skills · 4 commands

PCI DSS v4.0.1 compliance with ROC guidance, SAQ selection, and March 2025 requirements

1 skill · 6 commands

Socratic primer + drill plugin for new-to-GRC practitioners. Get up to speed on a framework, control, or role without already knowing it.

3 skills · 4 commands

US Export Controls: ITAR (defense) + EAR (dual-use commercial) compliance

1 skill · 6 commands

CIS Controls v8 baseline security with IG1/IG2/IG3 levels

1 skill · 5 commands

CSA Cloud Controls Matrix with 197 controls and CAIQ support

1 skill · 5 commands

DORA EU Digital Operational Resilience Act for financial entities

1 skill · 5 commands

Essential 8 Australian cyber security strategies with maturity levels

1 skill · 5 commands

FedRAMP 20X automated authorization with KSIs, continuous monitoring, and auto-sync from official docs

1 skill · 4 commands · hooks

GDPR EU privacy regulation with DPIA and data subject rights

1 skill · 5 commands

GLBA Gramm-Leach-Bliley Act for financial institution privacy

1 skill · 5 commands

Policy management, risk registers, and compliance tracking for internal GRC teams

3 skills · 3 commands

Vendor assessments, questionnaire analysis, and risk scoring for third-party risk management

3 skills · 3 commands

HITRUST CSF healthcare security with i1/r2 assessments

1 skill · 5 commands

NYDFS 23 NYCRR 500 cybersecurity requirements for financial services

1 skill · 5 commands

StateRAMP state/local government cloud authorization

1 skill · 5 commands

GRC connector for AWS Secrets Manager: rotation, customer-managed KMS, resource policy, and access-pattern checks → v1 finding contract. Hybrid shape supports opt-in secret retrieval to stdout or 0600-permission files.

1 skill · 4 commands

FedRAMP Rev 5 traditional authorization with SSP/SAP/SAR/POA&M and NIST 800-53 controls

1 skill · 4 commands

Iterative GRC automation loops for gap-remediation burndown and quarterly evidence sweeps.

4 commands · hooks

India Digital Personal Data Protection Act, 2023 — reference-depth plugin with scope determination, evidence checklist, and breach-process workflow backed by the SCF crosswalk.

1 skill · 4 commands

Australian IRAP (ISM + Essential Eight) for government cloud

1 skill · 4 commands

Japanese ISMAP government cloud security (ISO 27001/27017/27018)

1 skill · 4 commands

Canadian PBMM (Protected B Medium Medium) with ITSG-33 controls

1 skill · 4 commands

Build and deploy a serverless trust center — public compliance posture, gated document access with optional NDA e-signature, admin dashboard. Deploys to AWS.

1 skill · 4 commands

APRA CPS 234 reference plugin with scope, evidence checklist, and SCF-backed gap assessment.

1 skill · 3 commands

GRC connector for AWS: IAM, S3, CloudTrail, EBS compliance checks → v1 finding contract

1 skill · 3 commands

GRC connector for Azure: Entra ID, Storage, Key Vault, Monitor, and Defender for Cloud to v1 finding contract

1 skill · 3 commands

GRC connector for CrowdStrike Falcon: sensor coverage, policies, and host-group scoping to v1 finding contract

1 skill · 3 commands

UK NCSC Cyber Essentials Plus (CE+) v3.3 Danzell — gap assessments, evidence checklists, remediation plans, and cross-framework mapping to ISO 27001 and NIST CSF.

1 skill · 3 commands

GRC connector for Datadog: log retention, audit logs, monitor coverage, SSO, and RBAC to v1 finding contract

1 skill · 3 commands

GRC connector for Drata: wraps drata-cli workflows and normalizes compliance posture to v1 finding contract

1 skill · 3 commands

EU NIS2 Directive (2022) — reference-depth plugin backed by the SCF crosswalk (68 SCF → 30 framework controls).

1 skill · 3 commands

Knowledge source for Google Developer Knowledge API: current Google developer documentation citations for GRC workflows.

1 skill · 3 commands

GRC connector for Google Cloud: IAM, Cloud Storage, audit logs, KMS rotation, Compute OS Login → v1 finding contract

1 skill · 3 commands

GCP Secret Manager name inventory and operator-only runtime injection.

1 skill · 3 commands

GRC connector for GitHub: branch protection, secret scanning, Dependabot, code scanning → v1 finding contract

1 skill · 3 commands

Japan APPI reference plugin with scope, evidence checklist, and SCF-backed gap assessment.

1 skill · 3 commands

NIST Cybersecurity Framework (v2.0) — reference-depth plugin backed by the SCF crosswalk (250 SCF → 134 framework controls).

1 skill · 3 commands

GRC connector for Okta: password/MFA/session policies, inactive users, admin factor enrollment → v1 finding contract

1 skill · 3 commands

OSCAL toolkit: validate and convert catalogs, profiles, SSPs, SAPs, SARs, POA&Ms, assessment results, component definitions. Wraps ethanolivertroy/oscal-cli.

1 skill · 3 commands

GRC connector wrapping networkbm/POAM-Automation-Tool: converts vulnerability scans into FedRAMP POA&M Excel and emits NIST-800-53-r5 (SI-2) findings → v1 finding contract.

1 skill · 3 commands

Singapore MAS TRM reference plugin with scope, evidence checklist, and SCF-backed gap assessment.

1 skill · 3 commands

Singapore - Personal Data Protection Ac (PDPA) (2012) — reference-depth plugin backed by the SCF crosswalk (30 SCF → 14 framework controls).

1 skill · 3 commands

GRC connector for Slack: workspace 2FA, SSO/session, retention, app approvals, and DLP visibility to v1 finding contract

1 skill · 3 commands

GRC connector for Snowflake: MFA, network policies, masking/row access policies, session timeout, and retention to v1 finding contract

1 skill · 3 commands

GRC connector for Splunk: index retention, RBAC, audit coverage, search ACLs, and auth posture to v1 finding contract

1 skill · 3 commands

GRC connector for Tenable.io/Tenable.sc: scan coverage, credentialed scans, vulnerability age, and scan access to v1 finding contract

1 skill · 3 commands

GRC connector wrapping testssl.sh: TLS/SSL protocol, cipher, certificate, and known-CVE checks on HTTPS endpoints → v1 finding contract

1 skill · 3 commands

California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) — Reference plugin with scope determination, evidence checklist, and SCF-backed gap assessment for the California Privacy Protection Agency (CPPA) regulations.

1 skill · 3 commands

NERC CIP reference plugin with scope, evidence checklist, and SCF-backed gap assessment.

1 skill · 3 commands

US Sarbanes-Oxley Act of 2002 (SOX) — Reference-depth plugin for ICFR scoping, IT General Control (ITGC) testing, and §302/§404/§906 evidence preparation. Backed by the SCF crosswalk (4 SCF → 17 framework controls).

1 skill · 3 commands

GRC connector for Wiz CNAPP: configuration findings, issues, vulnerabilities, and cloud inventory to v1 finding contract

1 skill · 3 commands

Convert FedRAMP Rev 5 SSP DOCX templates to validated OSCAL 1.2.0 SSP JSON. Wraps ethanolivertroy/frdocx-to-froscal-ssp.

1 skill · 2 commands

HIPAA Security Rule (45 CFR Part 164, Subpart C) for ePHI protection with Administrative, Physical, and Technical Safeguards

1 skill · 2 commands

Guide a research project through the academic lifecycle — idea, literature, methodology, writing, feedback, publishing, and authorship — with verified sources and a durable tracker.

1 skill · 1 command

Swiss Federal Act on Data Protection (nFADP) — stub-depth plugin backed by the SCF crosswalk (35 SCF → 90 framework controls).

1 skill · 1 command

NIST AI 600-1 (Generative AI Profile) — stub-depth plugin backed by the SCF crosswalk (139 SCF controls map to 250 profile items and suggested actions).

1 skill · 1 command

NIST AI 100-1 (AI RMF 1.0) — stub-depth plugin backed by the SCF crosswalk (158 SCF → 91 framework controls).

1 skill · 1 command

Run trusted local commands with 1Password secret references and suppressed output.

1 skill · 1 command

FINRA Broker-Dealer Cybersecurity Guidance — stub-depth plugin backed by the SCF crosswalk (17 SCF → 39 framework controls).

1 skill · 1 command

Operator-only Vault KV runtime injection into a trusted local process.

1 skill · 1 command

Localhost compliance posture dashboard for monitor-continuous JSON output. Reference implementation of the Dashboards category from RFC #38.

1 command