poam-automation

Editable draw.io diagram patterns for GRC system boundaries, evidence flows, control maps, risk treatment, audits, crosswalks, TPRM, POA&M, data flows, RACI, and operating models.

13 skills · 13 commands

Maps IaC to compliance controls, generates policies, collects evidence, reviews PRs

7 skills · 19 commands

Build and deploy a professional portfolio website for GRC engineers — certifications, frameworks, audit experience, and AWS hosting.

7 skills · 7 commands

Translate findings, risks, and metrics into narratives leadership reads. Reference implementation of the Reporting category from RFC #38.

5 skills · 4 commands

ISO 27001 Annex A controls and ISMS implementation guidance

1 skill · 8 commands

NIST 800-53 control families and baseline selection (Low/Moderate/High)

1 skill · 8 commands

The Vanta plugin connects Claude to Vanta's security and compliance platform through the Vanta MCP server. List failing compliance tests, get test-specific remediation context, and fix failing tests with code changes — directly from your Claude session.

3 skills · 3 MCP servers

Get a defense supplier ready for a CMMC 2.0 Level 2 assessment. Three deterministic stdlib scripts: an SPRS scorer that weights all 110 NIST SP 800-171 Rev 2 requirements per 32 CFR 170.24 and blocks gaps that can never go on a POA&M; a POA&M closeout tracker that checks every deferred gap against the 180-day Conditional status deadline and the annual affirmation calendar; and a scope classifier that sorts the asset inventory into the 170.19 categories and blocks on assets missing from the SSP or cloud providers holding CUI without FedRAMP. Ships cs-cmmc-assessor agent, /cs-cmmc-readiness and /cs-sprs-score commands, 3 cited references and a readiness sign-off.

1 skill · 2 commands · 1 agent

USA Federal Civilian Overlay — 10 commands for FedRAMP, FISMA/NIST 800-53, CISA Zero Trust, OMB M-19-17 ICAM, NIST AI RMF, OMB M-25-21/M-25-22 AI assurance, E-Gov §208 PIA, EO 14028 SBOM

10 commands

Open-source compliance workflows for the Probo MCP API, plus the using-prb CLI skill

5 skills · 2 commands · 2 MCP servers

OWASP cdxgen toolkit for coding agents: generate, enrich, audit, sign, validate, convert, and explore CycloneDX BOMs (SBOM, CBOM, HBOM, OBOM, SaaSBOM, AI-BOM, VDR) across source code, containers, live hosts, and hardware.

14 skills · 1 agent · hooks

Expert SOC 2 compliance advisor covering all Trust Services Criteria — gap analysis, policy drafting, control documentation, audit evidence, and vendor risk.

1 skill