compliance

Plugin compliance from marketplace metapowers in bromso/metapowers. Commands read from the repo's manifest — 18 days ago.

Skills (51)

• ada-wcag

  Assess ADA Title III and WCAG 2.2 AA compliance as a legal obligation — applicability, lawsuit risk, DOJ guidance, state rules, and remediation. Use when the user worries about ADA website lawsuits or a demand letter and how their site measures up legally. Not for the audit or a multi-market legal m

• audit-readiness

  Assess whether a project is ready for its formal audit — evidence completeness, control operating periods, a mock audit, readiness per regulation and a pre-audit punch list. Use when remediation is mostly done, an audit date is approaching, and the user asks if they are ready, what evidence is still

• auditor-selection

  Evaluate and shortlist audit firms with weighted selection criteria, an RFP template and a scoring matrix, including combined SOC 2 and ISO 27001 engagements. Use when the user needs to pick an auditor or certification body, compare audit firm quotes, or write an RFP for an audit.

• bank-partnership

  Assess what a partner bank and its regulators expect of a fintech — OCC/FDIC third-party guidance, compliance management pass-through, UDAAP and fair lending, exam readiness and exit planning. Use when a fintech or BaaS program depends on a sponsor bank and wants to assess whether its own program me

• breach-notification

  Assess breach notification readiness across GDPR, US state laws, HIPAA, PCI DSS, NIS2 and contractual SLAs, with a notification decision tree and template library. Use when the user wants to check who they would have to notify after a data breach and whether their own process could meet every deadli

• ccpa

  Assess CCPA/CPRA compliance — applicability thresholds, consumer rights, Do Not Sell or Share and GPC, service provider terms — as a scored control-gap assessment. Use when the user is subject to California privacy law and wants to assess how their own request handling, opt-outs and vendor terms mea

• certification-tracker

  Track the certifications and attestations a business holds — status, validity, surveillance audits, owners and between-audit obligations — in a RAG register. Use when the user asks what certifications and attestations they hold, their current status, or what obligations they owe between audits. Not

• compliance-priorities

  Prioritize the applicable regulations by business impact, deadline urgency and effort into three tiers, with quick wins and certification dependencies. Use when the user has a list of regulations or certifications and asks which ones to tackle first or which customers will demand soonest.

• compliance-questionnaire

  Answer a customer security or compliance questionnaire (SIG, CAIQ, VSAQ or custom) from existing compliance artifacts, flagging answers that need verification or may worry the customer. Use when a prospect or customer sends a security questionnaire or vendor assessment and the user needs it filled i

• compliance-reporting

  Generate compliance status reports at three levels — an executive RAG summary, a detailed operational report and customer-facing trust content — with a reporting cadence and trends. Use when the user needs a compliance update for leadership or the board, a monthly status report, or trust page conten

• compliance-roadmap

  Build a phased compliance roadmap with milestones, dependencies between certifications, the critical path and a budget per phase. Use when the user asks for a plan or timeline to get several certifications, wants to know how long SOC 2 then ISO 27001 will take, or needs a compliance budget.

• compliance-score

  Calculate a weighted compliance score across all assessed regulations, with per-regulation and per-domain RAG ratings, weakest areas, trend and gap to target. Use when the user asks how compliant they are overall, wants a single compliance number, or asks which regulation is in the worst shape.

• continuous-monitoring

  Design a continuous compliance monitoring program — automated control checks, dashboard metrics, alert thresholds and escalation, and GRC tooling such as Vanta or Drata. Use when the user wants to stay audit-ready between audits, automate compliance checks, or set up a compliance dashboard. Not for

• control-framework

  Select a primary control framework (ISO 27001, NIST CSF, CIS Controls, NIST 800-53 or SOC 2) and map its controls to every applicable regulation to find leverage points and gaps. Use when the user is pursuing several regulations at once and asks which control framework to build the program on. Not f

• control-mapping

  Map each gap in the remediation register to unified controls that close it across several regulations, then sequence those controls by coverage and dependency. Use when the user has a gap register and asks which controls fix the most gaps, or in what order to implement remediation controls.

• cross-regulation-map

  Show clause by clause how controls satisfy several regulations at once, such as SOC 2, ISO 27001 and GDPR, highlighting high-coverage controls and the minimum control set. Use when the user asks how two or more frameworks overlap or wants a standalone crosswalk without running the full compliance pr

• csa-star

  Assess CSA STAR readiness against the Cloud Controls Matrix v4 domains, choose between STAR Level 1 and Level 2, and map to existing ISO 27001 or SOC 2 controls. Use when a cloud provider wants a CSA STAR registry listing or STAR certification and needs to know which level to target. Not for a one-o

• dora

  Assess EU financial-sector ICT resilience under DORA, plus PSD2 strong customer authentication and MiFID II trading-system controls. Use when the user is an EU bank, insurer, payment or investment firm, or its ICT provider, and wants to assess how their own resilience program measures up to DORA.

• eaa-en301549

  Assess European Accessibility Act and EN 301 549 compliance — what is in scope, WCAG 2.1 AA mapping, non-web requirements and the conformance statement. Use when the user sells digital products or services in the EU and asks which are in scope and how they measure up. Not for the audit or a multi-ma

• eu-ai-act

  Assess EU AI Act compliance — inventory AI systems, classify them by risk tier, screen for prohibited practices, and check high-risk, GPAI and transparency obligations against the enforcement timeline. Use when the user builds or deploys AI used in the EU and wants to assess how their own systems ar

• evidence-package

  Compile an auditor-ready evidence package — evidence checked for currency and completeness, organized by control, indexed to regulation clauses, with a delivery plan. Use when the auditor has asked for evidence, fieldwork is about to start, or the user needs to hand over a request list or evidence b

• evidence-plan

  Design the evidence collection strategy for each control — evidence type, format, frequency, owner, storage and retention, plus a collection calendar and automation options. Use when the user asks what evidence auditors will want for each control, who should collect it, or how to automate evidence c

• fedramp

  Assess FedRAMP and StateRAMP readiness — FIPS 199 impact level, NIST 800-53 control families, 3PAO requirements and the ATO package (SSP, POA&M, ConMon). Use when a cloud or SaaS company plans to sell to US federal agencies or state governments and wants to assess how far its own environment is from

• financial-compliance

  Assess financial regulatory compliance for broker-dealers, advisers and public companies — FINRA cybersecurity and record retention, SOX IT general controls, and SEC cyber incident disclosure. Use when a broker-dealer, adviser or public company wants to assess how its own controls measure up to SOX

• gap-analysis

  Aggregate the findings from every regulation assessment into one deduplicated gap register, scored by risk, effort and urgency, with quick wins and root causes. Use when several regulation assessments are done and the user asks which gaps to fix first across all of them. Not for a gap check against

• gdpr

  Assess EU GDPR compliance as a scored control-gap assessment — lawful basis, records of processing, DPIAs, data subject rights, transfers, DPO and breach readiness. Use when the user processes EU personal data and wants to see how their processing measures up to GDPR, area by area. Not for legal ana

• hipaa

  Assess HIPAA compliance — covered entity or business associate status, the Privacy Rule, Security Rule safeguards, the Breach Notification Rule and BAA coverage. Use when the user handles patient health data for US healthcare customers and wants to assess how their own safeguards and BAAs measure up

• hitrust

  Assess HITRUST CSF certification readiness — choose the e1, i1 or r2 assessment, score control domains, map existing ISO 27001, NIST and SOC 2 controls, and estimate the certification path. Use when a healthcare customer demands HITRUST and the user wants to assess which assessment to pursue and how

• implementation-plan

  Create a phased implementation plan that groups controls into three waves with steps, effort, owners, dates, resources and go/no-go checkpoints. Use when the user knows which controls they need and asks who does what by when, how many person-days remediation will take, or how to schedule it.

• intl-privacy

  Assess privacy compliance under Canada's PIPEDA (and provincial laws such as Quebec Law 25), Singapore's PDPA and Japan's APPI, with a cross-jurisdiction comparison matrix. Use when the user has customers or users in Canada, Singapore or Japan and wants to assess how their own privacy practices meas

• iso22301

  Assess ISO 22301 business continuity management system readiness — BIA with RTO and RPO, disruption risk assessment, continuity strategies and plans, and the exercise program. Use when the user wants ISO 22301 certification or must prove a certifiable continuity program and wants to assess its own B

• iso27001

  Assess ISO/IEC 27001:2022 ISMS compliance — clauses 4 to 10, all 93 Annex A controls, a draft Statement of Applicability and the risk treatment plan. Use when the user wants ISO 27001 certification and wants to assess how far their own ISMS is from it, or needs a Statement of Applicability.

• iso27017

  Assess ISO 27017 cloud security controls — the cloud service model, shared responsibility between provider and customer, and cloud-specific extensions to ISO 27001 controls. Use when a cloud or SaaS company with ISO 27001 wants to assess its own cloud controls for the 27017 extension or clarify what

• iso27018

  Assess ISO 27018 protection of personal data in public cloud — PII processor obligations, cloud-specific PII protections, sub-processor transparency and contract terms. Use when a cloud provider processing customers' personal data wants to assess how its own PII protections measure up for ISO 27018.

• iso27701

  Assess ISO 27701 privacy information management (PIMS) compliance — controller and processor controls, mapped to GDPR articles and CCPA sections. Use when the user has or is pursuing ISO 27001 and wants to assess how far their own privacy program is from a certifiable ISO 27701 PIMS.

• iso42001

  Assess readiness for ISO/IEC 42001, the certifiable AI management system standard — AI policy, risk and impact assessment, data and lifecycle controls, third-party AI and ISMS reuse. Use when the user wants AI governance certification or a customer asks for ISO 42001 and they want to assess how far

• kyc-aml

  Assess KYC, AML and Bank Secrecy Act compliance — customer identification, CDD and EDD, beneficial ownership, transaction monitoring, SAR and CTR filing, OFAC screening and independent testing. Use when a fintech or financial institution moves money for customers and wants to assess whether its own

• lgpd

  Assess compliance with Brazil's LGPD — the ten legal bases, data subject rights, the Encarregado (DPO), ANPD obligations and international transfers. Use when the user has users or customers in Brazil and wants to assess how their own processing measures up to LGPD, including where it differs from G

• nis2

  Assess NIS2 Directive compliance — essential or important entity classification, the ten Article 21 risk management measures, 24 and 72 hour incident reporting, and supply chain security. Use when the user operates in or serves critical EU sectors and wants to assess their entity classification and

• nist-ai-rmf

  Assess alignment with the voluntary NIST AI Risk Management Framework across Govern, Map, Measure and Manage and the trustworthiness characteristics. Use when the user wants to assess their own AI risk practices against a non-certifiable framework, often because a US customer or agency asks about NI

• payment-network

  Assess payment network compliance — Nacha ACH rules, Visa and Mastercard rules and registrations, state money transmitter licenses and FinCEN MSB registration. Use when a fintech moves money or runs card programs and wants to assess its own licensing coverage and adherence to ACH and card network ru

• pci-dss

  Assess PCI DSS compliance — SAQ type and merchant level, cardholder data environment scope, the 12 requirements, and scope reduction options such as tokenization. Use when the user takes card payments and wants to assess their own SAQ type and PCI compliance or find ways to shrink their PCI scope.

• policy-gaps

  Identify which policies the applicable regulations require, which are missing or outdated, and produce a prioritized policy development list with effort estimates. Use when the user asks which security or privacy policies they need for an audit, or whether their existing policies are good enough.

• regulation-research

  Research one law or standard as a briefing — scope, key requirements, deadlines, enforcement and penalties, practical compliance approaches, and likely applicability. Use when the user wants a briefing on an unfamiliar law or standard, such as what it requires or who it covers, before deciding wheth

• regulatory-landscape

  Map every regulation and certification that applies to a business from its jurisdictions, data types, industry and customer demands — the starting point of the compliance program. Use when the user asks which regulations apply to their company or product, or is starting a compliance program from scr

• regulatory-watch

  Track regulatory changes relevant to the business and assess each change's impact on controls and policies, with action plans and monitoring sources. Use when the user asks what is changing in their regulations, whether a new law or amendment affects them, or how to keep up with regulatory updates.

• renewal-calendar

  Maintain a 12-month forward calendar of certification expiries, renewals, audit windows, surveillance visits and evidence deadlines, with workload peaks. Use when the user asks when a certification expires or is up for renewal, or wants to plan the compliance year so audits do not collide. Not for c

• soc2

  Assess SOC 2 readiness as a scored control-gap assessment — scope the Trust Services Criteria, test the Security and other in-scope criteria, and decide between Type I and Type II. Use when customers are asking for a SOC 2 report and the user wants to assess which criteria apply and where their cont

• uk-gdpr

  Assess UK GDPR compliance — divergences from EU GDPR, ICO expectations, UK transfer mechanisms (IDTA and addendum), PECR cookie and marketing rules, and UK breach reporting. Use when the user processes personal data of people in the UK and wants to assess what their own program must change for UK GD

• us-state-privacy

  Assess compliance with US state comprehensive privacy laws such as Virginia, Colorado, Connecticut, Utah and newer states, with a cross-state matrix and common baseline. Use when the user has US consumers outside California and wants to assess which state privacy laws apply and how their own program

• vendor-tprm

  Assess the vendor and third-party risk management program — vendor tiering, due diligence, contract clauses, ongoing monitoring, offboarding and subprocessor management. Use when the user wants to assess their own vendor risk program, needs TPRM for an audit, or a customer asks how they vet their ow

Hooks (1)

• PreToolUse

  "${CLAUDE_PLUGIN_ROOT}"/hooks/phase-gate.sh

Similar plugins