claude

cybersecurity-grc

Cybersecurity governance, risk & compliance (GRC) team — agents (grc-architect, control-and-evidence-engineer, audit-and-third-party-risk-lead) for the security-compliance program layer: framework selection & scoping (SOC 2 TSC, ISO 27001 + Annex A, NIST CSF 2.0, NIST 800-53), the ISMS, control crosswalk across frameworks, the Statement of Applicability; control implementation & operating effectiveness, policy authoring, evidence collection & continuous control monitoring, Type I vs Type II readiness; audit readiness, gap assessments, and vendor/third-party risk (TPRM tiering, SIG/CAIQ, shared-responsibility, monitoring). Decision-tree bank (Mermaid trees), best-practices, skills, commands, templates, a hook, a grc_calc.py risk/coverage/readiness calculator, scenarios. Seams: AppSec -> security-engineering; financial-regulator -> regulatory-compliance; privacy mechanics -> data-governance-privacy; cloud config -> aws/azure/gcp-cloud. Requires ravenclaude-core@>=0.7.0.

9 on GitHubby Matt Corbettv0.2.2MITupdated today
/

Plugin cybersecurity-grc from marketplace ravenclaude in mcorbett51090/RavenClaude. Commands read from the repo's manifest — today.

This plugin runs code on your machine — its hooks fire automatically on events like tool use. The exact commands are listed below; read them before installing.

What it installs

Skills (3)

  • evidence-and-audit-readiness

    Set the control-testing cadence, build evidence collection and continuous control monitoring, decide Type I vs Type II readiness, run a gap assessment and manage the auditor PBC list, and own third-party risk — vendor tiering, SIG/CAIQ, shared-responsibility, and ongoing monitoring — so evidence is

  • framework-selection-and-control-mapping

    Choose the right security-compliance framework for the org's size/risk/customer demand, scope the audit boundary, crosswalk controls across SOC 2 TSC / ISO 27001 Annex A / NIST CSF 2.0 / 800-53 so one evidenced control attests many, and author a Statement of Applicability whose every exclusion is ju

  • risk-register-and-assessment

    Build a risk register (assets, threats, likelihood x impact scoring), drive control selection from risk rather than from a framework checklist, choose a treatment per risk (mitigate / accept / transfer / avoid), and track residual risk with a named owner — so every control traces to a risk and every

Slash commands (3)

  • /cybersecurity-grc:audit-readiness-review

    Run a gap assessment before fieldwork: control readiness, evidence-cadence check, Type I vs Type II readiness, the auditor PBC list, and third-party risk.

  • /cybersecurity-grc:build-risk-register

    Build a risk register, score likelihood x impact, choose a treatment per risk, and drive control selection from risk rather than from a framework checklist.

  • /cybersecurity-grc:scope-compliance-program

    Shape a security-compliance program: pick the framework, scope the audit boundary, crosswalk controls across frameworks, and produce the Statement of Applicability.

Subagents (3)

  • audit-and-third-party-risk-lead

    Own audit readiness and vendor/third-party risk: NOT for picking/scoping the framework (grc-architect), implementing/testing a control or building evidence (control-and-evidence-engineer).

  • control-and-evidence-engineer

    Use to make controls real and prove they operate: implement controls, assess operating effectiveness, author policies, build continuous control monitoring, and decide Type I vs Type II readiness. NOT for framework scoping (grc-architect), audit/vendor risk, or secure code (security-engineering).

  • grc-architect

    Use to shape a security-compliance program: pick the framework (SOC 2, ISO 27001, NIST CSF/800-53), scope the audit boundary, stand up the ISMS, crosswalk controls so one attests many, and author the Statement of Applicability. NOT for implementing a control (control-and-evidence-engineer).

Hooks (1)

  • PreToolUse

    /usr/bin/env -u BASH_ENV -u ENV -u SHELLOPTS -u BASHOPTS -u LD_PRELOAD -u LD_LIBRARY_PATH -u LD_AUDIT -u DYLD_INSERT_LIBRARIES -u DYLD_LIBRARY_PATH -u PYTHONPATH -u PYTHONSTARTUP PATH=/usr/local/bin:/

View source on GitHub mcorbett51090.github.io

More from mcorbett51090/RavenClaude

All 184 plugins →

Domain-neutral Claude Code foundation: specialist agents, skills, gates, hooks, rules, templates. Capability Grounding Protocol, Structured Output Protocol, Researcher meta-skill, comfort-posture dashboard, opt-in command-review tribunal (the Thing), WebFetch sanitizer, branch-archive escape hatch, brand-extraction (homepage → brand kit), /wireframe (describe anything → validated model + high-fi Artifact + Mermaid), Problems & Resolutions view, declarative-visualization (Vega-Lite/Deneb/SVG, Gate 101 + Gate 103 svg-report-lint, viz-spec-reviewer), and Claude orchestrator escape hatch (/claude-orchestrate). Slash commands: /init-agent-ready, /wrap, /set-posture, /dashboard, /forge, /wireframe, /reset-plugin-cache, /handoff.

70 skills · 14 commands · 18 agents · hooks

9

Power Platform specialist team — agents (incl. power-platform-tester, power-bi-engineer) and skills, with strong ALM/git coverage for solutions, flows, and PBIP. A house-opinions hook flags 8 §3/§4 violations; the knowledge bank carries production decision trees (PA-flow recovery, Dataverse token-acquisition, PCF React surface, PBI deploy/refresh, custom-connector build-path, PBIR Enhanced infinite-spinner debug + full build reference, DAX silent-zero scoring via the `Domain` pattern, sempy.fabric notebook reference, Power BI Copilot report-readiness, Code Apps connector gotchas, PBIP deployment variables + #839, PBIR reference enrichment, PBIP report fast-solve triage router [MCP-optional], main-forms-are-Web-API-authorable grounding) plus a real-engagement scenarios bank. Bundles the community pbix-mcp server (d0nk3yhm/pbix-mcp, MIT) for .pbix/.pbit read/write/DAX-eval (`pip install pbix-mcp`); documents (not bundles) the official Microsoft Dataverse MCP (CLAUDE.md §9a). Extends ravenclaude-core.

24 skills · 8 commands · 11 agents · 1 MCP server · hooks

9

finance

claude

Corporate finance & FP&A specialist team — FP&A analyst (budgets, forecasts, variance commentary), financial modeler (3-statement, DCF, scenarios), controller (close, JEs, reconciliations), treasury analyst (cash, covenants, FX), valuation analyst (DCF + comps + precedent), audit-prep specialist (PBC, walkthroughs, SOC1/2 narratives), and board-pack composer. skills incl. a gold-standard NetSuite close (OAuth2 M2M + SuiteQL BS/IS trial balance, layperson runbook), templates, a knowledge bank (ASC 805 / 718 / 740, accrual-cutoff, WACC, cost accounting, FP&A operating model + decision support, NetSuite integration landscape), advisory hooks (hardcoded rates / plaintext PII / missing Sources / Assumptions; secrets-PII scan). Inherits ravenclaude-core protocols.

23 skills · 7 commands · 7 agents · hooks

9

Web design & build specialist team — web architect (IA, stack, hosting), UX designer (wireframes, flows, conversion), visual designer (brand, typography, tokens), frontend implementer (HTML/CSS/JS, React, Astro, Next), content strategist (copy, microcopy, SEO content), accessibility auditor (WCAG 2.2 AA/AAA), and performance engineer (Core Web Vitals, image/font optimization). skills (the gold-standard-website-pipeline gated build pipeline, static-site build, design-system audit, card/tile UI, accessibility review, Core Web Vitals tuning, technical SEO audit, information architecture, conversion design, content audit, design-tokens scaffolding, third-party hygiene, Fluent UI v9 + React implementation), templates, an advisory hook, and a knowledge bank seeded with a curated 2026 reference set of "cutting edge yet simple" marketing-site donors — the design agents carry compact inline priors plus a pointer to the full brief. Inherits ravenclaude-core protocols.

19 skills · 7 commands · 7 agents · hooks · LSP

9

EdTech-flavored Partner Success Manager team — specialist agents anchored on the PSM lane, with skills, templates, an advisory hook, a knowledge bank with Mermaid decision trees, a engagement bank, and a stdlib psm_calc.py calculator (seat-utilization / renewal-NRR-forecast / time-to-value). Covers QBRs, success plans, health scores, a self-contained Power-BI-style partner-health report, onboarding, touchpoint logs, adoption sequencing, 90-day implementation arcs, train-the-trainer curricula, advocacy/reference pipelines, renewal decision memos, and the integration contract for a centralized CS dashboard (Planhat + Salesforce + Snowflake + Zapier + Granola). Team growth ships as skills + knowledge + templates, not parallel agents. Primary-source citations with retrieval dates. Vertical-explicit but segment-agnostic — fits K-12, higher-ed, corporate L&D, or mixed EdTech books. Inherits ravenclaude-core protocols including the alternate-methods Capability Grounding Protocol.

17 skills · 5 commands · 6 agents · hooks

9

Financial-regulatory & compliance specialist team — function agents (AML/KYC, regulatory-reporting, risk-and-controls, policy & procedure, examination-prep, Bermuda-insurance) PLUS jurisdiction/regulator specialists: BMA financial-institutions (banking, trust, corporate-services, fund-admin, investment-business, money-service, digital-assets — the primary build-out, with deep AML/ATF + supervision/fees + licensing-classification trees), CIMA (Cayman), Bahamas, Channel Islands (Jersey JFSC + Guernsey GFSC), UK PRA, and US federal+state. primary-source-cited regulator knowledge files, best-practice rules, skills, templates, a defensive PreToolUse hook (PII scrub — SSN/IBAN/credit-card/Bermuda TIN/wire instructions). Positioning reflects field experience inside a Tier-1 financial regulator (BMA). Inherits ravenclaude-core protocols.

11 skills · 5 commands · 12 agents · hooks

9

Similar plugins

SOC2, HIPAA, and GDPR compliance validation, secrets scanning, compliance checklists, and regulatory documentation

1 command · 1 agent

wshobson/agents 42,461

Vanta

claude

The Vanta plugin connects Claude to Vanta's security and compliance platform through the Vanta MCP server. List failing compliance tests, get test-specific remediation context, and fix failing tests with code changes — directly from your Claude session.

3 skills · 3 MCP servers

anthropics/knowledge-work-plugins 35,601

Compliance OS — meta-orchestrator for multi-framework compliance programs spanning 9 frameworks (ISO 27001, ISO 13485, ISO 42001, ISO 14971, EU AI Act, MDR 745, GDPR, SOC 2, FDA QSR). Framework selector, cross-framework control mapper, audit simulator, and consolidated evidence-pool generator (stdlib Python), plus 3 cs-* compliance agents and 3 /cs-* readiness commands.

9 skills · 8 agents

alirezarezvani/claude-skills 29,725

Check infrastructure compliance (SOC2, HIPAA, PCI-DSS)

1 skill · 1 command

jeremylongshore/tons-of-skills-marketplace 2,917

Regulatory compliance verification for GDPR, SOC2, and HIPAA

2 commands

rohitg00/awesome-claude-code-toolkit 2,836

Compliance & trust skills for regulated and enterprise teams: SOC 2 Readiness, GDPR Compliance, HIPAA Safeguards, ISO 27001 ISMS, Vendor Security Review, and Data Retention Policy. Each ships a stdlib scoring/validation script.

7 skills

mohitagw15856/pm-claude-skills 1,544

Maintain cybersecurity-grc?

This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.

claude & codex plugins184 plugins