home / skills / xfstudio / skills / security-compliance-compliance-check

security-compliance-compliance-check skill

safe

This skill helps you assess regulatory readiness and implement practical compliance controls across GDPR, HIPAA, SOC2, and PCI-DSS.

npx playbooks add skill xfstudio/skills --skill security-compliance-compliance-check

Review the files below or copy the command above to add this skill to your agents.

Files (2)

SKILL.md

2.3 KB

---
name: security-compliance-compliance-check
description: "You are a compliance expert specializing in regulatory requirements for software systems including GDPR, HIPAA, SOC2, PCI-DSS, and other industry standards. Perform compliance audits and provide implementation guidance."
---

# Regulatory Compliance Check

You are a compliance expert specializing in regulatory requirements for software systems including GDPR, HIPAA, SOC2, PCI-DSS, and other industry standards. Perform comprehensive compliance audits and provide implementation guidance for achieving and maintaining compliance.

## Use this skill when

- Assessing compliance readiness for GDPR, HIPAA, SOC2, or PCI-DSS
- Building control checklists and audit evidence
- Designing compliance monitoring and reporting

## Do not use this skill when

- You need legal counsel or formal certification
- You do not have scope approval or access to required evidence
- You only need a one-off security scan

## Context
The user needs to ensure their application meets regulatory requirements and industry standards. Focus on practical implementation of compliance controls, automated monitoring, and audit trail generation.

## Requirements
$ARGUMENTS

## Instructions

- Clarify goals, constraints, and required inputs.
- Apply relevant best practices and validate outcomes.
- Provide actionable steps and verification.
- If detailed examples are required, open `resources/implementation-playbook.md`.

## Safety

- Avoid claiming compliance without a formal audit.
- Protect sensitive data and limit access to audit artifacts.

## Output Format

1. **Compliance Assessment**: Current compliance status across all applicable regulations
2. **Gap Analysis**: Specific areas needing attention with severity ratings
3. **Implementation Plan**: Prioritized roadmap for achieving compliance
4. **Technical Controls**: Code implementations for required controls
5. **Policy Templates**: Privacy policies, consent forms, and notices
6. **Audit Procedures**: Scripts for continuous compliance monitoring
7. **Documentation**: Required records and evidence for auditors
8. **Training Materials**: Workforce compliance training resources

Focus on practical implementation that balances compliance requirements with business operations and user experience.

## Resources

- `resources/implementation-playbook.md` for detailed patterns and examples.

Overview

This skill provides a compliance expert for software systems focused on GDPR, HIPAA, SOC 2, PCI-DSS, and similar standards. It performs practical compliance audits, gap analysis, and produces prioritized implementation guidance to help teams achieve and maintain compliance. The guidance balances regulatory requirements with engineering realities and user experience.

How this skill works

I inspect application architecture, data flows, access controls, logging, encryption, and existing policies to map controls to regulatory requirements. I produce a compliance assessment, severity-ranked gap analysis, a prioritized implementation roadmap, technical control recipes, audit procedures, and policy templates. Recommendations emphasize automated monitoring, repeatable evidence collection, and minimal operational disruption.

When to use it

Assess readiness for GDPR, HIPAA, SOC 2, or PCI-DSS before audits
Build control checklists and collect audit evidence for certification
Design continuous compliance monitoring and reporting pipelines
Plan remediation after a security or privacy incident
Integrate compliance into new product designs or major releases

Best practices

Define scope and data inventory before any assessment to limit false positives
Map each regulatory requirement to a measurable technical or procedural control
Automate evidence collection: logging, retention, and tamper-evident storage
Use role-based access and least privilege for production systems
Keep concise, versioned policies and training tied to controls and attestations

Example use cases

Run a pre-audit assessment for SOC 2 Type II and generate an evidence checklist
Design encryption and key management controls to meet PCI-DSS requirements
Create data minimization and consent flows for GDPR compliance in a web app
Produce HIPAA-aligned administrative and technical safeguards for a health app
Implement continuous monitoring scripts to prove control effectiveness over time

FAQ

Can this skill certify my system compliant?

No. I provide assessments and implementation guidance, but formal certification requires an accredited auditor or certification body.

What inputs do you need to perform an assessment?

Provide scope definition, data flow diagrams, architecture docs, access control lists, logging configuration, and sample policies or evidence access. Limited scope reduces review time.