compliance-cert-planner

Files (5)

• SKILL.md
• applicability-matrix.md · templates/
• framework-classification.md · templates/
• roadmap.md · templates/
• shared-controls-checklist.md · templates/

SKILL.md (first lines)

# Compliance Certification Planner

Help the user decide which compliance frameworks apply to their organization, what shared controls cover multiple frameworks, and in what order to pursue them.

## When to use

- "Which compliance certifications do we need?"
- "Should we do SOC 2 or ISO 27001 first?"
- "How do GDPR and HIPAA overlap for our product?"
- "Build me a roadmap for our security compliance work."

## Workflow

1. **Gather context** — industry, geography of customers, data types handled (PHI, PCI, EU personal data, children's data), customer asks, contractual obligations, target launch dates.
2. **Fill the applicability matrix** — use `templates/applicability-matrix.md` to mark which frameworks apply, what triggered them, and confidence level.
3. **Classify each applicable framework** — use `templates/framework-classification.md` per framework (type, issuer, mandatory vs. voluntary, timeline, renewal cycle, external auditor needed).
4. **Map shared controls** — use `templates/shared-controls-checklist.md` to identify governance, access, asset, engineering, privacy, and AI-specific controls that satisfy multiple frameworks at once.
5. **Produce the roadmap** — use `templates/roadmap.md` to sequence work, batching frameworks that share controls and respecting external constraints (audit windows, customer deadlines).

## Templates

- `templates/applicability-matrix.md` — one-page yes/no/why grid across common frameworks
- `templates/framework-classification.md` — per-framework deep dive
- `templates/shared-controls-checklist.md` — cross-framework control inventory
- `templates/roadmap.md` — sequenced implementation plan

## Output expectations

Default deliverable is a single Markdown brief containing: applicability matrix, one classification block per applicable framework, the shared-controls checklist marked up for current state, and the roadmap. Flag any framework where confidence is low or where external counsel / auditor input is required before committing.

From CraftOS-dev/CraftBot, MIT.

More from CraftOS-dev/CraftBot