Compliance

Report control and configuration drift since the last known-good baseline for a client or the whole portfolio

Build a source-cited compliance evidence package for a client against a named framework

Draft evidence-backed answers to the standard cyber-insurance questionnaire for a client

Use this agent when an MSP needs to know what has changed in a client's compliance posture since the last known-good baseline, prioritized by how much each change actually matters. Trigger for: control drift, configuration drift report, standards drift, has anything changed, drift detection, what changed, unauthorized change report, security drift review. Examples: "Has anything drifted for Acme Corp since our last check?", "Run a control drift report across the portfolio this week", "Did anything change on Meridian Health's tenant that we should know about?"

Use this agent when an MSP needs to gather and assemble compliance evidence for a client against a named framework or control set, producing a source-cited package an auditor or client can review. Trigger for: compliance evidence, gather evidence for audit, build evidence package, SOC2 evidence, HIPAA evidence, CIS evidence, audit prep, evidence for auditor, control evidence package. Examples: "Build a SOC 2 evidence package for Meridian Health", "Gather HIPAA evidence for Riverside Medical before Friday's audit", "Put together CIS control evidence across the whole portfolio"

Use this agent when a client needs its cyber-insurance renewal or new-business questionnaire drafted using live tool evidence rather than best-guess answers. Trigger for: insurance questionnaire, fill out cyber insurance form, answer security questionnaire, cyber insurance renewal, underwriter questions, insurance application security section. Examples: "Fill out the cyber insurance questionnaire for Acme Corp's renewal", "We need to answer the underwriter's security questions for Riverside Medical", "Draft the security section of Meridian Health's insurance application"

Use this skill when a compliance control (CIS, SOC 2, HIPAA, or a cyber-insurance questionnaire line item) needs to be traced to concrete, retrievable evidence from connected MSP tooling rather than answered from memory or assumption. Covers how to resolve a control statement to specific gateway tool calls across CIPP (M365/Entra), Liongard (infrastructure inspections), and IT Glue/Hudu (documentation), and the critical distinction between evidence that proves a control is actually met versus evidence that only proves the control is written down as policy.

Use this skill when drafting answers to a cyber-insurance renewal or new-business questionnaire for an MSP client. Covers the standard recurring question set (MFA everywhere, EDR deployed, backups tested, incident response plan documented, employee security training) and how to answer each type by pulling live evidence from connected tools rather than guessing, plus how to flag questions that cannot be answered with current tool coverage instead of submitting an unverified answer.

Use this skill when a client's live configuration needs to be compared against a previously established baseline or standard to detect drift. Covers CIPP standards checks and Best Practice Analyser results, Liongard change detection and inspection timelines, what qualifies as drift versus normal operational change, how to distinguish intentional/authorized change from unauthorized or risky drift, and how to prioritize which drift findings matter most when several surface at once.