Enterprise-grade compliance architecture for SOC 2, HIPAA, GDPR, PCI-DSS. Provides compliance checklists, security controls, audit guidance, and regulatory requirements for serverless and cloud architectures. Activates for compliance, HIPAA, SOC2, SOC 2, GDPR, PCI-DSS, PCI DSS, regulatory, healthcare data, payment card, data protection, audit, security standards, regulated industry, BAA, business associate agreement, DPIA, data protection impact assessment.
Provides enterprise compliance architecture guidance for SOC 2, HIPAA, GDPR, and PCI-DSS. Activates when users mention compliance requirements, regulated industries, security standards, or data protection needs for cloud/serverless systems.
/plugin marketplace add anton-abyzov/specweave/plugin install sw@specweaveThis skill inherits all available tools. When active, it can use any tool Claude has access to.
MEMORY.mdI'm a specialist in enterprise compliance architecture across regulated industries. I help you design systems that meet regulatory requirements while maintaining operational efficiency.
Ask me when you need help with:
Core Requirements for Serverless:
Encryption Standards
Access Logging and Retention
Access Controls
Change Management
Healthcare Data Protection Requirements:
Business Associate Agreement (BAA)
Encryption Requirements
Audit Logging
Network Isolation
No Public Endpoints
European Data Protection Regulations:
Data Residency Controls
Right to Erasure (Data Deletion)
Consent Management
Data Portability
Privacy by Design
Payment Card Data Protection (v3.2.1 or later):
Tokenization Requirements
Encryption Requirements
Network Segmentation
Regular Security Audits
Secure Card Data Handling
Common Serverless Security Issues:
WRONG:
- S3 bucket with public read access
- "Block public access" disabled
- Bucket policy allows s3:GetObject to "*"
CORRECT:
- Block public access: enabled
- Bucket policy: Only CloudFront, VPC endpoints, specific IAM roles
- Encryption: enabled with customer-managed keys
WRONG:
{
"Effect": "Allow",
"Action": "s3:*", # WILDCARD ACTION
"Resource": "*" # WILDCARD RESOURCE
}
CORRECT:
{
"Effect": "Allow",
"Action": ["s3:GetObject", "s3:PutObject"],
"Resource": "arn:aws:s3:::specific-bucket/specific-prefix/*",
"Condition": {
"IpAddress": {"aws:SourceIp": "10.0.0.0/8"}
}
}
WRONG:
const apiKey = "sk_test_123456789abcdef"; // In code or env vars
CORRECT:
// AWS
const secret = await secretsManager.getSecretValue('api-key');
// Azure
const credential = new DefaultAzureCredential();
const client = new SecretClient(vaultUrl, credential);
// GCP
const [version] = await client.accessSecretVersion({name: secretName});
WRONG:
- RDS without encryption
- DynamoDB without encryption
- DocumentDB without encryption
CORRECT:
- All databases encrypted at rest
- Customer-managed keys in KMS
- Encryption enabled during creation
- Cannot be disabled after creation
WRONG:
- API Gateway accepting HTTP traffic
- No redirect from HTTP to HTTPS
- Clients can connect via unencrypted channel
CORRECT:
- API Gateway: minimum TLS 1.2
- Redirect HTTP → HTTPS (301)
- Client certificates for additional security
- HSTS header: Strict-Transport-Security
WRONG:
export DATABASE_PASSWORD="MyPassword123"
console.log(process.env.DATABASE_PASSWORD) # In logs
CORRECT:
- Use AWS Secrets Manager, Azure Key Vault, GCP Secret Manager
- Inject as secret environment variables (redacted in logs)
- Never log secrets or sensitive configuration
- Rotate secrets annually
WRONG:
- Lambda in public subnet with NAT
- Database accessible from internet
- No security groups restricting access
CORRECT:
- Lambda in private subnet
- Database in private subnet
- Security groups: Lambda → Database only
- No route to Internet Gateway from database subnet
Before deploying to production, verify all items:
Request my help when:
Coordinate with Security Agent for:
Remember: Compliance is not a checkbox exercise - it's about building secure, trustworthy systems that protect user data and meet legal obligations.
Creating algorithmic art using p5.js with seeded randomness and interactive parameter exploration. Use this when users request creating art using code, generative art, algorithmic art, flow fields, or particle systems. Create original algorithmic art rather than copying existing artists' work to avoid copyright violations.
Applies Anthropic's official brand colors and typography to any sort of artifact that may benefit from having Anthropic's look-and-feel. Use it when brand colors or style guidelines, visual formatting, or company design standards apply.
Create beautiful visual art in .png and .pdf documents using design philosophy. You should use this skill when the user asks to create a poster, piece of art, design, or other static piece. Create original visual designs, never copying existing artists' work to avoid copyright violations.