From nickcrew-claude-ctx-plugin
Conducts regulatory compliance audits across GDPR, HIPAA, PCI DSS, SOC 2, and ISO frameworks with automated evidence collection, gap analysis, and remediation planning. Use for assessments, certifications, or control implementation.
npx claudepluginhub nickcrew/claude-cortexThis skill uses the workspace's default tool permissions.
Systematic regulatory compliance auditing with automated evidence collection, control mapping,
Performs compliance audits for GDPR, HIPAA, SOC2, PCI-DSS in software systems; provides gap analysis, implementation plans, technical controls, policy templates, and monitoring scripts.
Audits software for GDPR, HIPAA, SOC2, PCI-DSS compliance, performs gap analysis, and delivers implementation plans with technical controls and monitoring scripts.
Tracks compliance for SOC 2, ISO 27001, GDPR, HIPAA, PCI DSS. Manages controls, audit calendars, evidence, gap analyses, checklists.
Share bugs, ideas, or general feedback.
Systematic regulatory compliance auditing with automated evidence collection, control mapping, gap analysis, and remediation planning across major compliance frameworks.
| Resource | Purpose | Load when |
|---|---|---|
references/frameworks.md | Key requirements, control mappings, and certification paths for GDPR, HIPAA, PCI DSS, SOC 2, ISO 27001 | Scoping which regulations apply |
references/evidence-collection.md | Automated evidence gathering, artifact organization, retention policies, audit trail patterns | Setting up or running evidence collection |
references/gap-analysis.md | Control mapping methodology, gap identification, risk scoring, remediation planning | Analyzing compliance gaps |
Phase 1: Scope → Identify applicable regulations, data types, and geographical scope
Phase 2: Assess → Map controls, review policies, analyze data flows, test implementations
Phase 3: Evidence → Collect and organize audit artifacts automatically
Phase 4: Gap Analyze → Identify control gaps, score risks, prioritize findings
Phase 5: Remediate → Create remediation plans, assign owners, set timelines
Phase 6: Report → Generate audit-ready documentation and compliance dashboards
Phase 7: Monitor → Establish continuous compliance monitoring and drift detection
Determine the regulatory landscape before testing anything.
Key questions:
Applicability matrix:
| Framework | Applies when |
|---|---|
| GDPR | Processing personal data of EU residents |
| HIPAA | Handling protected health information (PHI) |
| PCI DSS | Storing, processing, or transmitting cardholder data |
| SOC 2 | Providing services where trust principles matter |
| ISO 27001 | Organization wants certified ISMS |
| CCPA/CPRA | Collecting California consumer personal information |
| NIST CSF | Federal systems or voluntary cybersecurity framework adoption |
Map existing controls against the applicable framework requirements:
Load references/evidence-collection.md for detailed patterns.
Automation priorities:
Artifact organization:
evidence/
{framework}/
{control-id}/
artifact-{date}.{ext}
metadata.yaml # source, collection method, timestamp
Load references/gap-analysis.md for the full methodology.
For each framework requirement:
For each identified gap:
| Field | Content |
|---|---|
| Gap ID | Unique identifier |
| Framework Requirement | Specific clause or control |
| Current State | What exists today |
| Target State | What compliance requires |
| Remediation Action | Specific steps to close the gap |
| Owner | Responsible person/team |
| Priority | P0-P4 based on risk score |
| Timeline | Target completion date |
| Dependencies | Other gaps or actions this depends on |
Generate audit-ready documentation:
Establish ongoing compliance posture management: