What Are Claude Skills?
Claude Skills are installable knowledge packages that extend Claude's capabilities for specific domains. A skill is a .skill file — a bundled archive containing a SKILL.md instruction file and optional reference materials — that you upload to Claude once and use across all your conversations.
Once installed, a skill activates automatically when your conversation touches its topic area. You don't need to invoke it by name or use special commands. Claude simply becomes a deeper expert in that domain for the duration of your session.
Skills are ideal when you need:
- Consistent, expert-level responses on a specialized topic
- Outputs formatted to professional or regulatory standards (e.g., audit-ready control narratives, policy templates with the right clauses)
- Domain knowledge that goes beyond general LLM training — such as knowing which specific NIST 800-53 controls apply to a given scenario, or which GDPR articles govern international data transfers
How skills work under the hood: Each .skill file contains a primary SKILL.md that is loaded into Claude's context when the skill triggers, plus reference files that are loaded on demand for deeper sub-topics. This "progressive disclosure" pattern keeps context usage efficient while making comprehensive knowledge available when needed.
Who Is This For?
Designed for professionals who work on information security, privacy, and regulatory compliance — whether at organizations seeking certification, development teams building compliant systems, or advisors supporting clients.
Accelerate gap assessments, generate first-draft policies, map controls, and prepare evidence packages in minutes.
Understand what controls your systems must implement and audit code or architecture for compliance issues.
Draft DPAs, BAAs, and privacy notices; answer client questions with precise article-level regulatory citations.
Assess systems, generate NPPs and BAAs, and get HIPAA guidance without a compliance consultant for every question.
Navigate FedRAMP ATO, write SSP narratives, manage POA&Ms, and prepare for 3PAO assessments.
Scope compliance programs, understand framework requirements, and get expert-quality output without a large in-house team.
The Skills
1. 
ISO 27001
ISO 27001 - Claude Skill/iso27001.skill
Turns Claude into an expert ISO 27001 Lead Auditor and ISMS implementation consultant. Covers both ISO 27001:2013 (114 controls, 14 domains) and ISO 27001:2022 (93 controls, 4 themes), defaulting to 2022.
- Runs structured gap analyses against mandatory clauses (4–10) and all Annex A controls
- Generates complete, audit-ready policy documents with document control blocks, scope statements, and clause-to-control mappings
- Builds risk registers and risk treatment plans using the likelihood × impact methodology
- Creates Statement of Applicability (SoA) templates covering all 93 controls
- Guides 2013 → 2022 transition, explaining the 11 new controls and mapping changes
- Preparing for an ISO 27001:2022 Stage 2 certification audit with gap analysis across all Annex A controls
- Writing an Information Security Policy and Statement of Applicability (SoA) mapped to all 93 controls
- Building a risk register and risk treatment plan using the likelihood × impact scoring method
- Guiding a 2013 → 2022 transition, including the 11 new controls and mapping changes
2. 
SOC 2
SOC 2 - Claude Skill/soc2.skill
Turns Claude into an expert SOC 2 compliance advisor grounded in the AICPA 2017 Trust Services Criteria (TSC) with 2022 Revised Points of Focus. Covers all five TSC: Security (CC1–CC9), Availability (A1), Confidentiality (C1), Processing Integrity (PI1), and Privacy (P1–P8).
- Conducts gap analyses across in-scope TSC criteria with 🔴/🟡/🟢 status ratings and remediation roadmaps
- Drafts all 12 core SOC 2 policies — Information Security, Access Control, Incident Response, Change Management, and more
- Documents controls in auditor-ready format: Control ID, TSC criterion, type, owner, frequency, evidence, and test procedure
- Handles vendor risk: tiering, 32-question security questionnaires, SOC 2 report review, CUEC tracking
- Running a SOC 2 readiness assessment before engaging an external auditor
- Documenting controls for a SOC 2 Type 2 report with auditor-ready evidence tables
- Reviewing a vendor’s SOC 2 report and tracking Customer User Entity Controls (CUECs)
- Responding to a customer security questionnaire spanning multiple frameworks
3. 
FedRAMP [US]
FedRamp - Claude Skill/fedramp.skill
Turns Claude into a knowledgeable FedRAMP advisor covering the full authorization lifecycle for Cloud Service Providers under NIST SP 800-53 Rev 5. Current as of 2025–2026, incorporating the Rev 5 transition, September 2026 OSCAL mandate, and December 2024 template updates.
- Conducts readiness and gap assessments using a 75+ item checklist across 14 security domains
- Guides authoring of ATO documentation: SSP, POA&Ms, SAPs, SARs, and all required appendices (A–Q)
- Maps NIST 800-53 Rev 5 controls across all 20 control families
- Provides cloud architecture guidance for AWS GovCloud, Azure Government, and Google Cloud Government
- Supports Continuous Monitoring (ConMon) obligations and guides the Rev 4 → Rev 5 transition
- Scoping a FedRAMP Moderate authorisation on AWS GovCloud or Azure Government
- Writing SSP control narratives for all 20 NIST SP 800-53 control families
- Preparing a POA&M with FedRAMP-compliant remediation timelines
- Navigating the FedRAMP 20x pathway and the September 2026 OSCAL mandate
4. 🇪🇺 GDPR [EU]
GDPR - Claude Skill/gdpr-compliance.skillTurns Claude into an expert GDPR compliance assistant bridging technical and legal perspectives. Covers full EU GDPR with notes on UK GDPR (DPA 2018) where rules differ.
- Audits code, APIs, database schemas, and architectures for GDPR violations with severity-graded findings (🔴/🟡/🟢) mapped to specific GDPR articles
- Drafts compliance documents: Privacy Notices (Art. 13/14), Data Processing Agreements (Art. 28), Cookie/Consent Banners, DPIAs (Art. 35), Data Retention Policies
- Answers compliance questions with authoritative article citations — every response leads with the governing article
- Covers lawful basis, consent, data subject rights (Arts. 15–22), international transfers (Arts. 44–49), breach response (Arts. 32–34)
- Auditing an API or database schema for GDPR compliance before product launch
- Drafting a DPIA for a new AI feature that processes personal data
- Preparing an Article 28 Data Processing Agreement for a third-party vendor relationship
- Managing a 72-hour breach notification to a national supervisory authority
5. 
HIPAA [US]
HIPAA - Claude Skill/hipaa-compliance.skill
Turns Claude into a knowledgeable HIPAA compliance advisor covering the Privacy Rule, Security Rule, and Breach Notification Rule (45 CFR Parts 160 and 164, as amended by HITECH).
- Reviews documents, systems, and architectures for HIPAA compliance with structured findings: CFR citations, risk levels (High / Medium / Low), and remediation steps
- Generates HIPAA-compliant documents from nine ready-to-use templates: NPP, BAA, Authorization Forms, Workforce Training Acknowledgments, Security Incident Reports, Risk Analysis Templates
- Advises on technical safeguards for AWS, Azure, GCP, FHIR APIs, mobile/BYOD, and DevOps — all 54 Security Rule implementation specifications
- Guides breach response using the 4-factor risk assessment, notification timelines, and HHS reporting obligations
- Generating a Business Associate Agreement (BAA) for a healthcare SaaS vendor relationship
- Assessing whether a data incident constitutes a reportable HIPAA breach using the 4-factor risk assessment
- Advising on technical safeguards for AWS, Azure, or GCP healthcare cloud deployments
- Completing an HIPAA Security Rule risk analysis for a new healthcare application
6. 
NIST CSF
NIST Cybersecurity framework - Claude Skill/NIST Cybersecurity.skill
Turns Claude into an expert NIST Cybersecurity Framework advisor covering both CSF 2.0 (February 2024) and CSF 1.1 (April 2018), defaulting to CSF 2.0. Covers all six functions — Govern, Identify, Protect, Detect, Respond, Recover — including the new Govern function in CSF 2.0.
- Conducts structured gap assessments across all six CSF 2.0 functions, categories, and subcategories
- Builds Organisational Profiles — Current and Target — aligned to business context and risk tolerance
- Assesses Implementation Tiers (1–4) and provides targeted advancement guidance
- Maps CSF subcategories to NIST SP 800-53, ISO 27001:2022, and CIS Controls v8
- Guides CSF 1.1 → CSF 2.0 migration with a detailed subcategory mapping and migration checklist
- Assessing current cybersecurity posture using NIST CSF 2.0 across all six functions
- Building an Organisational Profile with Current and Target states for board reporting
- Guiding a CSF 1.1 → CSF 2.0 migration with subcategory mapping and a migration checklist
- Mapping CSF 2.0 subcategories to ISO 27001:2022, NIST SP 800-53, and CIS Controls v8
7. 
PCI DSS
PCI Compliance - Claude Skill/PCI-Compliance.skill
Turns Claude into an expert PCI DSS compliance advisor covering PCI DSS v4.0.1 (June 2024 — current), including all requirements that became mandatory on March 31, 2025. Covers all 12 requirements, all 8 SAQ types, merchant and service provider levels, and v4.0 changes from v3.2.1.
- Scopes the Cardholder Data Environment (CDE) — identifies what's in scope, assesses network segmentation, recommends scope reduction via tokenisation or P2PE
- Selects the correct SAQ type — decision tree for SAQ A, A-EP, B, B-IP, C, C-VT, P2PE, and D
- Conducts structured gap assessments across all 12 requirements with QSA evidence requirements
- Guides v3.2.1 → v4.0.1 migration including MFA expansion, payment page script integrity (Req 6.4.3), phishing protection (Req 5.4.1)
- Scoping a PCI DSS Cardholder Data Environment for a cloud-hosted e-commerce platform
- Selecting the right SAQ type for a merchant using a hosted or redirect payment page
- Guiding a v3.2.1 → v4.0.1 migration including all requirements that became mandatory March 2025
- Assessing scope-reduction options via tokenisation or P2PE to shrink the CDE
8. 🚨 TSA Cybersecurity [US]
TSA Compliance - Claude Skill/TSA-Compliance.skillTurns Claude into an expert TSA cybersecurity directive advisor for critical transportation infrastructure. Covers all current TSA Security Directive series — SD Pipeline-2021-01G, SD Pipeline-2021-02F, SD 1580-21-01E (freight rail), and SD 1582-21-01E (transit/passenger rail) — plus the November 2024 NPRM.
- Determines applicability — which directive series applies to your organisation and what it means for compliance
- Runs structured gap assessments across four technical domains: IT/OT network segmentation, access controls (MFA), continuous monitoring, and patch management
- Drafts CRMP documents: Cybersecurity Implementation Plan (CIP/COIP), IRP, Architecture Design Review (ADR), and Cybersecurity Assessment Plan (CAP)
- Guides OT/ICS-specific implementation — data diodes, jump servers for legacy HMIs, passive monitoring tools (Claroty, Dragos, Nozomi)
- Determining whether a pipeline or rail operation is a TSA covered entity and which directive applies
- Drafting a Cybersecurity Implementation Plan (CIP) for pipeline OT/SCADA environments
- Aligning a TSA Cyber Risk Management Plan (CRMP) to NIST CSF 2.0 and CISA Cross-Sector CPGs
- Guiding OT/ICS segmentation using data diodes, jump servers, and passive monitoring tools
9. 
ISO 42001 AI Management System
ISO 42001 - Claude Skill/ISO-42001.skill
Turns Claude into an expert ISO/IEC 42001:2023 AI Management System (AIMS) advisor — the world's first international standard for AI governance. Serves both AI providers (organisations developing or deploying AI) and AI users (organisations integrating third-party AI).
- Conducts structured gap assessments across all mandatory clauses (4–10) and all 38 Annex A controls (domains A.2–A.10) with 🔴/🟡/🟢 status and phased remediation roadmap
- Guides the mandatory AI System Impact Assessment (AISIA) — identifying affected populations, assessing impact dimensions, classifying impact level (Low/Medium/High)
- Performs AI risk assessment across model risks, data risks, operational risks, and supply chain risks
- Generates a complete Statement of Applicability (SoA) covering all 38 Annex A controls (A.2.2–A.10.4)
- Maps ISO 42001 to the EU AI Act — aligns AISIA to the Fundamental Rights Impact Assessment (FRIA) for high-risk AI systems
- Running an ISO 42001 gap assessment for an AI provider with multiple ML models in production
- Completing an AI System Impact Assessment (AISIA) for an automated hiring or credit-scoring tool
- Integrating an ISO 42001 AIMS with an existing ISO 27001:2022 ISMS to avoid duplicating controls
- Generating a Statement of Applicability (SoA) covering all 38 Annex A controls
10. 
ISO 27701 Privacy Information Management
ISO 27701 - Claude Skill/iso27701.skill
Turns Claude into an expert ISO/IEC 27701:2025 Privacy Information Management System (PIMS) advisor. Covers the full lifecycle from gap assessment through certification for both PII controllers and PII processors, and handles both the new standalone 2025 edition and the legacy 2019 extension edition.
- Conducts structured gap analyses across all mandatory HLS clauses (4–10) and all 78 Annex A controls — 31 for PII controllers (A.1), 18 for PII processors (A.2), 29 shared security controls (A.3)
- Generates complete PIMS policy documents — Privacy Policy, RoPA, Data Subject Rights Procedure, DPAs, Privacy by Design Procedure, and more
- Builds privacy risk registers, triggers DPIAs for high-risk processing, and produces risk treatment plans
- Creates Statements of Applicability (SoA) scoped to the organization's role (controller, processor, or both)
- Guides 2019 → 2025 transitions with full control mapping table and timeline to the October 2028 deadline
- Maps ISO 27701 to GDPR article by article, plus CCPA/CPRA, LGPD, PIPEDA, and UK GDPR
- Running an ISO 27701:2025 gap assessment for a SaaS company acting as both PII controller and processor
- Drafting a GDPR-aligned Data Processing Agreement with all Article 28 mandatory clauses
- Completing a DPIA for a new AI feature that profiles users for targeted advertising
- Mapping ISO 27701:2025 controls to GDPR articles to use as certification evidence
11. 
DORA [EU] — Digital Operational Resilience
DORA - Claude Skill/dora.skill
Turns Claude into an expert advisor on Regulation (EU) 2022/2554 (DORA) — the anchoring ICT regulation for EU financial entities since 17 January 2025. Encodes all 64 DORA articles, all 12 adopted RTS/ITS, and provides precise article-level guidance. Explicitly separates DORA from NIS2, legacy EBA ICT guidelines, and ISO 27001.
- Conducts structured DORA gap analyses across ICT risk management (Chapter II, Art. 5–16), incident management (Chapter III, Art. 17–23), TLPT (Chapter IV, Art. 24–27), and third-party risk (Chapter V, Art. 28–44)
- Guides ICT incident classification against Art. 18 criteria and CDR (EU) 2024/1772 materiality thresholds, with a full decision tree for major vs. non-major
- Builds three-stage reporting procedures per Art. 19: initial (4h), intermediate (72h), final (1 month), including content requirements per CDR (EU) 2025/301
- Reviews contracts against Art. 30(2)(a)–(i) mandatory provisions and flags the audit-rights gap common with hyperscale cloud providers
- Builds and validates the Register of Information with all mandatory fields per CIR (EU) 2024/2956
- Scopes TLPT programmes per Art. 26 and CDR (EU) 2025/1190, covering threat intelligence, red team, mutual recognition, and tester qualifications
- Running a DORA gap analysis for an EU credit institution ahead of a supervisory review
- Building a three-stage ICT incident reporting procedure (4h / 72h / 1 month) per Art. 19
- Reviewing ICT third-party contracts against all Art. 30(2)(a)–(i) mandatory provisions
- Advising on the DORA vs. NIS2 lex specialis interaction and residual obligations for a European bank
12. 🇮🇳 DPDPA [India] — Digital Personal Data Protection Act
DPDPA - Claude Skill/dpdpa.skillTurns Claude into an expert advisor on India's Digital Personal Data Protection Act, 2023 and the finalized DPDP Rules, 2025 (notified 13 November 2025, effective 13 May 2027). Covers all 44 sections and 23 Rules with section-level citations, GDPR-alignment mapping, and guidance for both Indian companies and global organizations with Indian data subjects.
- Conducts structured DPDPA gap analyses covering notice/consent (Sections 5–6 + Rules 3–4), Data Fiduciary obligations (Section 8 + Rules 6–9), children's data (Section 9 + Rules 10–12), and SDF obligations (Section 10 + Rule 13)
- Distinguishes DPDPA from GDPR across 8 dimensions — digital-only scope, no legitimate interests basis, unconditional consent + no bundling, blacklist cross-border transfers, narrower erasure right, India-resident DPO for SDFs, 18-year children's threshold, single Board enforcement
- Guides breach notification per Section 8(6) and Rule 6 — 72-hour Board notification, all breaches notifiable (no risk threshold), Processor cascade obligations
- Designs children's data programmes — Rule 12 parental verification (DigiLocker, government tokens, virtual tokens) and absolute prohibitions on tracking, profiling, and targeted advertising for under-18s
- Advises Significant Data Fiduciaries on India-resident DPO, annual DPIA, annual independent audit, and data localisation readiness
- Guides Data Principal rights fulfilment — access (Section 11), correction/erasure (Section 12), grievance redressal (Section 13), and the unique right to nominate (Section 14)
- Running a DPDPA gap analysis for an Indian SaaS company ahead of the May 2027 deadline
- Designing a Rule 3-compliant privacy notice with multi-language and layered disclosure obligations
- Implementing a children’s data programme with Rule 12 parental verification (DigiLocker, virtual tokens)
- Advising on India cross-border transfer obligations — blacklist approach and contractual safeguards
13. 
CMMC 2.0 [US] — Cybersecurity Maturity Model Certification
CMMC - Claude Skill/cmmc.skill
Turns Claude into an expert CMMC compliance advisor for US defense contractors. Covers all three CMMC levels — Level 1 (17 FAR 52.204-21 practices), Level 2 (110 NIST SP 800-171 Rev 2 practices/C3PAO), and Level 3 (110+ NIST SP 800-172/DIBCAC) — under the final 32 CFR Part 170 rule effective December 16, 2024.
- Determines the correct CMMC level based on FCI vs. CUI handling, DFARS clauses (7012, 7019, 7020, 7021), and program criticality
- Conducts structured gap assessments across all 17 domains — AC, AT, AU, CM, IA, IR, MA, MP, PE, PS, RA, CA, SC, SI — against all 110 Level 2 practices
- Drafts System Security Plans (SSP) covering system boundary, CUI data flows, and implementation narratives for all 110 practices
- Calculates SPRS scores (starting at 110; deductions per unmet practice; range −203 to +110) and prioritises highest-impact gaps
- Determining your CMMC level based on DFARS clauses (7012, 7019, 7020, 7021) and CUI handling scope
- Running a CMMC Level 2 gap assessment across all 110 NIST SP 800-171 practices
- Calculating your SPRS score and prioritising the highest-impact gap remediations
- Preparing evidence packages and POA&M documentation for a C3PAO assessment
14. 
NIST AI Risk Management Framework
NIST AI RMF - Claude Skill/nist-ai-rmf.skill
Turns Claude into an expert advisor on the NIST AI Risk Management Framework (AI RMF 1.0), published January 2023 as NIST AI 100-1. Covers all four core functions — GOVERN, MAP, MEASURE, MANAGE — their 19 categories and subcategories, the AI RMF Playbook's suggested actions, and deep guidance on AI trustworthiness evaluation.
- Builds AI organizational profiles — Current Profile and Target Profile across all 19 categories with gap scoring and prioritised roadmap
- Conducts GOVERN gap assessments across all 6 categories (GV-1 to GV-6) — AI risk policies, accountability, roles, cross-functional teams, risk tolerance, regulatory alignment
- Guides MAP context-setting for any AI system — intended use, affected stakeholder mapping, risk/benefit analysis, likelihood/impact characterization
- Specifies MEASURE 2.x pre-deployment evaluation — bias/fairness (demographic parity, equalized odds), explainability (SHAP, LIME), adversarial robustness, privacy, human oversight
- Builds AI risk registers with AI RMF category citations (e.g., MAP 5.2, MEASURE 2.2, MANAGE 2.3), trustworthiness property at risk, and treatment options
- Maps AI RMF to ISO 42001, EU AI Act, and NIST CSF — showing which categories satisfy Art. 9, equivalent ISO 42001 clauses, and how AI RMF extends cybersecurity frameworks
- Building an AI organisational profile using Current and Target states across all 19 categories
- Running a GOVERN gap assessment for an organisation starting its AI risk programme
- Evaluating a credit scoring or hiring AI model against MEASURE 2.x trustworthiness criteria before deployment
- Mapping NIST AI RMF categories to EU AI Act Art. 9 and ISO 42001 requirements
15. 
SWIFT Customer Security Programme (CSP)
SWIFT CSP - Claude Skill/swift-csp.skill
Turns Claude into an expert advisor on the SWIFT Customer Security Controls Framework (CSCF) v2025 — the mandatory cybersecurity programme for all SWIFT network participants. Covers all 31 controls (23 mandatory + 8 advisory), all five architecture types (A1/A2/A3/A4/B), the KYC-SA annual attestation process, and cross-framework mapping to ISO 27001:2022, PCI DSS v4.0.1, and NIST CSF 2.0.
- Determines the correct SWIFT architecture type (A1/A2/A3/A4/B) and produces the full mandatory/advisory control applicability matrix for your deployment
- Conducts structured CSCF v2025 gap assessments with 🔴/🟡/🟢 status per control, evidence requirements, and prioritised remediation roadmaps
- Provides deep-dive implementation guidance for all 23 mandatory controls — purpose, requirements, implementation steps, and audit evidence artifacts
- Guides the complete KYC-SA attestation process — evidence prep, independent assessor qualification, portal submission, and post-submission counterparty visibility
- Advises on SWIFT-specific incident response — 24-hour initial notification to security@swift.com, 30-day full report, evidence preservation, and Control 7.1 IRP requirements
- Maps CSCF to ISO 27001:2022, PCI DSS v4.0.1, and NIST CSF 2.0 — identifying synergies and SWIFT-specific additions not covered by existing certifications
- Determining your SWIFT architecture type (A1/A2/A3/A4/B) and scoping the full CSCF control matrix
- Running a CSCF v2025 gap assessment for an Alliance Access on-premises deployment
- Preparing evidence and completing the annual KYC-SA attestation via swift.com/myswift
- Mapping existing ISO 27001 or PCI DSS controls to CSCF requirements to identify SWIFT-specific gaps
16. 🇦🇺 ISM [Australia] — Australian Information Security Manual
ISM - Claude Skill/ism.skillTurns Claude into an expert advisor on the Australian Information Security Manual (ISM) — the whole-of-government cybersecurity framework published by the Australian Signals Directorate (ASD) for federal and state government entities and their supply chains. Covers all 22 guideline chapters, control applicability markings (NC/OS/PROTECTED/SECRET/TOP SECRET), the IRAP assessment programme, system authorisation, and the Essential Eight relationship.
- Applies the ISM's control applicability marking system — determines NC/OS/PROTECTED/SECRET/TOP SECRET controls for a given system using the stacking rule, and scopes gap analyses accordingly
- Guides the complete system authorisation pathway — six-step cycle (define, select, implement, assess, authorise, monitor), SSP structure, and ATO sign-off by the Authorising Official
- Prepares agencies for IRAP assessments — full artefact checklist, what assessors evaluate, post-assessment POA&M → ATO pathway, and 24-month re-assessment obligations
- Provides deep-dive guidance on all 22 ISM guideline chapters: system hardening (Ch. 13), patch management SLAs (Ch. 14), logging/retention (Ch. 15), cryptography (Ch. 20), email security (Ch. 18), networking (Ch. 19)
- Explains the Essential Eight as a prioritised ISM subset — maps each of the 8 strategies to ISM chapters, covers ML0–ML3 maturity levels, and distinguishes Essential Eight from full ISM compliance
- Advises private sector cloud providers and supply chain partners on ISM obligations under government contracts and when IRAP is required for non-government entities
- Understanding ISM control applicability markings (NC/OS/PROTECTED) for an Australian government cloud system
- Preparing all artefacts for an IRAP assessment of a PROTECTED-level system — SSP, risk register, evidence
- Mapping Essential Eight Maturity Level requirements to their ISM guideline chapters
- Drafting a System Security Plan (SSP) for ATO sign-off on an OFFICIAL: Sensitive case management system
17. 🇪🇺 NIS2 [EU] Directive
NIS2 - Claude Skill/nis2.skillTurns Claude into an expert advisor on the EU NIS2 Directive (Directive (EU) 2022/2555) — the EU's overarching cybersecurity framework for essential and important entities, in force since 27 December 2022 (transposition deadline 17 October 2024). Replaces NIS1 with expanded scope, stronger incident reporting, management body accountability, and penalties up to €10M or 2% of global turnover.
- Determines entity classification — Essential Entity (Annex I: 11 highly critical sectors including energy, transport, health, banking) or Important Entity (Annex II: 7 other critical sectors) — with size-threshold analysis to confirm scope
- Guides compliance with all 10 Art. 21 cybersecurity risk management measures: risk analysis policies, incident handling, BCP/DR/crisis management, supply chain security, secure SDLC and vulnerability management, effectiveness assessment, cyber hygiene training, cryptography, HR security and access control, and MFA/secure communications
- Walks through the Art. 23 incident reporting workflow: 24-hour early warning, 72-hour incident notification, and 1-month final report — with content requirements for each stage and significant incident threshold guidance
- Explains Art. 20 governance obligations — management body approval, mandatory cybersecurity training, and personal liability under Member State transposition law
- Performs ISO 27001 gap analysis — maps ISO 27001:2022 Annex A controls to NIS2 Art. 21 measures and identifies critical gaps (Art. 20 governance, Art. 23 reporting timelines, MFA mandate, ENISA supply chain assessments)
- Addresses the DORA lex specialis interaction — explains DORA precedence for financial entities under Art. 4, identifies residual NIS2 obligations, and recommends an integrated compliance programme
- Determining whether a European company is an Essential or Important Entity under NIS2
- Walking through the NIS2 Art. 23 incident reporting workflow (24h / 72h / 1 month) after a ransomware attack
- Drafting an NIS2-compliant incident response policy covering all 10 Art. 21 security measures
- Explaining the DORA lex specialis relationship and residual NIS2 obligations for a European financial entity
18. 
CCPA/CPRA [California] Privacy
CCPA - Claude Skill/ccpa.skill
Turns Claude into an expert advisor on California's comprehensive privacy laws — the California Consumer Privacy Act (CCPA, effective Jan 1, 2020) and the California Privacy Rights Act (CPRA/Proposition 24, effective Jan 1, 2023). CPRA created the California Privacy Protection Agency (CPPA), introduced Sensitive Personal Information (SPI), and added rights to correct PI, limit SPI use, and require data retention disclosures.
- Determines business applicability — whether an organisation meets any of the three CCPA/CPRA thresholds ($25M revenue OR 100K+ consumers/households OR 50%+ revenue from PI sale/sharing) and outlines resulting obligations
- Guides consumer rights fulfillment — step-by-step workflows for right to know, delete, correct, opt-out of sale/sharing, limit SPI use, portability, and non-discrimination — including identity verification, exception handling, response deadlines (45 days / 15 business days for SPI), and service provider propagation
- Classifies ad tech, cookie tracking, and data sharing as "sale" or CPRA "sharing" (cross-context behavioral advertising) and advises on Global Privacy Control (GPC) signal compliance and consent management platform implementation
- Identifies and advises on Sensitive Personal Information (SPI) — precise geolocation, biometrics, health data, SSNs, credentials, and more — including permitted uses, limitation right obligations, and 15-business-day response SLA
- Performs GDPR-to-CCPA/CPRA gap analysis — identifies California-specific additions (Do Not Sell or Share link, GPC, SPI limitation, minors' opt-in, financial incentive disclosures) and structural differences (opt-out vs. opt-in, no lawful basis requirement, breach private right of action)
- Assesses CPPA enforcement and penalty exposure — $2,500/unintentional, $7,500/intentional, $100–$750/consumer for breach class actions — and advises on remediation prioritisation
- Determining whether your business meets any CCPA/CPRA threshold ($25M revenue, 100K+ consumers, or 50%+ revenue from PI sale)
- Building a combined right-to-know and right-to-delete response workflow meeting the 45-day deadline
- Classifying ad tech activities (cookie sync, RTB) as sale vs. CPRA sharing vs. service provider processing
- Performing a GDPR-to-CCPA/CPRA gap analysis to identify California-specific requirements
19. 
ITAR [US] — International Traffic in Arms Regulations
ITAR - Claude Skill/itar.skill
Turns Claude into an expert advisor on US defense export controls under 22 CFR Parts 120–130, administered by the Directorate of Defense Trade Controls (DDTC). ITAR controls the export, re-export, and transfer of defense articles, defense services, and technical data on the United States Munitions List (USML) — covering 21 categories from firearms to spacecraft.
- Performs USML jurisdiction analysis — applies the enumeration test and the specially designed test (22 CFR § 120.41) to determine ITAR vs EAR jurisdiction; guides Commodity Jurisdiction (CJ) requests for ambiguous items
- Guides DDTC registration under 22 CFR Part 122 — who must register (manufacturers, exporters, brokers), DS-2032 submission, annual fee tiers, renewal, and Empowered Official designation
- Advises on export licensing — DSP-5 (permanent export), DSP-73 (temporary export), DSP-94 (temporary import), application requirements via D-Trade, licence conditions, and Congressional notification thresholds
- Drafts and reviews Technical Assistance Agreements (TAA) and Manufacturing License Agreements (MLA) under 22 CFR Part 124, including all mandatory clauses: retransfer prohibition, US government rights, audit rights, and 5-year record retention
- Manages deemed exports and foreign national access — covers Technology Control Plans (TCP), screening against DDTC/OFAC/BIS denied party lists, and physical/logical access segregation for foreign national employees and visitors
- Advises on violations and voluntary disclosures — walks through the VSD process (22 CFR § 127.12), penalty exposure (civil up to $1.369M/violation; criminal up to $1M fine and 20 years), mitigating factors, and corrective action planning
- Performing USML jurisdiction analysis for a defense article to determine ITAR vs. EAR applicability
- Guiding DSP-5 and DSP-73 export licence applications and drafting TAAs and MLAs
- Managing deemed export obligations for foreign national employees accessing ITAR-controlled technical data
- Advising on voluntary self-disclosure (VSD) after an ITAR violation and structuring penalty mitigation
20. 
LGPD [Brazil] — General Data Protection Law
LGPD - Claude Skill/lgpd.skill
Turns Claude into an expert advisor on Brazil's Lei Geral de Proteção de Dados Pessoais (Law 13,709/2018), enforced by the ANPD (Autoridade Nacional de Proteção de Dados). LGPD applies extraterritorially to any organisation processing personal data of individuals located in Brazil — covering SaaS companies, fintechs, healthcare, e-commerce, and any business with Brazilian users.
- Analyses extraterritorial scope (Art. 3) — determines LGPD applicability regardless of where the organisation is established
- Maps legal bases for processing — 10 bases under Art. 7 for regular data; stricter Art. 11 bases for sensitive data (health, biometric, racial/ethnic origin); legitimate interest balancing tests
- Drafts LGPD-compliant privacy notices (Art. 9) and valid consent mechanisms (Art. 8) — specific, freely given, documented, and revocable
- Guides data subject rights fulfilment (Arts. 17–22) — access, correction, deletion, portability, and automated decision review — with 15-day response workflows
- Assessing extraterritorial LGPD applicability for a US or EU company with Brazilian users
- Completing a RIPD (Data Processing Impact Report) for high-risk sensitive data processing activities
- Managing a breach notification within the 3-working-day ANPD deadline
- Mapping LGPD legal bases for processing to equivalent GDPR bases and identifying gaps
21. 
CSRD [EU] — Corporate Sustainability Reporting Directive
CSRD - Claude Skill/csrd.skill
Turns Claude into an expert advisor on EU Directive 2022/2464 (CSRD), which requires approximately 50,000 companies to disclose detailed ESG information under the European Sustainability Reporting Standards (ESRS). CSRD came into force on 5 January 2023 and replaces the Non-Financial Reporting Directive (NFRD), extending mandatory sustainability reporting from ~11,000 to ~50,000 companies across the EU.
- Determines CSRD scope and first reporting year — analyses PIE Wave 1 (>500 employees, FY 2024), other large companies (FY 2025), listed SMEs (FY 2026), and non-EU companies with >€150M EU turnover (FY 2028)
- Guides the Double Materiality Assessment (DMA) — step-by-step ESRS 1 process covering impact materiality (scale × scope × irremediability) and financial materiality (risks/opportunities), with scoring templates and stakeholder engagement requirements
- Produces CSRD gap assessments — maps current GRI, TCFD, CDP, and SASB disclosures to mandatory ESRS datapoints with priority and action columns
- Advises on ESRS E1 Climate Change — Scope 1, 2 (location- and market-based), and all 15 Scope 3 GHG categories; transition plan under Art. 19a(2)(a); EU Taxonomy alignment; physical and transition risk financial effects
- Determining whether your company falls under CSRD and identifying your first mandatory reporting year
- Conducting a Double Materiality Assessment (DMA) covering all material ESRS topical standards
- Building a Scope 3 GHG emissions programme covering all 15 categories required under ESRS E1
- Performing a GRI / TCFD to ESRS gap analysis for companies transitioning to mandatory reporting
22. 
CIS Controls v8 — CIS Top 18 Cyber Hygiene
CIS Controls - Claude Skill/cis-controls.skill
Turns Claude into an expert CIS Controls v8 advisor covering all 18 controls and 153 safeguards from the May 2021 release. Applies the Implementation Group (IG) framework to scope guidance to your organisation's risk profile: IG1 (56 safeguards — essential cyber hygiene for all orgs), IG2 (130 safeguards — dedicated IT, sensitive data), and IG3 (153 safeguards — large enterprise with security team). Includes complete cross-framework mapping to NIST CSF 2.0, ISO 27001:2022, CMMC 2.0, SOC 2, and PCI DSS v4.0.
- Determines the correct Implementation Group for any organisation — applies IG criteria (IT resources, data sensitivity, regulatory exposure, threat profile) and scopes all guidance to that IG
- Conducts CIS Controls gap assessments across all 18 controls and applicable safeguards with 🔴/🟡/🟢 status, IG assignment, asset type, security function, and prioritised remediation roadmap
- Provides safeguard-level implementation guidance — practical steps, recommended tools (Qualys, CrowdStrike, Splunk, Microsoft Defender, Nessus), and common pitfalls for all 153 safeguards
- Delivers a structured IG1 12-week quick-start programme — week-by-week: asset inventory, secure configuration, access controls, patch management, backups, and security awareness training
- Determining whether your organisation needs IG1, IG2, or IG3 controls with a scoped 12-week quick-start plan
- Running a CIS Controls v8 gap assessment with 🔴/🟡/🟢 status across all 18 controls and applicable safeguards
- Building a vulnerability management programme with CVSS-based remediation SLAs (Control 7)
- Mapping CIS Controls v8 to NIST CSF 2.0 for a unified cross-framework compliance programme
23. 
EAR [US] — Export Administration Regulations
EAR - Claude Skill/ear.skill
Turns Claude into an expert Export Administration Regulations (EAR) advisor with deep knowledge of all 15 CFR Parts 730–774, administered by the Bureau of Industry and Security (BIS). Covers the full dual-use export control lifecycle — ECCN classification, licence analysis, restricted party screening, deemed exports, FDPR, and enforcement response.
- Applies the mandatory Order of Review to determine EAR vs. ITAR jurisdiction — USML check first, then CCL classification or EAR99 confirmation per § 732.3
- Classifies items across all 10 CCL categories (0–9) and 5 product groups (A–E) with step-by-step ECCN determination, including CCATS and CJ request guidance
- Analyses licence requirements using the Commerce Country Chart (RFC × country matrix) and identifies all 14 applicable licence exceptions: LVS, GBS, CIV, APP, TSR, TMP, RPL, GOV, TSU, ENC, BAG, AVS, ACE, GFT
- Guides restricted party screening against the Entity List, Denied Persons List, Unverified List, MEU List, and OFAC SDN — with Consolidated Screening List (CSL) workflow
- Classifying an item under the EAR — ECCN determination and licence requirement analysis for specific destinations
- Assessing deemed export obligations for foreign national employees accessing controlled encryption technology
- Determining whether AES-256 cybersecurity software qualifies for the ENC licence exception for France, India, or Brazil
- Designing a 7-element Export Compliance Programme for a dual-use technology or semiconductor company
24. 
NIST SP 800-53 — Security and Privacy Controls for Federal Systems
NIST 800-53 - Claude Skill/nist-800-53.skill
Turns Claude into an expert NIST SP 800-53 Rev 5 federal security and privacy controls advisor covering the full catalog (September 2020) and its companion publications — SP 800-53B baselines, SP 800-53A assessment procedures, and SP 800-37 Rev 2 Risk Management Framework. Serves federal agency teams, cloud service providers pursuing FedRAMP, system owners, ISSOs, and GRC professionals implementing FISMA-mandated controls.
- Categorises systems using FIPS 199/200 and SP 800-60 — determines C/I/A impact levels, applies the high-water mark rule, and selects the appropriate Low, Moderate, or High baseline from SP 800-53B
- Covers all 20 control families (AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, PT, RA, SA, SC, SI, SR) — including the new PT Privacy and SR Supply Chain families added in Rev 5
- Guides the full tailoring process — identifies common/inherited controls, applies scoping considerations, fills in Organization-Defined Values (ODVs) with federal guidance, designs compensating controls, and supplements baselines for elevated risks
- Writes SSP control narratives in the standard format — implementation description, responsible role, inherited/hybrid designation, and SP 800-53A testing method for each control
- Categorising a federal system under FIPS 199/200 and selecting the correct Low, Moderate, or High SP 800-53B baseline
- Implementing phishing-resistant MFA under IA-2(1) and IA-2(2) to satisfy EO 14028 and OMB M-22-09
- Writing SSP control narratives in the standard federal format for any of the 20 control families
- Building a ConMon strategy with monthly vulnerability scan frequencies, annual pen-testing, and POA&M cadence
25. 
EU AI Act — Regulation (EU) 2024/1689
EU AI Act - Claude Skill/eu-ai-act.skill
Turns Claude into an expert EU AI Act compliance advisor covering the full Regulation (EU) 2024/1689 — the world's first comprehensive horizontal AI regulation, in force from 1 August 2024. Serves AI providers, deployers, importers, and authorised representatives operating in or placing AI systems on the EU market.
- Classifies AI systems across all four risk tiers — Prohibited (Art. 5), High-Risk (Art. 6), Limited Risk (Art. 50), and Minimal/No Risk — using both Annex I safety component path (Art. 6(1)) and Annex III listed use case path (Art. 6(2))
- Screens for all 8 prohibited AI practices (Art. 5, applies from 2 February 2025): subliminal manipulation, vulnerability exploitation, social scoring, predictive criminal assessment, untargeted biometric scraping, workplace/education emotion inference, sensitive-attribute biometric categorisation, and real-time RBI in public spaces by law enforcement
- Covers all 8 Annex III high-risk use case areas: biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration/border control, and justice/democracy
- Walks through all Arts. 9–17 provider obligations: risk management (5-step lifecycle process), data governance, Annex IV technical documentation, automatic logging, transparency to deployers, human oversight design (stop button, override capability), accuracy/robustness/cybersecurity, 12-item provider checklist, and 13-component Quality Management System
- Classifying an AI system across all four risk tiers and understanding provider obligations under Arts. 9–17
- Assessing whether an AI use case triggers an Art. 5 prohibited practice prohibition (in force from 2 February 2025)
- Determining GPAI model obligations and whether the 10²⁵ FLOPs systemic risk threshold applies
- Navigating dual EU MDR / EU AI Act regulation for an AI-powered medical diagnostic imaging tool
26. ♿ Section 508 — US Federal ICT Accessibility
Section 508 - Claude Skill/section-508.skillTurns Claude into an expert Section 508 compliance advisor for US federal agencies, contractors, and ICT vendors. Covers the Revised Section 508 Standards (2018) — 36 CFR Part 1194 — which incorporate WCAG 2.0 Level A and AA as the technical standard for all federal web content, software, documents, and hardware.
- Completes VPAT 2.x (WCAG Edition) / Accessibility Conformance Reports (ACR) — section-by-section with Supports/Partially Supports/Does Not Support/N/A conformance levels, remarks, and testing methodology disclosure
- Guides full accessibility audits: automated scan (axe-core, WAVE, Lighthouse), keyboard-only navigation, screen reader testing (JAWS+Chrome, NVDA+Chrome/Firefox, VoiceOver+Safari), colour contrast (SC 1.4.3), zoom/reflow (SC 1.4.4), and PDF accessibility checklist
- Drafts procurement language — FAR clause 52.239-2 RFP requirements, remediation SLAs, post-award ACR update obligations, and undue burden exception documentation (E202.5)
- Completing a VPAT 2.x Accessibility Conformance Report (ACR) for a federal agency SaaS procurement
- Auditing a federal web portal for WCAG 2.0 AA compliance with JAWS, NVDA, and keyboard-only testing
- Drafting RFP procurement language with Section 508 accessibility requirements under FAR 52.239-2
- Documenting an undue burden determination (E202.5) for a legacy ICT system with an alternative access plan
27. ♿ WCAG — Web Content Accessibility Guidelines
WCAG - Claude Skill/wcag.skillTurns Claude into an expert advisor on WCAG 2.0, 2.1, and 2.2 — the W3C international standard for digital accessibility, developed by the Web Accessibility Initiative (WAI). WCAG is the technical foundation for accessibility laws worldwide: EU EAA (EN 301 549), US Section 508 and ADA, UK Equality Act, and Australia's DDA all reference WCAG conformance.
- Covers all POUR principles (Perceivable, Operable, Understandable, Robust) across WCAG 2.2 — including all 9 new criteria added in 2.2 (SC 2.4.11–13, 2.5.7–8, 3.2.6, 3.3.7–8) and all 17 criteria added in 2.1 for mobile, low vision, and cognitive accessibility
- Performs accessibility audits: colour contrast analysis (SC 1.4.3/1.4.11), ARIA patterns and screen reader testing (NVDA, JAWS, VoiceOver), keyboard navigation, focus management, live region announcements, and reflow at 320 CSS px (SC 1.4.10)
- Produces accessibility statements, maps WCAG to legal frameworks by jurisdiction (EN 301 549, EAA, Section 508, ADA, UK PSBAR), and advises on WCAG 2.1 AA vs 2.2 AA conformance claims
- Auditing a web or React application for WCAG 2.1 AA compliance across all POUR principles
- Upgrading a WCAG 2.1 conformance claim to WCAG 2.2 AA and identifying the 6 new required criteria
- Reviewing ARIA patterns, keyboard focus management, and live region announcements for interactive components
- Determining WCAG version and conformance level required under US, EU, and UK accessibility laws
28. 🇳🇿 NZISM — New Zealand Information Security Manual
NZISM - Claude Skill/nzism.skillTurns Claude into an expert advisor on the New Zealand Information Security Manual (NZISM) — the mandatory cybersecurity framework published by the GCSB / NCSC NZ for NZ government agencies and their supply chains. Covers the NZ Government Information Classification System (ISCS) from Unclassified through Top Secret, all 18+ control sections, and the full Certification & Accreditation (C&A) lifecycle.
- Conducts NZISM gap analyses across all control domains for any classification level — produces structured tables with status, evidence required, and remediation priority
- Guides Certification & Accreditation (C&A) for Restricted and above — SSP preparation, security risk assessment, independent assessment, POA&M, and Accrediting Authority sign-off
- Generates NZISM-referenced policies (Access Control, Incident Response, Information Security) with classification markings and document control blocks
- Gap analysis of a NZ government system against NZISM for Restricted classification — with C&A roadmap
- NZISM guidance for moving Restricted government data to offshore cloud — approvals and data residency requirements
- Generating NZISM-compliant security policies (Access Control, Incident Response) with classification markings
- Reviewing supplier contractual security obligations for NZ government In-Confidence data
29. 🇻🇳 Vietnam PDPL — Law on Personal Data Protection
Vietnam PDPL - Claude Skill/vn-pdpl.skillTurns Claude into an expert advisor on Vietnam's Law on Personal Data Protection No. 91/2025/QH15 (effective 1 January 2026) and implementing Decree 356/2025/ND-CP, administered by the Ministry of Public Security. Applies to Vietnamese entities and foreign organisations processing data of Vietnamese citizens (extraterritorial reach). Vietnam's first comprehensive personal data protection law.
- Conducts VN-PDPL gap analyses — maps obligations across all 6 data subject rights, consent, lawful basis, cross-border transfer, DPIA, security, breach notification, DPO, and SME exemptions
- Drafts cross-border transfer impact assessments (Article 20, due within 60 days) and domestic DPIAs (Article 21) with sector-specific rules for finance, AI, cloud, and blockchain
- Guides breach response — 72-hour notification workflow to Ministry of Public Security; finance sector dual notification to both authority and data subjects
- VN-PDPL gap analysis for a foreign company processing Vietnamese citizen data — extraterritorial scope and obligations
- 72-hour breach notification response for a Vietnamese fintech company with dual authority and data subject notification
- DPIA for an AI-powered telemedicine platform processing health records, biometrics, and behavioural data
- Assessing SME exemptions — which VN-PDPL obligations are deferred for 5 years and which apply from day one
30. 🇪🇺 EU CRA — Cyber Resilience Act
EU CRA - Claude Skill/eu-cra.skillTurns Claude into an expert advisor on Regulation (EU) 2024/2847 — the EU Cyber Resilience Act, which mandates cybersecurity requirements for all Products with Digital Elements (PDEs) sold in the EU (full application: 11 December 2027). Covers connected hardware, software, IoT devices, industrial systems — any product with a network interface.
- Classifies products into Default / Class I / Class II (Annex III: 35 categories including VPNs, password managers, identity management; Annex IV: 12 categories including hypervisors, HSMs, industrial ICS/SCADA) and determines conformity route (self-assessment vs. mandatory Notified Body)
- Conducts Annex I gap analysis — 10 Part I security properties (secure by default, no hardcoded credentials, encryption, signed firmware, exploit mitigations) and 9 Part II vulnerability handling obligations (CVD/VDP, SBOM, 24/72-hour ENISA/CSIRT reporting)
- Guides CE marking, technical documentation (Annex VII), SBOM programme (SPDX/CycloneDX), and 5-year support period obligations including end-of-life notification
- Classifying a connected product as Default, Class I, or Class II and selecting the correct conformity route
- Conducting an Annex I gap analysis across 10 Part I security properties and 9 Part II vulnerability handling obligations
- Implementing a 24-hour ENISA early warning + 72-hour full notification programme for actively exploited vulnerabilities
- Building an SBOM programme (SPDX/CycloneDX) and meeting the 5-year support period and end-of-life notification obligations
How to Install a Skill
- Download the
.skillfile for the framework you need from the table below. - Open Claude and navigate to Customize → Skills.
- Click Upload Skill and select the
.skillfile. - The skill is now active. Start a new conversation and ask your compliance question — Claude will automatically apply the skill.
| Framework | Download |
|---|---|
| 1. ISO 27001 | iso27001.skill |
| 2. SOC 2 | soc2.skill |
| 3. FedRAMP | fedramp.skill |
| 4. 🇪🇺 GDPR | gdpr-compliance.skill |
| 5. HIPAA | hipaa-compliance.skill |
| 6. NIST CSF | NIST Cybersecurity.skill |
| 7. PCI DSS | PCI-Compliance.skill |
| 8. 🚨 TSA Cybersecurity | TSA-Compliance.skill |
| 9. ISO 42001 AI Management System | ISO-42001.skill |
| 10. ISO 27701 Privacy Information Management | iso27701.skill |
| 11. DORA [EU] — Digital Operational Resilience | dora.skill |
| 12. 🇮🇳 DPDPA [India] — Digital Personal Data Protection Act | dpdpa.skill |
| 13. CMMC 2.0 [US] — Cybersecurity Maturity Model Certification | cmmc.skill |
| 14. NIST AI Risk Management Framework | nist-ai-rmf.skill |
| 15. SWIFT Customer Security Programme (CSP) | swift-csp.skill |
| 16. 🇦🇺 ISM [Australia] — Australian Information Security Manual | ism.skill |
| 17. 🇪🇺 NIS2 [EU] Directive | nis2.skill |
| 18. CCPA/CPRA [California] Privacy | ccpa.skill |
| 19. ITAR [US] — International Traffic in Arms Regulations | itar.skill |
| 20. LGPD [Brazil] — General Data Protection Law | lgpd.skill |
| 21. CSRD [EU] — Corporate Sustainability Reporting Directive | csrd.skill |
| 22. 🛡️ CIS Controls v8 — CIS Top 18 Cyber Hygiene | cis-controls.skill |
| 23. 📦 EAR [US] — Export Administration Regulations | ear.skill |
| 24. 🏛️ NIST SP 800-53 — Security and Privacy Controls for Federal Systems | nist-800-53.skill |
| 25. 🤖 EU AI Act — Regulation (EU) 2024/1689 | eu-ai-act.skill |
| 26. ♿ Section 508 — US Federal ICT Accessibility | section-508.skill |
| 27. ♿ WCAG — Web Content Accessibility Guidelines | wcag.skill |
| 28. 🇳🇿 NZISM — New Zealand Information Security Manual | nzism.skill |
| 29. 🇻🇳 VN-PDPL — Vietnam Law on Personal Data Protection | vn-pdpl.skill |
| 30. 🇪🇺 EU CRA — Cyber Resilience Act | eu-cra.skill |
Install via Claude Code Marketplace
If you use Claude Code — the AI-powered CLI for developers — these skills are also available as installable Claude Code plugins through a hosted marketplace. This is the recommended installation path for developers and teams, as it supports version-pinning, automatic updates, and team-wide distribution without any manual file handling.
Add the marketplace and install the skills you need directly from the terminal:
/plugin marketplace add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
/plugin install iso27001@grc-skills soc2@grc-skills fedramp@grc-skills gdpr-compliance@grc-skills hipaa-compliance@grc-skills nist-csf@grc-skills pci-compliance@grc-skills tsa-compliance@grc-skills iso42001@grc-skills iso27701@grc-skills dora@grc-skills dpdpa@grc-skills cmmc@grc-skills nist-ai-rmf@grc-skills swift-csp@grc-skills ism@grc-skills nis2@grc-skills ccpa@grc-skills itar@grc-skills lgpd@grc-skills csrd@grc-skills cis-controls@grc-skills ear@grc-skills nist-800-53@grc-skills eu-ai-act@grc-skills section-508@grc-skills wcag@grc-skills nzism@grc-skills vn-pdpl@grc-skills eu-cra@grc-skillsTeams can pre-wire the marketplace in .claude/settings.json so every developer gets the skills automatically when they open the project — no manual install required.
📖 Full installation instructions, team setup, and update guide → INSTALLATION.md
Skill Evaluation
These skills were benchmarked using the Claude Skill Creator eval framework. 150 realistic test cases were run across all 30 skills — 5 per framework — covering gap analysis, policy drafting, control deep-dives, edge cases, and compliance advice scenarios. Each test case was evaluated against 5 objectively verifiable assertions by independent grader agents comparing skill-assisted vs. baseline Claude responses. 675 total assertions evaluated.
654 / 675 assertions passed
546 / 675 assertions passed
+108 additional assertions passed
Per-Skill Results
| # | Skill | Cases | With Skill | Baseline | Delta | What Was Tested |
|---|---|---|---|---|---|---|
| 1 | ISO 27001 | 5 | 100% | 84% | +16% | Gap assessment; Policy drafting; 2013→2022 transition; Risk assessment; Management review CAP |
| 2 | SOC 2 | 5 | 100% | 84% | +16% | Type 1 vs 2; CC controls checklist; Availability criteria; Access control policy; Audit exception response |
| 3 | FedRAMP [US] | 5 | 84% | 76% | +8% | Authorization pathways; Impact levels; FedRAMP 20x; System boundary; POA&M remediation timelines |
| 4 | 🇪🇺 GDPR | 5 | 100% | 96% | +4% | US SaaS GDPR obligations + DPF transfer mechanisms; Art. 28 DPA with DPF/SCCs; SAR response + exemptions; Cookie consent + tracking pixels ePrivacy; 72-hour breach notification workflow |
| 5 | HIPAA [US] | 5 | 92% | 88% | +4% | Covered entity analysis; BAA template; Encryption (addressable vs required); Risk analysis; Workforce violation |
| 6 | NIST CSF | 5 | 96% | 84% | +12% | CSF 2.0 overview; Ransomware recovery plan; Profile creation; Control mapping; Board reporting |
| 7 | PCI DSS | 5 | 92% | 88% | +4% | SAQ type selection; Req 3 stored data (v4.0); Breach obligations; Penetration testing; Tokenization scope |
| 8 | 🚨 TSA Cybersecurity | 5 | 100% | 96% | +4% | Pipeline directive requirements; CIRP elements; OT/IT segmentation; Airport applicability; TSA vs CIRCIA |
| 9 | ISO 42001 | 5 | 92% | 80% | +12% | AIMS applicability; Key requirements; AI-specific risks; Third-party LLM management; AI ethics controls |
| 10 | ISO 27701 | 5 | 100% | 80% | +20% | Extension to ISO 27001; GDPR mapping; Processor controls; PIA methodology; Certification as GDPR evidence |
| 11 | DORA [EU] | 5 | 88% | 72% | +16% | Five pillars; ICT incident reporting timelines; TLPT requirements; Third-party contracts; DORA vs EBA |
| 12 | 🇮🇳 DPDPA [India] | 5 | 96% | 80% | +16% | Applicability to foreign entities; Consent vs GDPR; Children's data (18-year threshold); Cross-border transfers; SDF obligations |
| 13 | CMMC 2.0 [US] | 5 | 100% | 100% | ±0% | Level determination; SPRS scoring; CUI scoping; SSP structure; C3PAO assessment readiness |
| 14 | NIST AI RMF | 5 | 92% | 76% | +16% | Four functions overview; Hiring AI risk assessment; Credit scoring risk register; EU AI Act mapping; GOVERN gap assessment |
| 15 | SWIFT CSP | 5 | 100% | 48% | +52% | Architecture scoping (A1/A2/A3/A4/B); MFA hardware token requirement (Control 4.2); CSCF v2025 gap assessment; KYC-SA attestation process; Incident response obligations (Control 7.1) |
| 16 | 🇦🇺 ISM [Australia] | 5 | 96% | 52% | +44% | OS control scoping and authorisation pathway; IRAP assessment preparation; Chapter 13 system hardening evidence; Essential Eight to ISM chapter mapping; Supply chain cloud provider obligations |
| 17 | 🇪🇺 NIS2 [EU] | 5 | 96% | 80% | +16% | Energy company EE/IE classification; SaaS provider Art. 21 obligations; Ransomware Art. 23 reporting workflow; ISO 27001 vs NIS2 gap analysis; DORA lex specialis interaction |
| 18 | CCPA/CPRA [California] | 5 | 100% | 96% | +4% | E-commerce threshold analysis and applicability; Combined right-to-know and delete workflow; Ad tech sale vs sharing classification; GDPR-to-CCPA/CPRA gap analysis; SPI classification for mobile app |
| 19 | ITAR [US] | 5 | 100% | 100% | 0% | USML jurisdiction analysis for military laptops; Deemed export for German engineer; DSP-73 temporary export for trade show; Violation and VSD process; TAA mandatory clauses for India transfer |
| 20 | LGPD [Brazil] | 5 | 100% | 80% | +20% | Extraterritorial scope for US SaaS with Brazilian customers; Data deletion request across CRM/email/analytics; Sensitive health data marketing restrictions; Breach notification (3 working days vs GDPR 72h); International transfer mechanisms to the US |
| 21 | CSRD [EU] | 5 | 100% | 72% | +28% | CSRD scope analysis for German listed manufacturer (PIE Wave 1); Double materiality vs GRI/TCFD; Post-DMA disclosure requirements for E1/S1/G1; GRI+TCFD to ESRS gap assessment; Non-EU company (US parent, €200M EU revenue) obligations |
| 22 | 🛡️ CIS Controls v8 | 5 | 100% | 80% | +20% | Implementation Group determination; Gap assessment for SaaS startup; MFA safeguard scoping (IG2); CIS v8 to NIST CSF 2.0 mapping; Vulnerability management programme with CVSS-based remediation SLAs |
| 23 | 📦 EAR [US] | 5 | 100% | 88% | +12% | RF amplifier ECCN classification for Germany export; Deemed export for Chinese/Australian dual national on 5D002; Entity List re-export violation and VSD process; AES-256 software ENC exception for France/India/Brazil; ECP design for semiconductor equipment company |
| 24 | 🏛️ NIST SP 800-53 [US] | 5 | 92% | 84% | +8% | FIPS 199 categorization for federal HR system; AC-2(3) OTS finding and POA&M documentation; MFA controls and EO 14028 phishing-resistant MFA; SSP narrative for SC-8(1) Transmission Confidentiality; ISO 27001 to FedRAMP gap analysis and RMF steps |
| 25 | 🤖 EU AI Act [EU] | 5 | 100% | 76% | +24% | CV screening high-risk + Annex III Area 4 + AI Omnibus 2027 deadline; Predictive policing Art. 5 prohibition (score-not-decision rebutted); Open-source GPAI CoP + exception scope (3×10²⁴ FLOPs); MDR+AI Act interaction + 2028 Annex I deadline; E-commerce chatbot Art. 50 disclosure + grace period |
| 26 | ♿ Section 508 [US] | 5 | 100% | 100% | ±0% | VPAT 2.x procurement language (FAR 52.239-2); Keyboard and screen reader audit methodology; PDF accessibility remediation checklist; JAWS+Chrome AT testing matrix; Undue burden exception documentation |
| 27 | ♿ WCAG [International] | 5 | 100% | 89% | +11% | Colour contrast audit with replacement suggestions (SC 1.4.3); WCAG 2.2 upgrade criteria (6 new criteria, SC 4.1.1 removal); React modal ARIA code review with corrected implementation; Legal compliance mapping across US/EU/UK; Accessibility statement for e-commerce site |
| 28 | 🇳🇿 NZISM [New Zealand] | 5 | 100% | 88% | +12% | Gap analysis for Restricted system; Cloud (AWS offshore) hosting approval; NZISM Access Control Policy; Incident response obligations; Supplier contractual security obligations |
| 29 | 🇻🇳 VN-PDPL [Vietnam] | 5 | 100% | 68% | +32% | SaaS extraterritorial scope and cross-border transfer obligations; Fintech breach notification (72-hour dual notification); Telemedicine DPIA with AI opt-out obligations; Micro-enterprise SME exemptions; Consent validity review and 15-day withdrawal deadline |
| 30 | 🇪🇺 EU CRA [EU] | 5 | 100% | 80% | +20% | Password manager Class I classification and conformity route; Industrial PLC Class II mandatory Notified Body assessment; 24/72-hour ENISA vulnerability reporting; SBOM format and maintenance obligations; Importer Annex I violations for default credentials and open ports |
Customer Testimonials
Feedback from the GRC and Claude AI community on LinkedIn, Reddit (r/grc · r/ClaudeAI), and beyond.
"An open-source repository of GRC Claude skills that are pretty good! It has ISO 27001, ISO 42001, SOC 2, FedRAMP, GDPR, and others. I checked them out and tested a few. It looks like the skills are at different levels but definitely a very good starting point if your AI assistant doesn't have any GRC skills installed yet."
"This open-source project by Hemant Naik transforms Claude into a compliance co-pilot using installable 'Skills' covering 9+ major GRC frameworks. The benchmark shows a 94% pass rate vs 72% for baseline Claude — a solid +22 point lift, especially on accurate citations. Practical for audit preparation, gap assessments, control mapping, and policy drafting. This represents genuine progress toward interactive, intelligence-driven compliance."
"Fantastic work. Going to follow this and test it out myself."
"This is awesome, thank you!"
"This is awesome! Any chance you can build one for ISO 42001?"
"As a rather new Claude Code user, I'm both impressed and thankful. It's really helpful that you release it publicly. I am at the stage where I understand the need for a well-written CLAUDE.md and skills. This will help me a lot."
"The skills approach is a good entry point — getting Claude to reason about specific frameworks is exactly the right instinct. The gap I kept hitting was that Claude could describe the compliance picture but couldn't act on it... this is a great start."
"I've been doing something similar for the CIS controls and it's been brilliant so far. I'll be using this for ISO and SOC 2. Thanks!"
"Hell ya. We just approved Claude for enterprise so I'll go check it out."
"I'll definitely check this out. I have a skill for threat modeling and am working on some other ones, this is super helpful."
"Awesome, thanks for sharing. I'm going to play around with this."
Share Your Feedback
Have you used the GRC Claude Skills? We'd love to hear what you think — your feedback helps improve future skills and guides new framework coverage.
GRC Framework Updates
This section tracks official regulatory and standards activity across the 30 frameworks covered in this repository. Updated monthly to help GRC practitioners stay ahead of changes — new versions, enforcement actions, guidance releases, and compliance deadline shifts. Each entry below covers June 2026 only; prior months are archived in collapsible sections below.
🗓️ June 2026 Current
Published: June 10, 2026
Change indicators: 🔴 Major change · 🟡 Minor change · 🟢 No change
Seven frameworks carry a 🔴 Major indicator this month — an unusually heavy cycle. FedRAMP finalises CR26 by June 30; the EU AI Act's August 2026 high-risk deadline is being deferred to December 2027 / August 2028 under the Digital Omnibus on AI (formal adoption pending); the HIPAA Security Rule final rule missed its May target; the simplified ESRS delegated act for CSRD is expected this month; SWIFT CSCF v2026 governs the 2026 attestation cycle with Control 2.4 mandatory; California's CCPA risk-assessment regime is live with ADMT obligations six months out; and the EU CRA's notified-body framework applies from June 11.
ISO 27001 🟢
ISO/IEC 27001:2022 remains stable. Audit practice continues to embed Amendment 1:2024 climate-action clauses, and ISO/IEC JTC 1/SC 27 has confirmed no revision before 2027 at the earliest. No new transition deadlines are in play. Practitioners should focus on integration work — harmonising ISMS scope statements with adjacent AIMS (ISO 42001) and PIMS (ISO 27701) implementations.
SOC 2 🟢
The AICPA 2017 Trust Services Criteria (with 2022 Points of Focus) remain unchanged. Auditors increasingly expect AI system monitoring, model versioning, and third-party AI dependency controls as CC6/CC7 evidence, and SOC 2 + AI overlay engagements (aligned to ISO 42001 and NIST AI RMF) keep growing. No action required beyond keeping control narratives current for AI-adjacent systems.
FedRAMP 🔴
CR26 finalises this month. FedRAMP publishes the final Consolidated Rules for 2026 by June 30, effective July 1 with optional transition to January 1, 2027. The single official label becomes "FedRAMP Certified"; FIPS 199 impact levels are replaced by Certification Classes A–D; narrative guidance becomes machine-readable MUST/MUST NOT rules; Rev5 and 20x are distinct, non-reciprocal lanes. FedRAMP Ready retires July 28, 2026. Action: file final comments via GitHub, map legacy SSP narratives to the new rule structure.
GDPR 🔴
The Digital Omnibus is now the dominant GDPR story. The EDPB-EDPS Joint Opinion 2/2026 opposes narrowing the personal data definition via pseudonymisation carve-outs, while supporting simplification of breach notification and cookie consent. June milestones: EDPB consultation on a single EU-wide DPIA template closed June 9. Proposed changes include an explicit legitimate-interest pathway for AI training. The GDPR text is unchanged — treat all Omnibus relief as prospective only.
HIPAA 🔴
The Security Rule final rule did not publish in the May window. The December 2024 NPRM (mandatory MFA, encryption, network segmentation, elimination of "addressable" safeguards) remains proposed with no confirmed timeline; 100+ hospital groups including CHIME are pressing HHS to withdraw it. OCR's January 2026 inflation adjustment raised max civil monetary penalties to $2,190,294 at the willful-neglect-uncorrected tier. Action: keep MFA/encryption moving — treat May 2026 publication claims as outdated.
NIST CSF 🟡
NIST is reviewing comments on SP 1347 (Informative References Quick-Start Guide; comment period closed May 6) with finalisation expected later in 2026. The OLIR ecosystem around CSF 2.0 continues to expand — including the OWASP LLM Security OLIR released in April — giving organisations richer mappings for AI-era risks. The core CSF 2.0 framework is unchanged.
PCI DSS 🟢
PCI DSS v4.0.1 remains the sole active standard, with no v4.1 timeline announced. 2026 assessments are the first full cycle under the complete rule set. QSA scrutiny remains concentrated on Req. 6.4.3 (payment page script integrity) and Req. 12.3.2 (targeted risk analyses). Organisations that deferred these requirements continue to see them raised as findings.
TSA Cybersecurity 🟢
SD Pipeline-2021-01G (effective January 9, 2026) remains the current directive for critical pipeline operators, and freight rail directive SD 1580-21-01E runs through January 15, 2027. TSA's permanent rulemaking to replace Security Directives with binding regulations continues to advance, with a final rule still expected no earlier than late 2026. No new directives or amendments this month.
ISO 42001 🟡
The EU AI Act Omnibus deferral eases — but does not remove — the timeline pressure driving ISO 42001 adoption: high-risk obligations now land December 2027 / August 2028, giving organisations a realistic window to certify first. Certification-body accreditation under ISO/IEC 42006:2025 continues to ramp, and ISO/IEC 42005:2025 remains the reference methodology for AI System Impact Assessments. No revision to 42001:2023 expected in 2026.
ISO 27701 🟡
Certification bodies are now actively issuing ISO/IEC 27701:2025 certificates following accreditation readiness reviews completed in spring. Early uptake is strongest among privacy-first organisations using the new standalone structure (no ISO 27001 prerequisite). Holders of 27701:2019 certificates remain on the transition clock to October 2028. No changes to the standard this month.
DORA 🟡
DORA has entered its first genuine supervisory enforcement cycle. The ESAs' Joint Examination Teams are actively examining the 19 designated CTPPs (including AWS, Azure, Google Cloud, IBM, and SAP), and supervisors have flagged persistent Register of Information deficiencies as an enforcement priority after the second annual submission cycle. Financial entities should verify registers correctly reflect CTPP oversight status. No amendments to Regulation (EU) 2022/2554 are pending.
DPDPA (India) 🟡
2026 remains India's compliance "build year." The government is still expected to publish the first Significant Data Fiduciary designations during 2026, triggering India-resident DPO, annual DPIA, and audit obligations. The next hard milestone is November 13, 2026 — Consent Manager registration framework becomes operational — ahead of full enforcement on May 13, 2027 with penalties up to ₹250 crore. Finalise notice/consent architecture and children's-data age-gating now.
CMMC 2.0 🟡
Phase 1 (self-assessments) continues under the 48 CFR rule. The critical date is five months out: Phase 2 begins November 10, 2026, when third-party C3PAO certification becomes a condition of award for Level 2 contracts. C3PAO assessment capacity is tightening — certification typically takes 9–12 months end-to-end, so contractors not yet in the pipeline are at real risk of missing contract eligibility windows.
NIST AI RMF 🟢
AI RMF 1.0 (NIST AI 100-1) and the Generative AI Profile remain unchanged, and no revision has been announced. The framework continues to gain regulatory relevance as the de facto US reference for AI governance — and with EU AI Act high-risk deadlines deferred, many multinationals are using AI RMF profiles as the bridge framework while EU harmonised standards mature.
SWIFT CSP 🔴
CSCF v2026 now governs the 2026 attestation cycle — the most consequential CSCF release in years. Now 32 controls (25 mandatory + 7 advisory). Headline change: Control 2.4 (Back Office Data Flow Security) is mandatory, extending the perimeter into middleware, file transfers, and payment engines. Some Architecture B institutions must reclassify as A4. CSCF v2027 expected July 2026. Action: confirm architecture type, scope expanded perimeter, book assessors early.
Australian ISM 🟡
ASD published the June 2026 ISM release (June 9), continuing the quarterly update cadence. The release includes the updated ISM PDF, a June 2026 changes document, and refreshed System Security Plan annex and cloud controls matrix templates. Organisations preparing for IRAP assessments should rebaseline against the June release before finalising SSP annexes.
NIS2 🟡
Transposition remains incomplete in several Member States, with Commission infringement actions continuing. The Digital Omnibus proposes targeted NIS2 amendments including simplification of incident-reporting obligations across NIS2, GDPR, and DORA — proposals only. For entities in transposed jurisdictions, supervisory activity is increasing, with Art. 20 management-body accountability and Art. 23 reporting timelines the most common early findings.
CCPA / CPRA 🔴
California's CPPA regulations — effective January 1, 2026 — are now fully operational. Businesses must complete a risk assessment before any "significant risk" processing (produce within 30 days on request); pre-2026 activities must be assessed by December 31, 2027 with first attestations due April 1, 2028. ADMT obligations begin January 1, 2027. The CPPA has signalled a "new era" of intensified enforcement. Action: inventory ADMT use, map significant-risk processing, stand up the risk-assessment programme now.
ITAR 🟢
No significant DDTC rulemaking this month. The USML, registration, and licensing frameworks under 22 CFR Parts 120–130 are unchanged. Enforcement and voluntary disclosure activity continues at a steady pace; exporters should maintain TCP discipline for foreign-national access and keep screening current against consolidated lists.
LGPD (Brazil) 🟢
No new ANPD regulations or major enforcement milestones this month. The ANPD continues to mature its supervisory programme under the existing sanction and international-transfer frameworks. Organisations with Brazilian data subjects should keep RIPDs current and ensure the 3-working-day breach notification workflow remains tested — Brazil's deadline is materially shorter than GDPR's 72 hours.
CSRD 🔴
Omnibus I (Directive (EU) 2026/470) entered into force March 2026, cutting CSRD scope to companies with more than 1,000 employees (descoping ~42,000 companies). The Commission's simplified ESRS delegated act — with datapoints cut ~60–70% — is expected this month, following EFRAG's December 2025 advice. Member States must transpose by March 2027. Action: re-run scope analysis and track the final ESRS delegated act closely.
CIS Controls v8 🟢
CIS Controls v8.1 remains the current release, with no v9 announced. The 18 controls, safeguard structure, and Implementation Group framework are unchanged. CIS continues to refresh Benchmarks and companion guides on its normal cadence; organisations should confirm they are referencing v8.1 (which added the Govern function alignment and refined asset classes) rather than the original v8.
EAR 🟡
The Affiliates Rule suspension remains in effect (November 10, 2025 – November 9, 2026) under the US–China trade arrangement, meaning the 50%-ownership extension of Entity List/MEU List restrictions is currently not operative — but scheduled to snap back in November 2026. Entity List additions and removals continue on a rolling basis. Action: maintain screening workflows so reinstatement does not catch transactions mid-flight.
NIST SP 800-53 🟡
Rev 5 continues to evolve through NIST's incremental "patch release" model (Release 5.2.x) via the Cybersecurity and Privacy Reference Tool. The bigger story is downstream: FedRAMP CR26 changes how Rev 5 baselines are packaged (Certification Classes, machine-readable rules), and the September 2026 FedRAMP OSCAL mandate is now a quarter away — SSP and assessment tooling should be OSCAL-ready.
EU AI Act 🔴
The August 2, 2026 high-risk deadline is being deferred. The Digital Omnibus on AI (May 7 political agreement) moves Annex III obligations to December 2, 2027 and Annex I to August 2, 2028. Two new Art. 5 prohibitions added: AI-generated non-consensual intimate imagery and CSAM. Critical caveat: until the Omnibus is formally published in the Official Journal, August 2, 2026 remains the legally operative deadline. Art. 5 and GPAI obligations in force are unaffected.
Section 508 🟡
The Revised 508 Standards are unchanged, but DOJ's Interim Final Rule (April 20, 2026) extended ADA Title II web accessibility deadlines by one year — large public entities (≥50,000 population) now until April 26, 2027; smaller entities until April 26, 2028. Federal 508 obligations are unaffected. Vendors serving both federal and state/local markets should treat the extension as schedule relief, not a pause.
WCAG 🟡
WCAG 2.2 remains the current W3C Recommendation, with WCAG 3.0 still in exploratory working-draft stage. In the EU, European Accessibility Act enforcement approaches its first anniversary (June 28) with national market-surveillance activity increasing against EN 301 549. Conformance targets are unchanged — WCAG 2.1 AA remains the legal floor in most jurisdictions, with 2.2 AA the recommended target.
NZISM 🟢
No new NZISM version was released this month; GCSB/NCSC NZ continues its periodic update cadence. Certification & Accreditation processes, classification framework, and control sections are unchanged. Agencies and suppliers should continue referencing the current published version on the NCSC NZ site when scoping C&A work.
VN-PDPL (Vietnam) 🟡
Vietnam's PDPL (Law 91/2025) completes its first six months in force. Organisations that began processing on or after January 1 should have filed cross-border transfer impact assessments within the 60-day window (Art. 20) and completed domestic DPIAs (Art. 21). The Ministry of Public Security is building supervisory practice under Decree 356/2025, with the finance sector's dual-notification breach regime (authority + data subjects within 72 hours) an early focus. Expect early enforcement signals in H2 2026.
EU CRA 🔴
Two CRA milestones converge this month. From June 11, 2026, the notified-body framework applies — Member States can formally designate conformity assessment bodies for Class II and critical products. And the September 11, 2026 reporting deadline is under three months away: manufacturers must report actively exploited vulnerabilities (24-hour early warning, 72-hour notification) via the ENISA Single Reporting Platform, in pre-launch testing. Action: stand up SBOM monitoring, define the 24/72-hour escalation runbook, and register for SRP testing.
📁 Older Updates
🗓️ May 2026
Published: May 3, 2026
ISO 27001
The 2022 transition is fully complete — no certificates referencing ISO/IEC 27001:2013 remain valid. Audit practice in 2026 continues to embed Amendment 1:2024 climate-action clauses, with auditors verifying that organisations have documented whether climate change is relevant to their ISMS scope. ISO/IEC JTC 1/SC 27 has confirmed no revision to the main standard is planned before 2027. The next expected output from SC 27 is updated implementation guidance, not a new edition.
SOC 2
The AICPA's 2017 Trust Services Criteria remain unchanged. AICPA's updated Illustrative Service Auditor's Reports (revised Q1 2026) reflect evolving AI and cloud deployment patterns — auditors are now expected to address AI system monitoring, model versioning controls, and third-party AI service dependencies as part of CC6 and CC7 evidence. SOC 2 + AI overlay engagements are rising as clients request addendum sections aligned with ISO 42001 and the NIST AI RMF.
HIPAA
The HIPAA Security Rule final rule is expected to be published in May 2026, completing the overhaul first proposed in January 2025. Key changes upon finalisation: the addressable vs. required safeguard distinction is eliminated, making MFA, encryption-at-rest, and network segmentation universally mandatory for all covered entities and BAs. The Part 2 (SUD records) Notice of Privacy Practices update took effect February 16, 2026 — covered entities should verify NPP revisions are live.
GDPR
The EDPB published Guidelines 1/2026 on AI training data (April 15, 2026), clarifying the lawful basis requirements when personal data is scraped or used to train AI models. The Coordinated Enforcement Framework (CEF) 2026 on transparency obligations is underway across EU DPAs. Cumulative GDPR fines have exceeded €7.1 billion across 2,245+ documented cases. Ireland's DPC remains the busiest Big Tech enforcer, with LinkedIn (€310M) and X Corp (€550M) fines both still subject to appeal.
FedRAMP
FedRAMP Ready status retires July 28, 2026 — CSPs currently holding FedRAMP Ready must transition to the Rev5 Class A (Pilot) pathway or risk losing their marketplace listing. The Consolidated Rules 2026 (CR26), which unify FedRAMP's rev5 control requirements, are targeting publication before June 2026. RFC-0031 (Updated Incident Communications Procedures, April 8, 2026) is now finalised and incorporated into the assessment framework. The connect.gov portal retires January 2027.
NIST CSF
The public comment period for SP 1347 (Informative References Quick-Start Guide) closed May 6, 2026; NIST is now reviewing submissions before finalisation. The final SP 1308 (Cybersecurity, ERM, and Workforce Management QSG) was published in April and is available on the NIST website. An OWASP LLM Security OLIR mapped to CSF 2.0 was released April 2026, providing a reference for organisations using large language models in their environments.
PCI DSS
PCI DSS v4.0.1 remains the sole active standard. All 64 future-dated requirements became mandatory on March 31, 2025, and 2026 assessments are the first full cycle under the complete v4.0.1 rule set. Payment brands and QSAs are closely scrutinising Req. 6.4.3 (e-commerce script integrity) and Req. 12.3.2 (targeted risk analyses) — organisations that deferred these are now finding them flagged as findings. PCI SSC has not announced a v4.1 timeline.
ISO 27701
May 2026 is the formal start of third-party certification body assessments against ISO/IEC 27701:2025. Accreditation bodies including UKAS completed their readiness reviews in April, and CBs are now authorised to issue 27701:2025 certificates. Organisations holding 27701:2019 certificates have until October 2028 to transition. The 2025 edition's key change — becoming a standalone standard not requiring ISO 27001 certification — is attracting privacy-focused companies that previously lacked an ISMS baseline.
ISO 42001
The EU AI Act's August 2026 deadline for high-risk AI system compliance is accelerating ISO 42001 certifications — the standard is widely cited in the Act's guidance as a relevant technical framework. The companion standard ISO/IEC 42005:2025 (AI system impact assessment) was published in late 2025 and is now being used to satisfy the AI System Impact Assessment (AISIA) requirements under 42001. No revision to the core 42001:2023 standard is expected in 2026.
DORA
The ESAs designated 19 Critical Third-Party ICT Providers (CTPPs) in November 2025; the first comprehensive oversight examinations of these entities are actively underway in 2026. Financial entities that relied on these CTPPs must reflect CTPP oversight status in their third-party ICT register submissions. The ESAs have also published Q&A clarifications on ICT incident classification thresholds, particularly for outsourced payment processing chains. No amendments to the DORA regulation (EU 2022/2554) are pending.
DPDPA (India)
India's DPDP Rules, 2025 (notified November 13, 2025) are in force but substantive enforcement obligations are phased. The government is expected to publish the first list of Significant Data Fiduciaries (SDFs) in mid-2026, triggering mandatory DPIA, DPO appointment, and data localisation requirements for designated entities. Phase II consent-manager provisions take effect November 2026. Organisations processing children's data must verify age-gating mechanisms are operational ahead of the SDF notification.
TSA Cybersecurity
SD Pipeline-2021-01G (effective January 9, 2026) is the current directive for critical pipeline operators, updating incident reporting contacts and clarifying CIP/COIP annual review requirements. Freight rail directive SD 1580-21-01E runs through January 15, 2027. TSA's proposed permanent rulemaking to replace the Security Directives with binding regulations continues to advance — public comments from 2025 are under review, with a final rule expected no earlier than late 2026.
CMMC 2.0
CMMC Phase 1 (self-assessments for Level 1/2) has been mandatory since November 10, 2025. Phase 2 begins November 10, 2026, requiring C3PAO third-party assessments for Level 2 contracts and making CMMC compliance a condition of all new DoD contract awards by October 31, 2026. Current compliance rates remain critically low — industry estimates suggest only ~1.4% of the DIB supply chain has achieved full Level 2 compliance. Contractors must submit SPRS scores and close open POA&M items urgently.
NIST AI RMF
NIST published a concept note for an AI RMF Profile for Critical Infrastructure (April 7, 2026), covering Energy, Water, Healthcare, and Financial Services sectors. The preliminary draft of NIST IR 8596 (CSF Profile for AI) is under review, extending CSF 2.0 functions to AI-specific cybersecurity risks. The AI Agent Standards Initiative (launched February 2026) adds three-pillar guidance (security, interoperability, identity) for agentic AI deployments. AI RMF 1.1 addenda are expected in late 2026.
SWIFT CSP
CSCF v2026 is the active attestation standard. The KYC-SA annual attestation window opens July 1, 2026, with a December 31, 2026 deadline. This cycle's most significant change: Control 2.4 (Data Flow Security) is now mandatory for all architecture types, requiring formal documentation and prioritisation of data flows between the SWIFT secure zone and back-office systems. Minimum TLS 1.2 and SSH2 cipher requirements are also newly mandatory. Institutions should begin evidence collection now for a July submission.
Australian ISM
The ASD released its March 2026 quarterly ISM update, the first 2026 revision to the Information Security Manual. New additions include a control addressing AI model storage and access governance (applicable to agencies storing large language models or AI training data), and a control for medical device security registers covering networked devices in government health facilities. The Essential Eight Maturity Model remains at its 2023 revision — no changes were included in this quarterly update.
NIS2
As of May 2026, 21 of 27 EU member states have transposed NIS2 into national law. The European Commission published a simplification proposal on January 20, 2026 that would introduce a new "small mid-cap" entity category and streamline the incident reporting obligation for lower-risk important entities. Competent authorities in early-transposing states (Germany, Belgium, Croatia) are issuing their first enforcement notices for registration non-compliance. Entities subject to NIS2 and DORA must manage overlapping incident reporting timelines carefully.
CCPA / CPRA
Two significant CPPA regulations took effect January 1, 2026: mandatory risk assessments for high-risk processing activities (profiling, large-scale sensitive PI processing, and selling/sharing) and cybersecurity audit requirements for businesses whose processing presents "significant risk." Businesses have until January 1, 2027 to comply with the new Automated Decision-Making Technology (ADMT) opt-out and access rules. The CPPA is actively conducting enforcement sweeps on consumer opt-out mechanisms and Global Privacy Control (GPC) signal compliance.
🗓️ April 2026
Published: April 26, 2026
ISO 27001
The October 2025 transition deadline has passed — all ISO 27001 certifications must now be to the ISO/IEC 27001:2022 edition. Certificates still referencing the 2013 standard are no longer valid. The earlier Amendment 1:2024 (climate action changes) remains in effect, requiring organisations to consider climate-related factors when scoping their ISMS. No new version is expected before 2027.
SOC 2
The AICPA's 2017 Trust Services Criteria remain unchanged. In early 2026, the AICPA issued revised points of focus clarifying how controls address evolving technologies — with greater emphasis on MFA, network segmentation, least-privilege access, and API security. Auditors are now treating these as standard evidence expectations in Type II engagements, even where not previously enforced.
HIPAA
Two significant changes took effect or are imminent. First, as of February 16, 2026, covered entities must include substance use disorder (SUD) record information in their Notice of Privacy Practices — a new Part 2 rule requirement. Second, the long-awaited HIPAA Security Rule overhaul is expected to be finalised by May 2026, eliminating the "addressable" vs "required" safeguard distinction and making MFA, encryption-at-rest, and network segmentation universally mandatory.
GDPR
The EDPB launched its Coordinated Enforcement Framework (CEF) 2026, targeting transparency and information obligations — national authorities across the EU are running aligned audits on how clearly organisations explain data processing. Two major enforcement actions remain active: Ireland's DPC fined LinkedIn €310 million and X Corp €550 million for unlawful data processing for ad targeting. Cumulative GDPR fines have now exceeded €7.1 billion across 2,245+ documented cases.
FedRAMP
April 8, 2026: RFC-0031 Updated Incident Communications Procedures was published, refining how CSPs evaluate and escalate incidents affecting federal customer data. Separately, FedRAMP Ready status is being retired on July 28, 2026, replaced by a Rev5 Class A (Pilot) designation. The Consolidated Rules 2026 (CR26) enforcement window begins January 2027, requiring migration away from the connect.gov portal, which will be retired at that time.
NIST CSF
NIST released two new CSF 2.0 Quick-Start Guides in April 2026. The final SP 1308 (Cybersecurity, ERM, and Workforce Management QSG) is now available, helping organisations integrate cybersecurity risk with enterprise risk management and HR planning. Additionally, the Initial Public Draft of SP 1347 (Informative References QSG) is out for a 45-day public comment period closing May 6, 2026.
PCI DSS
PCI DSS v4.0.1 is now the sole active version following the retirement of v4.0 in December 2024 and v3.2.1 in March 2024. All 64 future-dated requirements from v4.x became mandatory on March 31, 2025. In 2026, organisations are completing their first full-cycle assessments under v4.0.1, which include stricter requirements for e-commerce script security (Req. 6.4.3), targeted risk analyses (Req. 12.3.2), and expanded cryptographic controls. No v4.1 announcement has been made.
ISO 27701
ISO/IEC 27701 was substantially updated in October 2025, becoming a fully standalone standard — organisations no longer require ISO 27001 certification as a prerequisite. April 2026 marks a key milestone: accreditation bodies (including UKAS) are now ready to assess against ISO 27701:2025, with formal certification body assessments commencing from May 2026. The full transition deadline for existing 2019 certifications is October 2028.
ISO 42001
No revision to ISO/IEC 42001:2023 is expected in 2026 — the standard remains at its initial release. Adoption is accelerating: the Cloud Security Alliance published updated FAQs in February 2026 addressing how ISO 42001 integrates with ISO 27001 and ISO 27701 for organisations building unified governance frameworks. AI system impact assessments (a core prerequisite to risk assessment under the standard) are receiving increased scrutiny from early certification auditors.
DORA
DORA has been fully in force since January 17, 2025. In 2026, the European Supervisory Authorities (ESAs) are advancing the designation of Critical Third-Party ICT Providers (CTPPs) — the first formal CTPP oversight engagements are underway this year. Financial entities are now operating full ICT incident reporting cycles (4h initial / 72h intermediate / 1 month final report) and submitting ICT third-party registers to national competent authorities. No amendments to the regulation are pending.
DPDPA (India)
India's DPDP Rules 2025 were finalised on November 13, 2025. Implementation is phased: Phase II obligations (consent manager provisions) take effect in November 2026, while substantive compliance obligations for all Data Fiduciaries become enforceable in May 2027. In 2026, the government is expected to designate the first cohort of Significant Data Fiduciaries (SDFs), which will trigger stricter obligations including DPIA requirements and data localisation duties.
TSA Cybersecurity
TSA renewed its pipeline security directives in early 2026. SD Pipeline-2021-01G (issued January 9, 2026) is the latest revision of the incident reporting and cybersecurity coordinator requirements for pipeline operators. The freight rail directive SD 1580-21-01E (effective January 16, 2026 through January 15, 2027) continues to require freight railroad operators to maintain Cyber Risk Management Programs. TSA is also advancing a proposed rulemaking to formalise these directives as permanent regulation.
CMMC 2.0
CMMC is in active Phase 1 enforcement (since November 10, 2025): DoD contracts now require CMMC Level 1 or Level 2 self-assessments as a condition of award. Phase 2 begins November 10, 2026, at which point official C3PAO third-party assessments for Level 2 contractors become mandatory. By October 31, 2026, CMMC compliance will be required for all new DoD contract awards. Contractors should be submitting their SPRS scores and completing any outstanding POA&Ms now.
NIST AI RMF
NIST published a new AI RMF Profile for Trustworthy AI in Critical Infrastructure on April 7, 2026 (concept note stage), covering Energy, Water, Healthcare, and Financial Services. In February 2026, NIST released the preliminary draft of the Cybersecurity Framework Profile for AI (NIST IR 8596), which extends CSF 2.0 to AI-specific cybersecurity risks. The February-launched AI Agent Standards Initiative introduces a three-pillar programme (security, interoperability, identity) for autonomous AI systems. AI RMF 1.1 addenda are expected later in 2026.
SWIFT CSP
CSCF v2026 is now the active framework for the current attestation cycle. The most impactful change: Control 2.4 moves from advisory to mandatory, requiring all institutions to formally identify and prioritise data flows between the SWIFT secure zone and back-office systems. v2026 also introduces minimum key size and cipher requirements (TLS 1.2+, SSH2 mandatory), formalises AI-related risk considerations, and adds cloud shared-responsibility model visuals to Appendix G. The annual KYC-SA attestation deadline remains July 31, 2026.
Support
Reporting Issues
If you find an error, outdated regulatory reference, or missing coverage in any skill, please open a GitHub issue and include:
- The skill name (e.g., ISO 27001, FedRAMP)
- A description of the issue or incorrect guidance
- The correct information with a source reference if possible (e.g., regulatory text, official guidance document)
Requesting New Skills
Have a compliance framework not covered here? Open a GitHub issue with the tag skill-request and describe the framework, your use case, and the audience it would serve. Community suggestions are welcome for frameworks such as CMMC, CCPA, SOX, and others.
Author
Hemant Naik
LinkedIn · hemant.naik@gmail.com
Built March 2026
Disclaimer
The skills in this repository provide informational guidance based on publicly available regulatory and standards documentation. They do not constitute legal, audit, or professional compliance advice. Outputs should be reviewed by qualified professionals — such as a certified ISO 27001 Lead Auditor, licensed attorney, Data Protection Officer, or HIPAA compliance officer — before being relied upon for formal compliance purposes.
Regulatory requirements evolve. Always verify guidance against the latest official publications from the relevant standards body or regulatory authority.
Licensed under the MIT License.
Release Notes
Full changelog for all public releases. Latest release: v1.2.0.
- Improved EU AI Act updated for AI Omnibus (7 May 2026) — Annex III deadline → 2 Dec 2027; Annex I → 2 Aug 2028; 9th prohibited practice (nudification/CSAM, 2 Dec 2026); 10²³ FLOPs GPAI classification threshold; full GPAI Code of Practice (July 2025, signatories: Anthropic, Google, Microsoft, OpenAI, Mistral, Amazon, IBM); AI Office guidance suite (Art. 5 guidelines, GPAI scope, Art. 50 consultation)
- Improved GDPR updated with key 2024–2026 developments — UK DUAA 2025 (Recognised Legitimate Interests, different transfer test, Senior Responsible Individual role); EU–US DPF guidance with CJEU appeal caveat (C-703/25 P); EDPB Opinion 28/2024 on AI models; CJEU SRB pseudonymisation ruling; Russmedia platform controller ruling; EDPB Guidelines 1/2024 on legitimate interests; CEF 2025 erasure enforcement; ePrivacy Regulation withdrawal; new
updates-2025.mdreference file; UK adequacy renewed through December 2031 - Fix SKILL.md ZIP structure corrected for GDPR and EU AI Act — SKILL.md was nested two levels deep, causing the "SKILL.md must be in top-level folder" install error; rebuilt to match ISO 27001 structure (
<name>/SKILL.md) - Improved Benchmark re-run — GDPR: 100% vs 96% baseline (+4 pp, was ±0%); EU AI Act: 100% vs 76% baseline (+24 pp, was +12 pp); overall suite 97% with-skill vs 81% baseline across 675 assertions (+108)
- Improved Additional Resources updated with final 9-run findings from the Responsible AI Model Evaluations study — 5 major findings: Anthropic models hit <6% ASR and <1.2% false refusals simultaneously (only provider to clear both thresholds); CBRN averages 35.41% bypass across all providers (1.6× the next-highest category); Election Interference at 5.66% across all 9 runs; GPT-4o Mini reached +1.67 guardrail drift per turn vs Claude Sonnet 4.6 at −0.12; structural safety rankings stable across 27,000 evaluations
- Improved Skill cards redesigned — accent border, hover lift, pill trigger tags, colour-coded feature/use-case bullets; eval results page Browse Outputs rendering unified across all 30 skills; serial numbers added to benchmark and per-skill tables; header stats corrected (675 assertions, 81% baseline)
- Improved Documentation — Potential Use Cases completed for all 30 skills; INSTALLATION.md rewritten for all 30 plugins with category groupings; per-skill benchmark results table completed for NZISM, VN-PDPL, and EU CRA
- New EU CRA — EU Cyber Resilience Act (Regulation (EU) 2024/2847) advisor covering product classification (Default / Class I (35 Annex III categories) / Class II (12 Annex IV categories)), all 10 Annex I Part I essential security requirements (secure by default, signed firmware, exploit mitigations, encryption), all 9 Part II vulnerability handling obligations (CVD/VDP, SBOM in SPDX/CycloneDX, 24-hour ENISA early warning, 72-hour full notification), conformity assessment routes (Module A self-assessment vs. mandatory Notified Body for Class II), CE marking, technical documentation (Annex VII), 5-year support period obligations, end-of-life notification, manufacturer/importer/distributor duties, and open-source software steward obligations
- New Vietnam PDPL — Vietnam Law on Personal Data Protection (Law No. 91/2025/QH15, effective 1 January 2026) advisor covering gap analysis, all 6 data subject rights with legally mandated response timeframes (Decree 356/2025/ND-CP), cross-border transfer impact assessments (Article 20, 60-day dossier deadline), domestic DPIA (Article 21), 72-hour breach notification, sector-specific rules (finance/banking dual notification, AI opt-out obligations, cloud encryption, blockchain no-direct-storage rule), DPO qualification requirements, SME exemptions, and consent validity rules (pre-ticked boxes invalid)
- New NZISM — New Zealand Information Security Manual advisor covering the GCSB/NCSC NZ mandatory framework for NZ government agencies: NZ Government Information Classification System (Unclassified → Top Secret), all 18+ control sections, Certification & Accreditation (C&A) for Restricted and above, agency security obligations, supply chain and supplier contractual requirements, cloud data residency guidance, and NZISM-aligned policy generation
- Improved Expanded eval suite to 30 skills / 150 test cases — 5 test cases each for NZISM, Vietnam PDPL, and EU CRA covering gap analysis, classification, reporting workflows, and sector-specific scenarios
- Improved All 30 plugin.json versions updated to 1.0.0
- New WCAG — Web Content Accessibility Guidelines advisor covering WCAG 2.0, 2.1, and 2.2 — all POUR principles, every success criterion (including 9 new in 2.2 and 17 new in 2.1), conformance levels A/AA/AAA, ARIA patterns, colour contrast, screen reader testing, accessibility audits, accessibility statement generation, and legal framework mapping (EN 301 549, EAA, Section 508, ADA, UK PSBAR)
- New Section 508 — US Federal ICT Accessibility advisor covering Revised Section 508 Standards (2018 / 36 CFR Part 1194), WCAG 2.0 AA incorporation, VPAT 2.x ACR completion, JAWS/NVDA/VoiceOver screen reader testing, PDF accessibility, procurement language (FAR 52.239-2), and undue burden exception documentation
- Improved All 27 plugin.json versions bumped to 1.0.0 marking the first stable release of the GRC Skills collection
- Improved Expanded eval suite to 27 skills / 135 test cases with new WCAG and Section 508 evals — 5 test cases each graded against 5–6 assertions
▸ Show older releases (v0.1.0 – v0.9.0)
🆕 New Skills (7)
- New ITAR [US] — International Traffic in Arms Regulations advisor covering all 22 CFR Parts 120–130, USML category analysis, DSP-5/73/85 licence workflows, deemed export obligations, TAA/MLA drafting, voluntary self-disclosure, DDTC registration, and Blue Lantern end-use checks
- New LGPD [Brazil] — Lei Geral de Proteção de Dados compliance advisor covering all 10 legal bases, data subject rights, ANPD enforcement, DPA requirements, consent management, international transfer mechanisms, breach notification (3 working day timeline), and mapping to GDPR
- New CSRD [EU] — Corporate Sustainability Reporting Directive advisor covering ESRS standards, double materiality assessment, Wave 1–4 scoping, GRI/TCFD gap analysis, value chain reporting, EU Taxonomy alignment, non-EU parent obligations, and third-party assurance requirements
- New CIS Controls v8 — CIS Top 18 cyber hygiene advisor covering Implementation Group selection (IG1–IG3), all 153 safeguards, gap assessments, vulnerability management SLAs, SIEM/log management design, and cross-framework mapping to NIST CSF 2.0, ISO 27001:2022, CMMC 2.0, SOC 2, and PCI DSS v4.0
- New EAR [US] — Export Administration Regulations advisor covering ECCN classification, CCL/EAR99 analysis, BIS licence requirements, Entity List/SDN screening, deemed export obligations, FDPR, licence exceptions (ENC, STA, LVS, TMP), voluntary self-disclosure, and 7-element export compliance programme design
- New NIST SP 800-53 — Federal security and privacy controls advisor covering all 20 control families, FIPS 199/200 categorization, Low/Moderate/High baseline selection (SP 800-53B), control tailoring and ODVs, SSP narrative writing, POA&M management, all 7 RMF steps (SP 800-37 Rev 2), ConMon strategy, EO 14028 phishing-resistant MFA, and cross-framework mapping to FedRAMP, FISMA, CMMC 2.0, and ISO 27001
- New EU AI Act — Regulation (EU) 2024/1689 compliance advisor covering all four risk tiers (Prohibited/High-Risk/Limited/Minimal), all 8 Art. 5 prohibited practices, all 8 Annex III high-risk use case areas, provider obligations (Arts. 9–17), deployer obligations (Art. 26), conformity assessment and CE marking (Arts. 43–48), GPAI model obligations (Arts. 53–55) with open-source exception and 10²⁵ FLOPs systemic risk threshold (Art. 51), governance (AI Office, AI Board), phase-in timeline, penalties (Art. 99), and cross-framework mapping to ISO 42001, NIST AI RMF, and GDPR
📊 Skill Evaluation
- Improved Expanded eval suite to 25 skills / 125 test cases (5 per framework), each graded against 5 verifiable assertions — 625 total assertions
- Improved EU AI Act skill scored 100% vs baseline of 76% (+24 pp) after AI Omnibus update; GDPR skill improved to 100% vs 96% (+4 pp); overall suite achieves 97% with-skill vs 81% baseline across 675 assertions (+16 pp advantage)
🌐 GitHub Pages — UX Improvements
- New Collapsible skill cards — all 18 skill cards are now accordion-style; ISO 27001 is expanded by default; remaining cards collapse to just their title for a much cleaner page on first load
- New 📰 GRC Framework Updates tab — monthly regulatory and standards digest covering all 18 frameworks; May 2026 edition live now, with April 2026 archived in a collapsible section; updated monthly going forward
- Improved Skill toggle button — more prominent: solid blue background when expanded, light blue when collapsed; larger click target with chevron rotation
- Improved Table zebra striping — even rows now use
#eef2f7for better contrast and row-scanning readability
🐛 Bug Fixes
- Fix ISM plugin installation failure —
marketplace.jsonwas missing the required"source"field for the ISM plugin entry, causing a validation error on install; fixed
🆕 New Skills (3)
- New Australian Information Security Manual (ISM) — Expert advisor for the ASD Information Security Manual; covers control applicability markings (NC/OS/PROTECTED), system authorisation and IRAP assessment preparation, Essential Eight Maturity Level mapping to ISM chapters, Chapter 13 system hardening, supply chain obligations for private sector cloud providers, and government-specific gaps not covered by ISO 27001 certification
- New EU NIS2 Directive — Expert advisor for the NIS2 Directive (Directive (EU) 2022/2555); covers Essential vs Important Entity classification (Annex I/II), all 10 Art. 21 security measures, Art. 23 incident reporting timelines (24h/72h/1 month), Art. 20 management body accountability, supply chain security under Art. 21(2)(d) and Art. 26 ENISA assessments, ISO 27001 gap analysis, and DORA lex specialis interaction for financial entities
- New CCPA/CPRA California Privacy — Expert advisor for the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA/Proposition 24); covers business threshold analysis, all 7 consumer rights with deadlines (45-day standard, 15-business-day for SPI), Sensitive Personal Information (SPI) classification and limitation mechanisms, Do Not Sell or Share link, Global Privacy Control (GPC) signal obligations, ad tech sale vs. sharing classification, service provider/contractor/third-party classification, CPPA enforcement and penalty exposure ($2,500/$7,500 per violation), and GDPR-to-CCPA/CPRA gap analysis
📊 Eval Suite Expansion
- New Expanded from 75 → 90 test cases and 375 → 450 assertions — 5 ISM evals (control scoping and authorisation, IRAP preparation, Chapter 13 hardening, Essential Eight mapping, supply chain obligations), 5 NIS2 evals (entity classification, Art. 21 obligations, Art. 23 reporting, ISO 27001 gap, DORA interaction), and 5 CCPA/CPRA evals (threshold analysis, right-to-know/delete workflow, ad tech classification, GDPR gap analysis, SPI classification)
- Improved Updated benchmark: 95% with-skill (428/450) / 80% baseline (362/450) / +66 additional assertions passing
🌐 GitHub Pages — Improvements
- Improved Header updated — title changed to "Claude Skills for Governance, Risk, & Compliance Frameworks"; skills grid fixed to 6 columns for even rows (18 items ÷ 6 = 3 equal rows)
- Improved CCPA/CPRA uses the actual California flag — replaced unreliable subdivision tag emoji with the Wikimedia Commons California state flag SVG, rendered inline at text size
🆕 New Skills (3)
- New CMMC 2.0 Cybersecurity Maturity Model Certification — Expert advisor for DoD contractors; covers all three CMMC levels (Foundational, Advanced, Expert), 110 NIST SP 800-171 practices, CMMC Level 2 self-assessment vs. C3PAO third-party assessment, POA&M eligibility, SPRS scoring, and OSC/OSA/C3PAO role guidance
- New NIST AI RMF AI Risk Management Framework — Full coverage of NIST AI RMF 1.0 and AI RMF Playbook; all four core functions (GOVERN, MAP, MEASURE, MANAGE), AI risk taxonomy (bias, explainability, security, privacy, safety), trustworthy AI characteristics, tiered risk profiles, and sector-specific guidance
- New SWIFT CSP Customer Security Programme — Expert CSCF v2025 advisor for SWIFT member institutions; all 31 controls (23 mandatory + 8 advisory), all architecture types (A1/A2/A3/A4/B), KYC-SA attestation workflow, hardware MFA token requirements, critical patch SLA, and incident response obligations under Control 7.1
📊 Eval Suite Expansion
- New Expanded from 70 → 75 test cases and 350 → 375 assertions — 5 new SWIFT CSP evals covering architecture scoping, MFA hardware tokens, gap assessment, KYC-SA attestation, and incident response
- Improved Updated benchmark: 95% with-skill / 81% baseline / +14 pts delta / +50 additional assertions passing vs. baseline
🌐 GitHub Pages — UX Improvements
- Improved Skills header redesigned — replaced run-on 15-framework sentence with a clean responsive grid (5 cols → 3 cols → 2 cols) for better readability at all screen sizes
- Fix Skill cards sorted by number — CMMC #13, NIST AI RMF #14, and SWIFT CSP #15 now display in correct order (CMMC was previously appearing last)
- New Added second LinkedIn testimonial — Shubham Mishra, Security Engineering @ Juniper Networks: "genuine progress toward interactive, intelligence-driven compliance"
🌐 GitHub Pages — Site Improvements
- New Added dedicated 📋 Release Notes tab — moved out of Resources for easier access
- New Added LinkedIn testimonial card (Jaana Metsamaa, Co-Founder at Kontion.app) with screenshot and link to post — featured above the Reddit testimonials grid
- New Added GitHub Stars live badge to the site header and README
- Improved Meta description updated to include all 12 skills
📊 Eval Results Page — Rebuilt
- Fix Eval results page previously only showed 36 runs (9 skills). Rebuilt to correctly display all 120 runs (60 prompts × 2 configs) across all 12 skills with accurate benchmark stats (94% / 83% / +11% / +32 assertions)
- Improved Results table links now open and scroll to the corresponding skill accordion
🐛 Bug Fixes — Skill Installability
- Fix DORA and DPDPA skills failed to install with "field 'description' in SKILL.md must be at most 1024 characters" — descriptions trimmed to ~875–890 chars while preserving all key triggering terms
- Fix DORA, DPDPA, ISO 27701, ISO 42001, and FedRAMP plugin
.skillZIPs had an extraskills/wrapper, causing "SKILL.md must be in the top-level folder" install errors. All five rebuilt with correct<name>/SKILL.mdstructure
🆕 New Skills (3)
- New ISO 27701 Privacy Information Management — Expert PIMS advisor covering both ISO 27701:2025 (standalone) and ISO 27701:2019 (ISO 27001 extension); gap analysis, SoA generation, privacy risk assessment, DPIA support, and GDPR/CCPA/LGPD alignment across all 78 Annex A controls (A.1 controller, A.2 processor, A.3 shared security)
- New DORA Digital Operational Resilience — Full DORA (Regulation (EU) 2022/2554) compliance advisor for EU financial entities; covers all 64 articles, all 12 adopted RTS/ITS, ICT risk management framework, incident classification and three-stage reporting (4h/72h/1 month), TLPT scoping, ICT third-party risk, and Register of Information requirements
- New DPDPA India Digital Personal Data Protection — Advisor covering India's Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 (effective May 2027); all 44 sections and 23 Rules, notice and consent requirements, Data Principal rights, 72-hour breach notification, children's data (18-year threshold), Significant Data Fiduciary obligations, and GDPR-to-DPDPA gap analysis
🏛️ FedRAMP Skill — Improvements
- Improved Updated based on user feedback
🤖 ISO 42001 Skill — Improvements
- Improved Updated based on user feedback
🔒 ISO 27701 Skill — Improvements
- Improved Rewrote version-selection logic: skill now leads with the 2019 extension model when the user has an existing ISO 27001 certification, and defaults to the 2025 standalone edition for greenfield implementations — previously defaulted to 2025 in all cases
- Improved GDPR alignment is now mentioned in the opening paragraph of every ISO 27701 explanation — the standard's primary value proposition was previously buried in a reference table
- New Added PII Processor terminology table with exact ISO 27701 control language ("PII subject rights assistance obligations", "sub-processor notification and consent", "processing under controller authority") — these are the precise phrases used in audits and DPA contracts
- New Added explicit "Key Statements" section covering: ISO 27701 is not a GDPR safe harbor; it has not been approved as a formal Article 42 GDPR certification scheme; ISO 27701:2019 requires ISO 27001 as a prerequisite and cannot be certified standalone
🐛 Fix — ISO 27701 Standalone Skill File
- Fix The
ISO 27701 - Claude Skill/iso27701.skillZIP was missing entirely — the directory existed but contained no installable file. The standalone skill archive has been built and published.
📊 Skill Evaluation — Updated Benchmark
- Improved Re-ran the 60-case eval suite following ISO 27701 skill improvements. ISO 27701 delta flipped from −8% to +20% (76% → 100% with skill)
- Improved Overall suite: skills now score 94% vs baseline of 83% (+11 point delta, 282/300 assertions passed), up from 92% / +8pts in v0.3.0
🌐 GitHub Pages — Multi-Tab Site
- New Replaced the Jekyll/README default page with a fully custom, multi-tab
index.htmlcovering Skills, Installation, Evaluation, Customer Feedback, and Resources - New Embedded YouTube demo video directly in the Skills tab
- New Interactive Customer Feedback tab with Formspree-powered contact form (Customer Name, Company, Feedback Title, Feedback Body) — submissions delivered to hemant.naik@gmail.com
- New Integrated Formspree Ajax library (
@formspree/ajax) via CDN for inline field validation and no-reload submissions - New Release Notes section (this section) added to the Resources tab
- Improved Evaluation tab now shows stat cards (92% / 84% / +8pts) and per-skill results table for all 12 skills
🐛 Bug Fixes — Skill Installability
- Fix NIST CSF, PCI DSS, TSA Cybersecurity, and ISO 42001
.skillfiles were failing to install with the error "SKILL.md file must be in the top-level folder, not nested deeper" — caused bySKILL.mdbeing packaged two levels deep (skills/<name>/SKILL.md) instead of one (<name>/SKILL.md). All four skills have been repackaged correctly.
🧪 Test Suite
- New Added
tests/test_skill_installability.py— validates ZIP structure, SKILL.md depth, path safety, and content for all 9.skillfiles (169 assertions, runs withpytest) - New Added
tests/test_plugin_structure.py— validates plugin directory layout,plugin.jsonschema, semver versioning, andmarketplace.jsoncompleteness for all 9 plugins
🆕 New Skills (4)
- New NIST CSF — CSF 2.0 and CSF 1.1 advisor covering all six functions (Govern, Identify, Protect, Detect, Respond, Recover), gap assessments, organisational profiles, and implementation tiers
- New PCI DSS — PCI DSS v4.0.1 advisor covering all 12 requirements, all 8 SAQ types, CDE scoping, v3.2.1 → v4.0.1 migration guidance
- New TSA Cybersecurity — TSA Security Directive advisor for pipeline and rail critical infrastructure, CRMP drafting, OT/ICS implementation, and CISA 24-hour incident reporting
- New ISO 42001 AI Management System — ISO/IEC 42001:2023 AIMS advisor covering all 38 Annex A controls (A.2–A.10), AISIA methodology, AI risk assessment, and EU AI Act mapping
📊 Skill Evaluation
- Improved Expanded eval suite to 12 skills / 60 test cases (5 per framework), each graded against 5 verifiable assertions by independent grader agents — 300 total assertions
- Improved Skills scored 92% vs baseline of 84% (+8 point improvement, +24 additional assertions passed)
- Improved Evaluation tab updated with full 60-case results for all 12 skills including DORA and DPDPA
🐛 Bug Fixes
- Fix Resolved Issue #8 — Claude Code plugin loader path doubling bug where
marketplace.jsonentries with explicitskillsarrays caused the installer to construct double-nested paths, preventing plugin loading. Version bump forces cache invalidation for affected users.
📖 Documentation
- New Customer Testimonials section added to README with 9 community responses from Reddit
- Improved README Skill Evaluation section rewritten with new benchmark summary table and per-skill results
- New YouTube demo video embedded in README and GitHub Pages site
🚀 Initial Release
- New ISO 27001 — gap analysis, policy drafting, risk registers, SoA templates; covers ISO 27001:2013 and ISO 27001:2022
- New SOC 2 — Trust Services Criteria coverage (CC, A, C, PI, P), control documentation, vendor risk questionnaires, Type 1 / Type 2 guidance
- New FedRAMP — ATO lifecycle advisor, SSP and POA&M authoring, NIST 800-53 Rev 5, cloud architecture guidance for AWS GovCloud / Azure Government / GCP
- New GDPR — code and architecture audits, Privacy Notices, DPAs, DPIAs, data subject rights, UK GDPR notes
- New HIPAA — Privacy Rule, Security Rule, Breach Notification Rule; BAA and NPP templates; technical safeguards for cloud environments
- New Claude Code plugin marketplace integration — all 5 skills available via
/plugin install - New Skill eval framework with 10 baseline test cases across the 5 initial skills
Additional Resources
Responsible AI Model Evaluations for NIST AI Risk Management Framework
An open-source, automated red-teaming study benchmarking frontier LLMs from Anthropic, OpenAI, and Google against the RedBench dataset (29,362 prompts across 37 sub-benchmarks and 22 safety risk categories). Scored via a dual-judge pipeline (deterministic regex + Claude Haiku neural judge) and mapped to the NIST AI Risk Management Framework. Findings are published to a live public dashboard and compiled into a peer-reviewed research paper.
Across nine weekly evaluation runs, the study produced five major findings:
- Safety and utility are not in tension — but only Anthropic has proved it. All three Anthropic Claude models averaged under 6% Attack Success Rate and under 1.2% false refusals simultaneously. Every other provider fails at least one threshold. On the final run, Claude Sonnet 4.6 achieved a 5.25% ASR with 0.00% false refusals — the only data point in 9 runs where a model hit a perfect false-refusal rate. GPT-4o Mini posted 8.42% ASR and 13.67% false refusals, failing both simultaneously.
- CBRN information is the most severe and universal safety failure. Chemical, Biological, Radiological, and Nuclear prompts bypassed guardrails at an average of 35.41% across all 9 runs and all 7 models — more than 1.6× the second-highest category (Cybersecurity Threats Beyond Malware at 21.99%). This gap holds equally across all providers, confirming it is a structural limit of current AI alignment, not a single-provider weakness.
- Election Interference is a structural vulnerability — no provider has solved it. Ranked 5th in risk with a 5.66% average bypass rate across 53 data points (7 models × up to 9 runs each). Consistent across every model, every provider, and every week — ruling out sampling noise. Given ongoing global electoral cycles, this carries the most immediate real-world policy urgency.
- Multi-turn safety is where providers diverge most sharply. In the final run (22 May), GPT-4o Mini reached guardrail drift of +1.67 per conversation turn — the study's highest single-run reading — and 4 of 7 models simultaneously posted drift of +1.11 per turn or worse. Claude Sonnet 4.6 and Opus 4.6 averaged −0.12 per turn across all runs: their guardrails tighten under sustained adversarial pressure rather than eroding.
- Week-to-week variance is high, but structural rankings are stable. GPT-4o Mini exceeded 8% ASR in 6 of its 9 runs with no improvement trend. Gemini 2.5 Pro never fell below 7.25% across any of its 6 evaluated runs. Gemini 2.5 Flash led on ASR in every multi-provider run it participated in. These are repeatable, structural safety differences across 27,000 evaluations — not statistical artefacts.
🔗 Live Dashboard · 📄 Research Paper (PDF) · GitHub Repository
Hemant Naik · May 2026 · MIT License · Dataset: RedBench (knoveleng/redbench, MIT)