Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

CCPA CPRA Compliance Advisor helps assess California privacy-law applicability, classify data recipients, and handle consumer rights requests. It is used for notices, opt-outs, SPI limits, ADMT obligations, and gap checks for businesses handling California residents' data.

CIS Controls advises on CIS Controls v8 implementation, gap assessments, and safeguard guidance for organizations. Use it to scope Implementation Groups and map CIS Controls to frameworks like NIST CSF, ISO 27001, SOC 2, and CMMC.

CMMC Governance And Risk helps defense contractors map CMMC 2.0, NIST SP 800-171, and DFARS requirements to the right assessment track. It is used for gap analysis, SSPs, POA&Ms, SPRS scoring, and subcontractor compliance decisions.

CSRD helps answer questions about EU sustainability reporting under the Corporate Sustainability Reporting Directive and ESRS. Use it for scope checks, double materiality, disclosures, gap assessments, and related compliance timelines.

DORA advises on Regulation (EU) 2022/2554 for EU financial entities. Use it for ICT risk management, incident reporting, third-party risk, TLPT, and other digital operational resilience obligations.

DPDPA Compliance Advisor helps answer questions about India’s Digital Personal Data Protection Act, 2023 and the DPDP Rules 2025. Use it for consent, notices, rights requests, breach notification, children’s data, cross-border transfers, and compliance gap analysis.

EU AI Act advises on AI system classification, prohibited practices, high-risk obligations, GPAI duties, transparency, and conformity assessment under Regulation (EU) 2024/1689. Use it when assessing whether an AI system can be deployed in the EU and what compliance steps apply.

EU Cyber Resilience Act advises on scope, product class, conformity assessment, CE marking, SBOM, vulnerability reporting, and manufacturer/importer/distributor duties for products with digital elements sold in the EU.

Ear provides guidance on EAR export control questions, including ECCN classification, license analysis, restricted party screening, and EAR versus ITAR jurisdiction. Use it when checking dual-use items, license exceptions, or BIS compliance obligations.

FedRAMP provides guidance for FedRAMP authorization, documentation, and continuous monitoring. Use it for readiness, ATO packages, control mapping, and federal cloud compliance questions.

GDPR Compliance audits code, systems, and data flows for GDPR issues and helps draft GDPR documents such as privacy policies, DPAs, consent notices, and DPIAs. It also answers GDPR questions with article citations and flags UK-specific differences where relevant.

HIPAA Compliance helps review healthcare documents, workflows, and software for HIPAA issues and drafts related policies, notices, BAAs, and breach materials. It also explains privacy, security, and technical safeguard requirements in plain language.

ISM advises Australian government entities and supply chains on ASD Information Security Manual controls, gap analysis, authorisation, and IRAP preparation. It is used for compliance questions, security documentation, and classification-specific control selection.

ISO 27001 helps with gap analysis, audits, policy writing, risk registers, and certification readiness for ISO/IEC 27001 and ISMS work. Use it when a team needs control guidance or documentation aligned to 2013 or 2022 requirements.

ISO 27701 Privacy helps with ISO/IEC 27701 PIMS compliance, gap analysis, and control guidance for privacy teams. Use it for GDPR alignment, DPIAs, RoPA, data subject rights, and controller or processor obligations.

ISO 42001 AIMS helps with ISO/IEC 42001:2023 compliance, AI risk and impact assessments, control selection, and certification readiness. Use it when implementing or auditing an AI management system or answering specific clause and Annex A questions.

ITAR Compliance advises on 22 CFR Parts 120–130 for defense articles, technical data, registration, licensing, TAAs/MLAs, and enforcement. Use it for jurisdiction, USML scoping, deemed exports, and voluntary disclosure questions.

LGPD Compliance answers questions about Brazil’s data protection law, ANPD guidance, and obligations for processing personal data in Brazil. Use it for legal bases, data subject rights, breach notices, DPIAs, privacy policies, and LGPD vs GDPR comparisons.

NIS2 Directive Compliance Advisor helps classify entities, assess Art. 21 controls, compute incident-reporting deadlines, and draft governance or policy outputs for EU NIS2 compliance. It is used for readiness reviews, gap assessments, and penalty exposure analysis.

NIST 800-53 Compliance Advisor guides FIPS 199 categorization, baseline selection, control tailoring, and RMF steps for federal systems. It is used for SSP narratives, gap assessments, privacy controls, and mapping to FedRAMP, FISMA, CMMC 2.0, and ISO 27001.

NIST AI RMF helps organizations assess and manage AI risks using the GOVERN, MAP, MEASURE, and MANAGE functions. Use it for AI governance, trustworthiness, risk profiles, and mappings to frameworks like the EU AI Act or ISO 42001.

NIST Cybersecurity Framework helps assess cybersecurity risk, build CSF profiles, map controls, and plan remediation using CSF 2.0 or 1.1. Use it for gap assessments, implementation roadmaps, and alignment to other frameworks.

New Zealand Information Security Manual advises New Zealand government agencies and their supply chains on NZISM control requirements, classification, risk, certification, and compliance. Use it for gap analysis, policy guidance, and security obligations under GCSB/NCSC NZ.

PCI DSS Compliance helps teams assess PCI DSS v4.0.1 or v4.0 obligations for payment card data. Use it for CDE scoping, SAQ selection, control guidance, audit prep, and remediation planning.

Section 508 helps assess and document US federal ICT accessibility against the Revised Section 508 Standards and WCAG 2.0 AA. Use it for audits, VPATs/ACRs, remediation plans, procurement language, and testing guidance.