Results for “compliance”

Guidance on security analysis, compliance auditing, and vulnerability assessment techniques relevant to legal and regulatory compliance tasks

Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks, scanning for controls and generating a compliance report.

Classifies AI systems under the EU AI Act's risk tiers and maps compliance obligations for conformity, transparency, and human oversight.

Drafts an audit-ready Export Compliance Program manual covering EAR, ITAR, and OFAC requirements. Use when creating or updating an export compliance policy, international trade compliance program, or preparing enforcement defense documentation for regulatory review.

Pressure-tests any compliance program with six forcing questions before adopting a new framework, planning an audit cycle, or signing off on certification readiness.

Provides HIPAA-specific decision gates and guardrails for healthcare software, directing users to implementation and review skills for PHI handling, audit logging, and compliance.

Ensure HIPAA compliance when handling PHI (Protected Health Information). Use when writing code that accesses user health data, check-ins, journal entries, or any sensitive information. Activates for audit logging, data access, security events, and compliance questions.

Monitors Drata compliance posture by querying the Drata public API for control status, evidence collection, personnel compliance, and asset inventory, then produces a structured audit-readiness report.

Aggregate security findings across AWS accounts, enable compliance standards like CIS and PCI DSS, configure automated remediation with EventBridge and Lambda, and create custom security insights for organizational risk management.

Provides an immutable audit and provenance layer for agentic systems, recording reasoning, telemetry, and actions for debugging, compliance, and learning.

Performs security scanning, compliance checks, deployment planning, and infrastructure setup, with optional dependency auditing and bundle size analysis.

Categorize BES cyber systems and implement NERC CIP compliance controls for high, medium, and low impact assets, including electronic security perimeters, configuration management, and supply chain risk management.

Guides implementation of data protection and privacy controls for regulatory frameworks such as GDPR, HIPAA, SOC 2, and PCI-DSS, including audits, retention policies, and data subject requests.

Sarbanes-Oxley Act compliance reference — SOX sections, internal controls, audit requirements, and IT governance. Use when evaluating SOX compliance, designing internal controls, or preparing for financial audits.

Verifies that blockchain code implements exactly what documentation specifies, identifying gaps between specs and implementation for audit engagements.

Implement PCI DSS 4.0.1 compliance controls across all 12 requirements, including scoping, network security, data protection, access controls, monitoring, and governance.

Produces structured U.S. legal audit summaries that distill compliance findings into executive-ready risk prioritization and remediation plans, covering likelihood/impact scoring, consequence analysis, and corrective actions with timelines and owners. Use for legal audits, compliance audits, regulatory audits, compliance gap analyses, risk assessments, audit report summaries, or remediation roadmaps. Trigger keywords: audit summary, compliance findings, audit report, risk prioritization, remediation plan, regulatory exposure, corrective action plan.

Reference for SOC 2, PCI-DSS, HIPAA, and GDPR compliance requirements, including control checklists, evidence collection, and audit preparation guidance.

Run security audits, vulnerability scans, compliance checks, and incident response workflows for application security.

Expert SOC 2 compliance assistant covering all five Trust Services Criteria (Security/CC, Availability/A, Confidentiality/C, Processing Integrity/PI, Privacy/P). Use this skill whenever a user mentions SOC 2, Trust Services Criteria, SOC 2 Type 1 or Type 2, audit readiness, compliance gaps, control documentation, evidence collection, vendor risk questionnaires, or anything related to AICPA service organization controls. Trigger even for adjacent topics like "we need to get audited", "a customer asked for our security report", "writing an information security policy", or "preparing for an audit". Covers gap analysis, policy writing, control documentation, audit evidence preparation, and vendor risk reviews for organizations at any maturity level — from first-time startups to seasoned compliance teams.

Routes compliance requests to the appropriate regulatory and quality-management skill among 15 bundled options, covering ISO 13485, EU MDR, FDA submissions, ISO 14971, CAPA, document control, ISO 27001, ISO 42001, EU AI Act, GDPR, SOC 2, and auditing.

Enforces OWASP Top 10:2025 compliance on code touching security-relevant domains, using cached cheat sheets and verifying fixes against OSV.dev.

Expert PCI DSS compliance advisor covering PCI DSS v4.0.1 (current) and v4.0. Use this skill whenever a user asks about PCI DSS, payment card security, cardholder data protection, CDE scoping, SAQ types (A, A-EP, B, B-IP, C, C-VT, P2PE, D), ROC, AOC, QSA assessments, ASV scans, merchant levels, service provider levels, network segmentation, penetration testing, tokenisation, encryption of PAN data, or any of the 12 PCI DSS requirements. Also trigger for questions like "are we PCI compliant?", "how do I scope my CDE?", "which SAQ applies to us?", "what changed in PCI DSS v4.0?", "how do I prepare for a QSA audit?", or any request involving payment data security, cardholder data environment, or PCI certification readiness.

Use to check that required disclosures, consents and notices were actually given in support conversations — the right wording, at the right point, through a channel the customer could act on. Trigger for "did we give the required disclosure", "are we capturing consent properly", "recording notification audit", "check our mandatory notices", disclosure compliance, or a complaint that a customer was not told something.

Applies the Sarbanes-Oxley Act to assess financial-reporting integrity and IT general controls, mapping executive certification and internal-control areas to auditable evidence for public companies.

Draft a detailed privacy policy covering data types, jurisdiction, GDPR and compliance considerations, and clauses needing legal review.

Expert ISO 27001 compliance assistant for security and compliance teams. Use this skill whenever a user asks about ISO 27001 or ISO/IEC 27001, including any of the following: gap analysis, auditing, compliance assessments, control checklists, policy writing, document generation, Statement of Applicability (SoA), risk assessment, risk registers, risk treatment plans, Annex A controls, ISMS implementation, clause requirements, certification readiness, transitioning from 2013 to 2022, control implementation guidance, incident response policies, access control policies, supplier security, or any information security management system (ISMS) topic. Trigger even if the user doesn't say "skill" — any ISO 27001 or ISMS question should use this skill.

Verify a completed implementation against the original instructions, a declarative source document, an issue brief, or an optional MoonSpec feature packet, plus AGENTS.md repo guidance and required tests. Use when the user asks to run or reproduce `/moonspec.verify`, perform a final read-only implementation check, audit unit and integration test evidence, classify requirement coverage, or decide whether more code or test work is needed.

Guides HIPAA-specific healthcare privacy and security work, routing to implementation and review skills with decision gates and guardrails.

Scans codebases for GDPR/DSGVO compliance issues, generates DPIA documentation, and tracks data subject rights requests with deadline management.