Testing Compliance

!bash ~/.claude/hooks/sweetclaude/record-event.sh skill_invoked "sweetclaude:testing-compliance" 2>/dev/null || true

!cat .sweetclaude/state/session-state.yaml 2>/dev/null || echo "STATE_NOT_FOUND"

COMPLIANCE_FILE="$PWD/.sweetclaude/state/compliance.yaml"
cat "$COMPLIANCE_FILE" 2>/dev/null || echo "COMPLIANCE_NOT_FOUND"

# Security planning state (from security-planning skill if run)
cat "$PWD/.sweetclaude/state/security-planning.yaml" 2>/dev/null | python3 -c "
import yaml, sys
d = yaml.safe_load(sys.stdin)
standards = d.get('applicable_standards', [])
print(f'PLANNED_STANDARDS={standards}')
" 2>/dev/null || echo "PLANNED_STANDARDS=[]"

Testing Compliance

Track compliance control status, log evidence, and surface gaps. Arguments: $ARGUMENTS

Routing

Valid standard names: soc2, hipaa, gdpr, pci_dss

Status

Use COMPLIANCE_NOT_FOUND or compliance state from shell block.

If COMPLIANCE_NOT_FOUND: "No compliance tracking initialized. Run testing-compliance init <standard> to start."

Otherwise present:

Compliance Status
══════════════════════════════════════════════════

SOC 2 (Security TSC)
  Tested:           12 / 34 controls
  Evidence logged:   9 / 12 tested
  Gaps:              3 controls with no mitigation

GDPR
  Tested:            6 / 18 controls
  Evidence logged:   4 / 6 tested
  Gaps:              7 controls not started

Init

Arguments: init <standard>

Ask: "Which Trust Service Categories / modules apply?"

SOC 2: Security (required) + optional: Availability, Processing Integrity, Confidentiality, Privacy

HIPAA: Administrative Safeguards, Physical Safeguards, Technical Safeguards

GDPR: Lawful Basis & Consent, Data Subject Rights, Data Minimization, Security & Breach, DPO & Documentation, International Transfers

PCI-DSS: All 12 requirements (ask which apply based on card data scope)

Load the control set for the selected modules. Write to compliance.yaml:

python3 - <<'PYEOF'
import yaml
from datetime import datetime

# Load existing or create new
try:
    with open('.sweetclaude/state/compliance.yaml') as f:
        state = yaml.safe_load(f) or {}
except FileNotFoundError:
    state = {'schema_version': 1, 'standards': {}}

# Add new standard with controls
# <standard> and controls populated from control catalog below
state['standards']['<standard>'] = {
    'initialized_at': datetime.now(timezone.utc).isoformat(timespec='seconds'),
    'modules': ['<selected modules>'],
    'controls': {
        '<control-id>': {
            'title': '<control title>',
            'status': 'not_started',
            'evidence': [],
            'notes': None
        }
        # ... all controls
    }
}

with open('.sweetclaude/state/compliance.yaml', 'w') as f:
    yaml.dump(state, f, default_flow_style=False, allow_unicode=True)
print('ok')
PYEOF

Confirm: Initialized {standard} — {N} controls loaded

Control Catalogs

SOC 2 — Security TSC (CC series, key controls)

HIPAA — Technical Safeguards (key controls)

GDPR — Key controls

Assess

Arguments: assess <standard>

Load controls from compliance.yaml. For each control not yet tested or not_applicable:

Present one control at a time:

─────────────────────────────────────────
Control CC6.1 — Logical access security

  Authentication implemented for all user-facing systems.

  Status:  not_started

  Questions to assess:
    1. Is authentication required for all access to protected resources?
    2. What authentication mechanism is in use?
    3. Is there a password policy or equivalent?
    4. Are privileged accounts using stronger controls (MFA)?

Wait for user response. Classify result:

• Pass — control is implemented, evidence exists or can be collected
• Partial — control partially implemented, gaps identified
• Gap — control not implemented, risk accepted or remediation needed
• N/A — control does not apply (must give reason)

python3 - <<'PYEOF'
import yaml
from datetime import datetime

with open('.sweetclaude/state/compliance.yaml') as f:
    state = yaml.safe_load(f)

state['standards']['<standard>']['controls']['<control-id>']['status'] = '<pass|partial|gap|na>'
state['standards']['<standard>']['controls']['<control-id>']['notes'] = '<assessment notes>'
state['standards']['<standard>']['controls']['<control-id>']['assessed_at'] = datetime.now(timezone.utc).isoformat(timespec='seconds')

with open('.sweetclaude/state/compliance.yaml', 'w') as f:
    yaml.dump(state, f, default_flow_style=False, allow_unicode=True)
print('ok')
PYEOF

For gap status: ask "File a remediation issue?" On yes — create a project issue:

_sc_hooks="${CLAUDE_PLUGIN_ROOT:+${CLAUDE_PLUGIN_ROOT}/hooks}"; _sc_hooks="${_sc_hooks:-$HOME/.claude/hooks/sweetclaude}"; source "${_sc_hooks}/sc-artifact.sh"
sc_artifact_create issue '{
  "title": "Compliance gap: <control title>",
  "type": "story",
  "status": "backlog",
  "priority": "sooner",
  "description": "<gap description and remediation approach>",
  "tags": ["compliance", "<standard>", "<control-id>"]
}'

Log Evidence

Arguments: log <control-id>

Ask:

1. "What evidence exists for this control? (description)"
2. "Where is it stored? (file path, URL, or description)"
3. "Date of evidence?"

python3 - <<'PYEOF'
import yaml
from datetime import datetime

with open('.sweetclaude/state/compliance.yaml') as f:
    state = yaml.safe_load(f)

# Find the control across all standards
for std_name, std_data in state['standards'].items():
    if '<control-id>' in std_data.get('controls', {}):
        ctrl = std_data['controls']['<control-id>']
        if 'evidence' not in ctrl:
            ctrl['evidence'] = []
        ctrl['evidence'].append({
            'description': '<description>',
            'location': '<location>',
            'date': '<date>',
            'logged_at': datetime.now(timezone.utc).isoformat(timespec='seconds')
        })
        break

with open('.sweetclaude/state/compliance.yaml', 'w') as f:
    yaml.dump(state, f, default_flow_style=False, allow_unicode=True)
print('ok')
PYEOF

Confirm: Evidence logged for <control-id>

Report

Generate a gap report for all initialized standards.

Compliance Gap Report — {date}
══════════════════════════════════════════════════

SOC 2 — Security TSC
  Pass:           18 controls
  Partial:         4 controls
  Gap:             3 controls
  Not applicable:  5 controls
  Not assessed:    4 controls

  Gaps requiring remediation:
    CC7.1  Vulnerability scanning — no automated scan in place
    CC9.2  Vendor risk management — no vendor review process
    CC8.1  Change management — deploys not logged or reviewed

  Partial controls:
    CC6.1  Authentication — MFA not enforced for admin accounts
    ...

GDPR
  ...

Open remediation issues: {N}
  I-042  Compliance gap: CC7.1 Vulnerability scanning    priority: sooner
  I-043  Compliance gap: CC9.2 Vendor risk management    priority: later

If saving: write to .sweetclaude/testing/compliance-report-{date}.md.

Rules

• Gaps must have a remediation issue or a documented risk acceptance. Neither is optional — "we know about it" is not a status.
• N/A requires a documented reason. Challenge N/A on controls that seem applicable.
• Evidence location is required for pass controls at audit time. Prompt for it if missing.
• Compliance state is sensitive. It lives in .sweetclaude/state/ — always private, never committed to public repos.
• This skill supports compliance preparation — it does not constitute a formal audit. Always confirm with a qualified auditor before making compliance claims to customers.