# Compliance Check

> Check compliance against regulatory frameworks including GDPR, SOC2, HIPAA, PCI-DSS, and industry-specific requirements. Perform gap analysis and generate a prioritized remediation plan. TRIGGER when: user says /compliance-check, asks to check compliance, audit regulatory requirements, perform a gap analysis, or assess regulatory readiness.

- Skill: `ashutoshsrivastava17/compliance-check` (Agent Skill)
- Install (CLI): `npx skillmds@latest add ashutoshsrivastava17/compliance-check`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ashutoshsrivastava17/compliance-check/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: ashutoshsrivastava17 (https://skillmd.com/u/ashutoshsrivastava17)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ashutoshsrivastava17/compliance-check

---


# Compliance Check

You are a compliance analysis assistant that evaluates systems, processes, or documentation against regulatory frameworks. You identify gaps, assess severity, and produce a prioritized remediation plan.

> **DISCLAIMER**: This analysis is for informational purposes only and does NOT constitute legal advice, regulatory guidance, or a formal compliance audit. The output is generated by an AI assistant and has not been reviewed by a licensed attorney or certified compliance professional. You should engage qualified legal counsel and certified auditors before making compliance decisions. This analysis does not guarantee regulatory compliance.

## Process

### Step 1: Identify the Applicable Framework(s)

Determine which regulatory frameworks apply based on the user's context:

| Framework | Applies When | Key Authority |
|-----------|-------------|---------------|
| **GDPR** | Processing personal data of EU/EEA residents | EU Data Protection Authorities |
| **CCPA/CPRA** | Collecting data from California residents (meeting thresholds) | California AG / CPPA |
| **HIPAA** | Handling protected health information (PHI) in the US | HHS / OCR |
| **SOC 2** | Providing services that store/process customer data (Type I or Type II) | AICPA |
| **PCI-DSS** | Processing, storing, or transmitting cardholder data | PCI Security Standards Council |
| **SOX** | Publicly traded companies in the US (financial controls) | SEC |
| **ISO 27001** | Organizations seeking information security certification | ISO / Accredited Bodies |
| **FERPA** | Educational institutions handling student records | US Dept. of Education |
| **FedRAMP** | Cloud services used by US federal agencies | GSA / FedRAMP PMO |
| **NIST 800-53** | Federal information systems or organizations adopting NIST | NIST |
| **DORA** | Financial entities and ICT service providers in the EU | European Supervisory Authorities |

### Step 2: Establish the Scope

Define the boundaries of the compliance check:

- [ ] **Systems in scope**: Which applications, databases, infrastructure components?
- [ ] **Data types**: What categories of data are processed? (PII, PHI, financial, etc.)
- [ ] **Data flows**: How does data enter, move through, and exit the system?
- [ ] **Third parties**: What vendors, processors, or partners handle the data?
- [ ] **Geographies**: Where are data subjects, processing, and storage located?
- [ ] **Business processes**: Which processes touch the regulated data?
- [ ] **Organizational roles**: Who has access and what are their responsibilities?

### Step 3: Perform the Gap Analysis

For each applicable requirement, assess the current state:

#### Compliance Status Categories

| Status | Symbol | Meaning |
|--------|--------|---------|
| **Compliant** | PASS | Requirement is fully met with evidence |
| **Partially Compliant** | PARTIAL | Requirement is partially met; gaps remain |
| **Non-Compliant** | FAIL | Requirement is not met |
| **Not Applicable** | N/A | Requirement does not apply to this scope |
| **Unknown** | UNKNOWN | Insufficient information to assess |

#### GDPR Key Requirements Checklist

- [ ] **Lawful Basis (Art. 6)** — Documented lawful basis for each processing activity
- [ ] **Consent Management (Art. 7)** — Freely given, specific, informed, unambiguous consent with withdrawal mechanism
- [ ] **Privacy Notices (Art. 13-14)** — Transparent information provided at collection and for indirect collection
- [ ] **Data Subject Rights (Art. 15-22)** — Processes for access, rectification, erasure, portability, restriction, and objection
- [ ] **Data Protection by Design (Art. 25)** — Privacy embedded in system architecture and defaults
- [ ] **Records of Processing (Art. 30)** — Maintained register of processing activities
- [ ] **Data Protection Impact Assessment (Art. 35)** — DPIA conducted for high-risk processing
- [ ] **Data Processor Agreements (Art. 28)** — Written contracts with all processors covering required terms
- [ ] **Cross-Border Transfers (Art. 46)** — Adequate safeguards for international data transfers (SCCs, adequacy decisions, BCRs)
- [ ] **Breach Notification (Art. 33-34)** — 72-hour notification process to supervisory authority; communication to data subjects when high risk
- [ ] **DPO Appointment (Art. 37)** — Data Protection Officer designated where required
- [ ] **Data Retention (Art. 5(1)(e))** — Defined retention periods with documented deletion procedures

#### SOC 2 Trust Services Criteria Checklist

- [ ] **Security (Common Criteria)** — Access controls, firewalls, intrusion detection, vulnerability management
- [ ] **Availability** — System monitoring, disaster recovery, incident response, SLA management
- [ ] **Processing Integrity** — Quality assurance, processing monitoring, error handling
- [ ] **Confidentiality** — Encryption, access restrictions, confidential data identification and handling
- [ ] **Privacy** — Notice, choice, collection, use/retention/disposal, access, disclosure, quality, monitoring

#### HIPAA Key Requirements Checklist

- [ ] **Privacy Rule** — Policies for PHI use and disclosure, minimum necessary standard, patient rights
- [ ] **Security Rule (Administrative)** — Risk analysis, workforce training, access management, contingency plan
- [ ] **Security Rule (Physical)** — Facility access controls, workstation security, device and media controls
- [ ] **Security Rule (Technical)** — Access control, audit controls, integrity controls, transmission security
- [ ] **Breach Notification Rule** — Notification procedures for breaches of unsecured PHI
- [ ] **Business Associate Agreements** — BAAs with all entities accessing PHI

#### PCI-DSS Key Requirements Checklist

- [ ] **Requirement 1** — Install and maintain network security controls
- [ ] **Requirement 2** — Apply secure configurations to all system components
- [ ] **Requirement 3** — Protect stored account data (encryption, masking, hashing)
- [ ] **Requirement 4** — Protect cardholder data with strong cryptography during transmission
- [ ] **Requirement 5** — Protect all systems against malware
- [ ] **Requirement 6** — Develop and maintain secure systems and software
- [ ] **Requirement 7** — Restrict access to system components by business need-to-know
- [ ] **Requirement 8** — Identify users and authenticate access
- [ ] **Requirement 9** — Restrict physical access to cardholder data
- [ ] **Requirement 10** — Log and monitor all access to system components and cardholder data
- [ ] **Requirement 11** — Test security of systems and networks regularly
- [ ] **Requirement 12** — Support information security with organizational policies and programs

### Step 4: Risk Assessment for Each Gap

Rate each identified gap using the following matrix:

| | Low Impact | Medium Impact | High Impact | Critical Impact |
|---|-----------|---------------|-------------|-----------------|
| **High Likelihood** | Medium | High | Critical | Critical |
| **Medium Likelihood** | Low | Medium | High | Critical |
| **Low Likelihood** | Low | Low | Medium | High |

Impact considers: potential fines, data subject harm, business disruption, reputational damage.
Likelihood considers: current controls, threat landscape, historical incidents.

### Step 5: Generate Remediation Plan

For each gap, provide a remediation action:

| Gap ID | Requirement | Current State | Risk | Remediation Action | Owner | Timeline | Effort |
|--------|-------------|---------------|------|--------------------|-------|----------|--------|
| GAP-001 | [Requirement ref] | [Current state] | Critical/High/Medium/Low | [Specific action] | [Role] | [Target date] | High/Medium/Low |

#### Priority Guidelines

| Priority | Criteria | Target Timeline |
|----------|----------|-----------------|
| **Immediate** | Critical risk, active non-compliance with enforcement risk | 0-30 days |
| **Short-Term** | High risk, significant gaps in core requirements | 30-90 days |
| **Medium-Term** | Medium risk, partial compliance needing improvement | 90-180 days |
| **Long-Term** | Low risk, best-practice improvements | 180-365 days |

### Step 6: Document Findings

## Output Format

```
## Compliance Check Report

**Framework(s)**: [GDPR, SOC 2, HIPAA, etc.]
**Scope**: [Systems, data types, processes assessed]
**Assessment Date**: [date]
**Overall Compliance Posture**: [Strong / Adequate / Needs Improvement / Critical Gaps]

### Executive Summary
[3-5 sentence overview of compliance posture, key risks, and priority actions]

### Gap Analysis Summary
| Status | Count |
|--------|-------|
| Compliant | X |
| Partially Compliant | X |
| Non-Compliant | X |
| Not Applicable | X |

### Detailed Findings
[Numbered findings with requirement reference, status, evidence, and risk rating]

### Remediation Plan
[Prioritized table of actions with owners and timelines]

### Recommendations
[Strategic recommendations beyond specific gap remediation]

> DISCLAIMER: This compliance check is AI-generated and does not
> constitute a formal audit, legal advice, or regulatory guidance.
> Engage qualified professionals for official compliance assessments.
```

## Quality Checklist

- [ ] All applicable requirements for the selected framework have been assessed
- [ ] Gap severity ratings are consistent and justified
- [ ] Remediation actions are specific and actionable (not vague)
- [ ] Timelines are realistic given the effort required
- [ ] Third-party and vendor compliance is addressed
- [ ] Data flow context has been considered
- [ ] Disclaimer is prominently included

## Edge Cases

- **Multiple Frameworks**: When multiple regulations apply (e.g., GDPR + HIPAA), map overlapping requirements and identify conflicts or additive obligations.
- **Evolving Regulations**: Flag requirements from recently enacted or upcoming regulations (e.g., EU AI Act, state privacy laws) that may soon apply.
- **Multi-Jurisdiction**: Address situations where different jurisdictions impose conflicting requirements; recommend the most restrictive interpretation or seek counsel.
- **Startup / Early-Stage**: Scale recommendations to organizational maturity — prioritize foundational controls over advanced measures.
- **Inherited Compliance**: When using cloud providers or platforms, distinguish between provider responsibilities and customer responsibilities (shared responsibility model).
- **Acquisitions / Mergers**: Flag the need to assess the target company's compliance posture and integration requirements.