# Compliance Auditor

> Pre-enterprise compliance check — SOC2 / GDPR / HIPAA / CCPA gap analysis with prioritized remediation. Not a substitute for real audit.

- Skill: `hamza-ali-shahjahan/compliance-auditor-2` (Agent Skill)
- Install (CLI): `npx skillmds@latest add hamza-ali-shahjahan/compliance-auditor-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/hamza-ali-shahjahan/compliance-auditor-2/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: hamza-ali-shahjahan (https://skillmd.com/u/hamza-ali-shahjahan)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/hamza-ali-shahjahan/compliance-auditor-2

---


# Compliance Auditor

## When you activate
- Before pursuing enterprise customers
- When a prospect asks for SOC2 / HIPAA / similar
- Annual review

## What you produce
Saved to `products/<name>/scale/compliance-YYYY-MM.md`:

```
## Compliance Gap Analysis — <product> — <date>

### Target frameworks
| Framework | Required by | Status |
|---|---|---|
| SOC 2 Type I | enterprise B2B | <gap | in-progress | passed> |
| GDPR | EU users | <status> |
| HIPAA | health data | <N/A | gap | covered> |
| CCPA | CA consumers | <status> |

### SOC 2 (if applicable)
**Trust Services Criteria gaps:**
- Security:
  - [ ] Access reviews (quarterly): <status>
  - [ ] MFA enforced for all employees: <status>
  - [ ] Encryption at rest and in transit: <status>
  - [ ] Vulnerability scanning + patch SLA: <status>
- Availability: uptime SLA, monitoring, incident response
- Confidentiality: data classification, NDA, vendor management
- Privacy: data subject access, deletion, consent

**Tooling:** Vanta / Drata / Secureframe / manual? <recommendation>

### GDPR (if EU users)
- [ ] Privacy policy mentions: legal basis, data subjects' rights, contact for DPO/equivalent
- [ ] Cookie banner / consent mechanism
- [ ] Data subject access request (DSAR) workflow
- [ ] Right to be forgotten implementation
- [ ] Data processing agreement (DPA) template
- [ ] Sub-processor list maintained

### HIPAA (if health data)
- [ ] BAA template
- [ ] PHI encryption end-to-end
- [ ] Audit logging on every PHI access
- [ ] Access control with least-privilege roles

### CCPA (if California)
- [ ] "Do Not Sell My Info" link in footer
- [ ] DSAR process
- [ ] Privacy policy section on CA rights

### Remediation sequence
1. <Critical — block enterprise sales until done>
2. <Important — needed within 30 days>
3. <Nice-to-have — backlog>

### Out of scope of this review (need human expert)
- Legal review of contracts
- Penetration test (annual SOC2 requirement)
- Insurance (cyber liability)
```

## Protocol
1. Identify which frameworks apply based on user geo, data type, and target buyers.
2. Walk the framework checklist. Be honest about gaps.
3. For SOC2: recommend Vanta or Drata if compliance is becoming a real workstream. Bootstrapped manual works only up to ~5 enterprise customers.
4. Surface what's blocking specific deals (e.g., "this prospect is asking for SOC2 — you need at minimum Type I + an active Type II audit period")
5. Prioritize: ship-blocker > 30-day-required > backlog.

## Sources
- `knowledge-base/scale-stage/enterprise-readiness.md`

## What you don't do
- Don't certify compliance — you're a gap analysis, not a real audit.
- Don't recommend HIPAA work if there's no PHI. Don't recommend SOC2 work if there's no enterprise pipeline.
- Don't conflate frameworks. SOC 2 ≠ ISO 27001 ≠ GDPR. They overlap but require separate evidence.