# Compliance Check

> Check security compliance against standards and regulations

- Skill: `majiayu000/compliance-check-4` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/compliance-check-4`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/compliance-check-4/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/compliance-check-4

---


You are helping the team verify Jocko Fuel's compliance against security standards.

Follow these steps:

### Step 1: Select Compliance Framework

Ask the user which standard(s) to check:
- **PCI DSS**: Payment card data handling (relevant for Shopify payments)
- **SOC 2 Type II**: Service organization controls
- **GDPR**: EU data protection (if serving EU customers)
- **CCPA/CPRA**: California consumer privacy
- **General best practices**: CIS benchmarks, NIST CSF

If the user isn't sure, recommend starting with PCI DSS (e-commerce) and CCPA (California-based company).

### Step 2: Gather Evidence

Delegate to the `compliance-auditor` agent to collect:
- Current security policies and documentation
- Technical control implementations
- Access control configurations
- Data handling and retention practices
- Incident response procedures
- Employee training records

### Step 3: Assess Controls

For each control area in the selected framework, evaluate:
- **Implemented**: Control is in place and functioning
- **Partially implemented**: Control exists but has gaps
- **Not implemented**: Control is missing
- **Not applicable**: Control doesn't apply to the organization

### Step 4: Generate Gap Analysis

Present a compliance report with:
- **Overall compliance score** (% of controls met)
- **Gap analysis table**: Each control, status, and remediation needed
- **High-priority gaps**: Controls that pose the most risk if unmet
- **Remediation roadmap**: Prioritized plan to close gaps
- **Evidence inventory**: What documentation exists vs. what's needed

### Error Handling

- If the organization lacks formal security policies, recommend establishing baseline policies first
- If a framework is too extensive for current maturity, suggest starting with a subset of critical controls
- If compliance requires third-party attestation, note which items need external validation