How do I install the Compliance Frameworks skill?

Run npx skillmds@latest add tomevault-io/compliance-frameworks in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Compliance Frameworks safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Compliance Frameworks?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Compliance Frameworks free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Compliance Frameworks?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Compliance Frameworks by tomevault-io

Name: Compliance Frameworks
Author: tomevault-io

Compliance Frameworks

Security and privacy compliance patterns for B2B SaaS (SOC 2, GDPR). Use for audit preparation, control design, compliance gap analysis, or building compliance into features. Use when this capability is needed.

tomevault-io 32d4547 2 files · 3.6 KB Updated Sep 17, 2026

File contents

Compliance Frameworks Skill

Security and privacy compliance patterns for B2B SaaS products.

When to Use

Preparing for SOC 2 Type II audit
Implementing GDPR data handling requirements
Conducting compliance gap analysis
Designing controls for audit evidence
Building compliance into new features

Quick Reference

SOC 2 Trust Principles

Principle	Key Controls	Priority
Security	Access control, encryption, monitoring	Required
Availability	Uptime SLAs, redundancy, backups	Required
Processing Integrity	Input validation, error handling	Conditional
Confidentiality	Data classification, encryption	Common
Privacy	Consent, access requests, retention	If PII handled

GDPR Rights (Data Subject)

Right	Implementation	Response Time
Access	Data export endpoint	30 days
Erasure	Deletion workflow	30 days
Rectification	Edit profile	Reasonable
Portability	Machine-readable export	30 days
Objection	Opt-out mechanisms	Immediate

Common Control Categories

Category	Examples
Preventive	Access controls, input validation, encryption
Detective	Audit logging, anomaly detection, SIEM
Corrective	Incident response, patching, rollback

Key Patterns

Control Design

Risk Identification → Control Selection → Implementation → Evidence Collection → Audit

Evidence Types

Type	Examples
Documentation	Policies, procedures, diagrams
Configuration	Terraform, IAM policies, firewall rules
Logs	Audit trails, access logs, change records
Screenshots	Dashboard configs, settings, approvals

Integration with Development

PR Checklist (Security-Sensitive Changes)

No hardcoded secrets
Access controls implemented
Audit logging added
Input validation present
Error messages sanitized

Compliance by Design

Build compliance into features from the start:

Data Classification - What data is being handled?
Access Control - Who can access it?
Audit Trail - What operations are logged?
Retention - How long is data kept?
Deletion - How is data removed?

Files

reference.md - Detailed checklists, control mappings
examples.md - Implementation patterns, evidence templates

Converted and distributed by TomeVault — claim your Tome and manage your conversions.

---name: compliance-frameworksdescription: Security and privacy compliance patterns for B2B SaaS (SOC 2, GDPR). Use for audit preparation, control design, compliance gap analysis, or building compliance into features. Use when this capability is needed.---# Compliance Frameworks SkillSecurity and privacy compliance patterns for B2B SaaS products.## When to Use- Preparing for SOC 2 Type II audit- Implementing GDPR data handling requirements- Conducting compliance gap analysis- Designing controls for audit evidence- Building compliance into new features## Quick Reference### SOC 2 Trust Principles| Principle | Key Controls | Priority ||-----------|--------------|----------|| **Security** | Access control, encryption, monitoring | Required || **Availability** | Uptime SLAs, redundancy, backups | Required || **Processing Integrity** | Input validation, error handling | Conditional || **Confidentiality** | Data classification, encryption | Common || **Privacy** | Consent, access requests, retention | If PII handled |### GDPR Rights (Data Subject)| Right | Implementation | Response Time ||-------|----------------|---------------|| Access | Data export endpoint | 30 days || Erasure | Deletion workflow | 30 days || Rectification | Edit profile | Reasonable || Portability | Machine-readable export | 30 days || Objection | Opt-out mechanisms | Immediate |### Common Control Categories| Category | Examples ||----------|----------|| **Preventive** | Access controls, input validation, encryption || **Detective** | Audit logging, anomaly detection, SIEM || **Corrective** | Incident response, patching, rollback |## Key Patterns### Control Design```Risk Identification → Control Selection → Implementation → Evidence Collection → Audit```### Evidence Types| Type | Examples ||------|----------|| **Documentation** | Policies, procedures, diagrams || **Configuration** | Terraform, IAM policies, firewall rules || **Logs** | Audit trails, access logs, change records || **Screenshots** | Dashboard configs, settings, approvals |## Integration with Development### PR Checklist (Security-Sensitive Changes)- [ ] No hardcoded secrets- [ ] Access controls implemented- [ ] Audit logging added- [ ] Input validation present- [ ] Error messages sanitized### Compliance by DesignBuild compliance into features from the start:1. **Data Classification** - What data is being handled?2. **Access Control** - Who can access it?3. **Audit Trail** - What operations are logged?4. **Retention** - How long is data kept?5. **Deletion** - How is data removed?## Files- `reference.md` - Detailed checklists, control mappings- `examples.md` - Implementation patterns, evidence templates---> Converted and distributed by [TomeVault](https://tomevault.io/claim/ai-enhanced-engineer) — claim your Tome and manage your conversions.

Frequently asked questions