mirror of https://github.com/alirezarezvani/claude-skills.git synced 2026-08-28 04:24:58 +00:00

feat(compliance-os): multi-framework meta-orchestrator for compliance teams

Stream A Phase 1 — Plugin 3 of 3 (compliance OS MVP).

Top-level peer of ra-qm-team/ that orchestrates the 14 ra-qm-team skills
plus the two new compliance-team-* plugins (iso42001 + eu-ai-act).

Four stdlib Python tools:
- framework_selector.py: company profile -> applicable frameworks across all 9
  (ISO 27001, 13485, 42001, 14971, EU AI Act, MDR 745, GDPR, SOC 2, FDA QSR)
  with binding-vs-certifiable priority + dependency graph
- cross_framework_mapper.py: 19 merged control themes covering access, asset,
  risk, supplier, incident, logging, change, BCP, training, data, audit, mgmt
  review, crypto, secure SDLC, vuln, physical, privacy, document control, CAPA;
  HIGH/MED/LOW confidence per framework; >= 30 atomic 27001<->SOC 2 mappings
- audit_simulator.py: 10 finding scenarios per scope with IIA-target severity
  distribution (60% observation, 0% critical for embedded sample = healthy);
  3-5 interview questions per scoped control + document-review requests
- evidence_pool_generator.py: 15 curated artefacts with reuse-leverage scoring
  (100 total (framework, control) satisfactions in embedded sample)

Four references each citing 5+ authoritative sources:
- compliance_os_pattern.md: meta-framework architecture + IMS pattern
- cross_framework_overlap.md: 9-framework control-family overlap matrix
- audit_simulation_methodology.md: ISO 19011 + IIA IPPF + AICPA AT-C principles
- evidence_management.md: reuse-leverage + retention + freshness + storage

Three cs-* persona agents:
- cs-compliance-officer: multi-framework orchestrator
- cs-aims-iso42001: ISO 42001 AIMS implementation operator
- cs-ai-act-compliance: EU AI Act Article-cited compliance operator

Three /cs:* slash commands (sub-skill pattern):
- /cs:compliance-readiness: 6-question multi-framework forcing interrogation
- /cs:aims-audit: 6-question ISO 42001 internal-audit interrogation
- /cs:ai-act-readiness: 6-question EU AI Act readiness interrogation

Two JSON asset templates for tool inputs.

Karpathy gate: complexity_checker 100/100 (0 findings).

Phase 1 success criteria all met:
- framework_selector: AI SaaS profile -> 5 frameworks (GDPR/AI Act binding + 27001/SOC2/42001 cert)
- cross_framework_mapper: 19 merged controls, 16 HIGH-confidence 27001+SOC2 pair themes, 51 atomic 27001 + 34 atomic SOC2 citations
- audit_simulator: 10 findings, 60% observation, 0% critical = healthy distribution
- evidence_pool: 15 artefacts, 100 total satisfactions, 11 high-leverage (>= 5 mappings)

https://claude.ai/code/session_01VFreMf7XLBqMgjsrG4wSYe

2026-05-13 17:48:33 +00:00

3.5 KiB

Raw Blame History

compliance-os

Compliance OS — a meta-orchestrator for multi-framework compliance programs. Configure which frameworks apply; compute overlap; simulate audits; consolidate evidence across frameworks.

What this is

Most compliance teams run multiple frameworks in parallel: ISO 27001 + SOC 2 for security, ISO 13485 + FDA QSR for medical devices, ISO 42001 + EU AI Act for AI, GDPR + sector privacy law for personal data. Each framework lives in its own skill (we have 14 existing ra-qm-team skills + 2 new compliance-team-* plugins for ISO 42001 and EU AI Act).

But teams need:

A way to configure which of the 9 frameworks apply per company profile
Cross-framework overlap — many controls are the same across frameworks; one piece of evidence often satisfies multiple
Audit simulation — practice internal audits before the real ones
Unified evidence pool — collect evidence once, satisfy multiple frameworks

Compliance OS provides exactly that. Four stdlib Python tools + 4 in-depth references + 3 cs-* personas + 3 /cs:* commands.

Supported frameworks (9)

ID	Framework	Companion skill
ISO 27001	Info security ISMS	`ra-qm-team/skills/information-security-manager-iso27001/` + `isms-audit-expert/`
ISO 13485	Medical device QMS	`ra-qm-team/skills/quality-manager-qms-iso13485/` + `qms-audit-expert/`
ISO 42001	AI Management System	`ra-qm-team/skills/iso42001-specialist/` (new)
ISO 14971	Medical device risk mgmt	`ra-qm-team/skills/risk-management-specialist/`
EU AI Act	Regulation (EU) 2024/1689	`ra-qm-team/skills/eu-ai-act-specialist/` (new)
EU MDR 745	Medical device regulation	`ra-qm-team/skills/mdr-745-specialist/`
GDPR	Data protection	`ra-qm-team/skills/gdpr-dsgvo-expert/`
SOC 2	Trust services criteria	`ra-qm-team/skills/soc2-compliance/`
FDA QSR	21 CFR 820	`ra-qm-team/skills/fda-consultant-specialist/`

Quick start

# Configure which frameworks apply for your company
python skills/compliance-os/scripts/framework_selector.py

# Compute overlap between selected frameworks
python skills/compliance-os/scripts/cross_framework_mapper.py

# Simulate an internal audit
python skills/compliance-os/scripts/audit_simulator.py

# Generate unified evidence checklist
python skills/compliance-os/scripts/evidence_pool_generator.py

All four tools run with embedded samples if no JSON is provided. All use stdlib only.

Slash commands

Command	Purpose
`/cs:compliance-readiness`	6-question forcing interrogation for compliance program readiness
`/cs:aims-audit`	6-question forcing interrogation specific to ISO 42001 internal audit
`/cs:ai-act-readiness`	6-question forcing interrogation specific to EU AI Act compliance

cs-* persona agents

Agent	Voice
`cs-compliance-officer`	Multi-framework orchestrator. "Which frameworks apply, and where do they overlap?"
`cs-aims-iso42001`	AIMS implementation operator. "What's the gap against Clauses 4-10?"
`cs-ai-act-compliance`	EU AI Act Article-cited operator. "What's the risk tier per Article 6?"

What this is NOT

NOT executive AI/risk strategy. For board-level AI / data / risk decisions, see c-level-advisor/.
NOT a replacement for the per-framework skills. This orchestrates them. The per-framework skills do the deep work.
NOT a binding legal opinion. Cross-framework mappings reflect published guidance; novel cases need outside counsel.

License

MIT.

3.5 KiB Raw Blame History