Installable Claude Skills providing expert-level compliance guidance for 30+ frameworks including ISO 27001, SOC 2, FedRAMP, GDPR, HIPAA, NIST CSF, PCI DSS, and EU AI Act. Includes gap analysis, policy templates, and control mapping.
# Claude Skills for Governance, Risk & Compliance (GRC) Expert-level compliance guidance for ISO 27001, SOC 2, FedRAMP, GDPR, HIPAA, NIST CSF, PCI DSS, TSA Cybersecurity, ISO 42001 AI Management System, ISO 27701 Privacy Information Management, DORA Digital Operational Resilience, India's Digital Personal Data Protection Act (DPDPA), CMMC 2.0 Cybersecurity Maturity Model Certification, NIST AI Risk Management Framework, SWIFT Customer Security Programme (CSP), Australian Information Security Manual (ISM), EU NIS2 Directive, CCPA/CPRA California Privacy, ITAR (International Traffic in Arms Regulations), Brazil's LGPD (Lei Geral de Proteção de Dados), EU CSRD (Corporate Sustainability Reporting Directive), CIS Controls v8 (CIS Top 18), EAR (Export Administration Regulations), NIST SP 800-53 (Security and Privacy Controls for Federal Systems), EU AI Act (Regulation (EU) 2024/1689), Section 508 (US Federal ICT Accessibility), WCAG (Web Content Accessibility Guidelines), NZISM (New Zealand Information Security Manual), Vietnam PDPL (Law on Personal Data Protection No. 91/2025/QH15), EU CRA (Cyber Resilience Act, Regulation (EU) 2024/2847), Saudi Arabia GRC (NCA ECC, Saudi PDPL, SAMA, CST), UAE GRC (Federal PDPL, DIFC, ADGM, CBUAE, ICT Health Law), TISAX (VDA ISA / ENX automotive supplier security), TPRM (third-party/vendor risk), UK Cyber Essentials, and SOX ITGC — powered by Claude Skills. **Updated Monthly.** Benchmarked across 180 test cases using the eval framework — each graded against at least 5 verifiable assertions by independent agents (902 assertions in total). Skills scored **89%** vs a baseline of **55%**. [](../../releases/tag/v2.1.0) [](LICENSE) [](#the-skills) [](https://claude.ai) [](https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance) --- ## Table of Contents - [What Are Claude Skills?](#what-are-claude-skills) - [Who Is This For?](#who-is-this-for) - [The Skills](#the-skills) - [ISO 27001](#-iso-27001) - [SOC 2](#-soc-2) - [FedRAMP](#-fedramp) - [GDPR](#-gdpr) - [HIPAA](#-hipaa) - [NIST CSF](#-nist-csf) - [PCI DSS](#-pci-dss) - [TSA Cybersecurity](#-tsa-cybersecurity) - [ISO 42001 AI Management System](#-iso-42001-ai-management-system) - [ISO 27701 Privacy Information Management](#-iso-27701-privacy-information-management) - [DORA Digital Operational Resilience](#-dora-digital-operational-resilience) - [DPDPA India Digital Personal Data Protection](#-dpdpa-india-digital-personal-data-protection) - [CMMC 2.0 Cybersecurity Maturity Model Certification](#-cmmc-20-cybersecurity-maturity-model-certification) - [NIST AI Risk Management Framework](#-nist-ai-risk-management-framework) - [SWIFT Customer Security Programme (CSP)](#-swift-customer-security-programme-csp) - [Australian Information Security Manual (ISM)](#-australian-information-security-manual-ism) - [EU NIS2 Directive](#-eu-nis2-directive) - [CCPA/CPRA California Privacy](#-ccpacpra-california-privacy) - [ITAR — International Traffic in Arms Regulations](#-itar--international-traffic-in-arms-regulations) - [LGPD — Brazil's General Data Protection Law](#-lgpd--brazils-general-data-protection-law) - [CSRD — EU Corporate Sustainability Reporting Directive](#-csrd--eu-corporate-sustainability-reporting-directive) - [CIS Controls v8 — CIS Top 18 Cyber Hygiene](#-cis-controls-v8--cis-top-18-cyber-hygiene) - [EAR — Export Administration Regulations](#-ear--export-administration-regulations) - [NIST SP 800-53 — Security and Privacy Controls for Federal Systems](#-nist-sp-800-53--security-and-privacy-controls-for-federal-systems) - [EU AI Act — Regulation (EU) 2024/1689](#-eu-ai-act--regulation-eu-20241689) - [Section 508 — US Federal ICT Accessibility](#-section-508--us-federal-ict-accessibility) - [WCAG — Web Content Accessibility Guidelines](#-wcag--web-content-accessibility-guidelines) - [NZISM — New Zealand Information Security Manual](#-nzism--new-zealand-information-security-manual) - [Vietnam PDPL — Law on Personal Data Protection](#-vietnam-pdpl--law-on-personal-data-protection) - [EU CRA — Cyber Resilience Act](#-eu-cra--cyber-resilience-act) - [Saudi Arabia GRC — Country Compliance Advisor](#-saudi-arabia-grc--country-compliance-advisor) - [UAE GRC — Country Compliance Advisor](#-uae-grc--country-compliance-advisor) - [TISAX — Trusted Information Security Assessment Exchange](#-tisax--trusted-information-security-assessment-exchange) - [TPRM — Third-Party Risk Management](#-tprm--third-party-risk-management) - [Cyber Essentials / CE Plus — UK Baseline Certification](#-cyber-essentials--ce-plus--uk-baseline-certification) - [SOX ITGC — IT General Controls for SOX 404](#-sox-itgc--it-general-controls-for-sox-404) - [Potential Use Cases](#potential-use-cases) - [How to Install a Skill](#how-to-install-a-skill) - [Install via Claude Code Marketplace](#install-via-claude-code-marketplace) - [Skill Evaluation](#skill-evaluation) - [Customer Testimonials](#customer-testimonials) - [Support](#support) - [Author](#author) - [Disclaimer](#disclaimer) --- ## What Are Claude Skills? Claude Skills are installable knowledge packages that extend Claude's capabilities for specific domains. A skill is a `.skill` file — a bundled archive containing a `SKILL.md` instruction file and optional reference materials — that you upload to Claude once and use across all your conversations. Once installed, a skill activates **automatically** when your conversation touches its topic area. You don't need to invoke it by name or use special commands. Claude simply becomes a deeper expert in that domain for the duration of your session. **Skills are ideal when you need:** - Consistent, expert-level responses on a specialized topic - Outputs formatted to professional or regulatory standards (e.g., audit-ready control narratives, policy templates with the right clauses) - Domain knowledge that goes beyond general LLM training — such as knowing which specific NIST 800-53 controls apply to a given scenario, or which GDPR articles govern international data transfers **How skills work under the hood:** Each `.skill` file contains a primary `SKILL.md` that is loaded into Claude's context when the skill triggers, plus reference files that are loaded on demand for deeper sub-topics. This "progressive disclosure" pattern keeps context usage efficient while making comprehensive knowledge available when needed. <div style="position:relative;padding-bottom:56.25%;height:0;overflow:hidden;max-width:100%;"> <iframe width="560" height="315" src="https://www.youtube-nocookie.com/embed/-IBLNR0N2vE" title="Claude Skills for GRC Demo" frameborder="0" allow="accelerometer; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen loading="lazy" sandbox="allow-scripts allow-same-origin"></iframe> </div> --- ## Who Is This For? These skills are designed for professionals who work on information security, privacy, and regulatory compliance — whether at organizations seeking certification, development teams building compliant systems, or advisors supporting clients. **Security & Compliance Teams** use these skills to accelerate gap assessments, generate first-draft policies, map controls, and prepare evidence packages — compressing weeks of reference work into minutes. **Software Developers & Engineers** use them to understand what controls their systems must implement, audit code and architecture for compliance issues, and get actionable technical guidance tied to specific regulatory requirements. **Legal, Privacy & GRC Professionals** use them to draft regulatory documents (DPAs, BAAs, privacy notices), answer client questions with precise regulatory citations, and stay current on framework requirements. **Healthcare Organizations** use the HIPAA skill to assess systems, generate required notices and agreements, and train staff on obligations — without needing a compliance consultant for every question. **Cloud Service Providers** pursuing federal government contracts use the FedRAMP skill to navigate the ATO process, write SSP narratives, manage POA&Ms, and prepare for 3PAO assessments. **Startups and SMBs** use these skills to understand what a given framework requires of them, scope their compliance programs, and get expert-quality output without a large in-house team. --- ## The Skills <a id="-iso-27001"></a> ### 1. <img src="https://assets.kitploit.com/production/public/readmes/13360/1b8e916266811181ecf8f041e2b8125f8ada099ad5879a2426c790712b9320af.jpg" alt="ISO 27001" height="20" style="vertical-align:middle;object-fit:contain;"> ISO 27001 **File:** `ISO 27001 - Claude Skill/iso27001.skill` The ISO 27001 skill turns Claude into an expert ISO 27001 Lead Auditor and ISMS implementation consultant. It covers both **ISO 27001:2013** (114 controls, 14 domains) and **ISO 27001:2022** (93 controls, 4 themes), defaulting to the current 2022 version. **What it does:** - Runs structured **gap analyses** against mandatory clauses (4–10) and all Annex A controls - Generates complete, audit-ready **policy documents** with document control blocks, scope statements, and clause-to-control mappings - Provides step-by-step **control implementation guidance** for any Annex A control - Builds **risk registers** and **risk treatment plans** using the likelihood × impact methodology - Creates **Statement of Applicability (SoA)** templates covering all 93 controls - Guides **2013 → 2022 transition**, explaining the 11 new controls and mapping changes **Trigger phrases:** `ISO 27001`, `ISMS`, `Annex A`, `Statement of Applicability`, `SoA`, `gap analysis`, `risk register`, `certification readiness`, `internal audit` --- <a id="-soc-2"></a> ### 2. <img src="https://assets.kitploit.com/production/public/readmes/13360/83496193c7dd515316dc418567519579495687aff85d44542bde7b8cc358a6a1.jpg" alt="SOC 2" height="20" style="vertical-align:middle;object-fit:contain;"> SOC 2 **File:** `SOC 2 - Claude Skill/soc2.skill` The SOC 2 skill turns Claude into an expert SOC 2 compliance advisor grounded in the **AICPA 2017 Trust Services Criteria (TSC) with 2022 Revised Points of Focus**. It covers all five TSC: Security (CC1–CC9), Availability (A1), Confidentiality (C1), Processing Integrity (PI1), and Privacy (P1–P8). **What it does:** - Conducts **gap analyses** across in-scope TSC criteria with 🔴/🟡/🟢 status ratings and remediation roadmaps - Drafts all **12 core SOC 2 policies** (Information Security, Access Control, Incident Response, Change Management, Risk Assessment, Vendor Management, BCP/DR, and more) - Documents **controls** in auditor-ready format: Control ID, TSC criterion, type, owner, frequency, evidence, and test procedure - Produces **evidence checklists** mapped to each criterion, with sampling guidance for Type 1 vs Type 2 audits - Handles **vendor risk**: tiering, 32-question security questionnaires, SOC 2 report review, CUEC tracking, and contractual requirements - Adapts its tone — plain-language for first-time SOC 2 teams, technical AICPA-coded output for practitioners and auditors **Trigger phrases:** `SOC 2`, `Trust Services Criteria`, `TSC`, `CC6`, `Type 1`, `Type 2`, `AICPA`, `audit readiness`, `control statement`, `evidence` --- <a id="-fedramp"></a> ### 3. <img src="https://raw.githubusercontent.com/sushegaad/claude-skills-governance-risk-and-compliance/HEAD/assets/Logos/fedramp.svg" alt="FedRAMP" height="20" style="vertical-align:middle;object-fit:contain;"> FedRAMP [US] **File:** `FedRamp - Claude Skill/fedramp.skill` The FedRAMP skill turns Claude into a knowledgeable FedRAMP advisor covering the full authorization lifecycle for Cloud Service Providers (CSPs) under **NIST SP 800-53 Rev 5** and the new **CR26 (FedRAMP Consolidated Rules for 2026)** framework. Current as of August 2026 — CR26 is final (mandatory January 1, 2027) with Certification Classes A–D (A = pilot/transitional, B = LI-SaaS/Low, C = Moderate, D = High), Class pipelines opening August 2026, FedRAMP 20x as the primary pathway, Ready retired July 28, 2026 (Legacy FedRAMP Ready), and the September 30, 2026 OSCAL mandate for new authorizations. **What it does:** - Conducts **readiness and gap assessments** using a 75+ item checklist, mapped to CR26 Certification Classes (A/B/C/D) - Guides authoring of **ATO documentation**: System Security Plans (SSP), POA&Ms (with correct SLAs: Critical=15d, High=30d, Moderate=90d, Low=365d), SAPs, SARs, and all appendices (A–Q) - **Maps NIST 800-53 Rev 5 controls** across all 20 control families; advises on FedRAMP 20x continuous authorization approach - Provides **cloud architecture guidance** for AWS GovCloud, Azure Government, and Google Cloud Government - Supports **Continuous Monitoring (ConMon)** obligations: monthly deliverables, POA&M SLA management, deviation requests - Advises on **OSCAL readiness** for the mandatory September 30, 2026 submission deadline **Trigger phrases:** `FedRAMP`, `ATO`, `SSP`, `POA&M`, `3PAO`, `NIST 800-53`, `ConMon`, `AWS GovCloud`, `Azure Government`, `CR26`, `FedRAMP 20x`, `OSCAL`, `Certification Class` --- <a id="-gdpr"></a> ### 4. 🇪🇺 GDPR [EU] **File:** `GDPR - Claude Skill/gdpr-compliance.skill` The GDPR skill turns Claude into an expert GDPR compliance assistant that bridges technical and legal perspectives. It covers the full **EU GDPR** regulation with notes on **UK GDPR (DPA 2018)** where the rules differ, and adapts its tone automatically — technical for developers, legally precise for compliance and privacy professionals. **What it does:** - **Audits code, APIs, database schemas, and architectures** for GDPR violations, producing severity-graded findings (🔴/🟡/🟢) mapped to specific GDPR articles - **Drafts compliance documents** from built-in templates: Privacy Notices (Art. 13/14), Data Processing Agreements (Art. 28), Cookie/Consent Banners, DPIAs (Art. 35), Data Retention Policies, and Data Subject Rights Procedures - **Answers compliance questions** with authoritative article citations — every response leads with the governing article, then exceptions, then practical implications - **Reviews data flows and PII handling** across six dimensions (what, why, where, who, how long, how protected) and checks alignment with RoPA requirements - Covers all key GDPR areas: lawful basis, consent, data subject rights (Arts. 15–22), international transfers (Arts. 44–49), breach response (Arts. 32–34), special category data (Arts. 9–10), and penalties (Arts. 77–84) **Trigger phrases:** `GDPR`, `data protection`, `privacy`, `personal data`, `DPA`, `DPIA`, `lawful basis`, `data subject rights`, `consent`, `RoPA`, `Schrems II`, `ICO`, `EDPB` --- <a id="-hipaa"></a> ### 5. <img src="https://assets.kitploit.com/production/public/readmes/13360/1f1742cb6d5aac9160ceff87d2649d8946b0fb1e5657fc893991c5bea33b0e39.png" alt="HIPAA" height="20" style="vertical-align:middle;object-fit:contain;"> HIPAA [US] **File:** `HIPAA - Claude Skill/hipaa-compliance.skill` The HIPAA skill turns Claude into a knowledgeable HIPAA compliance advisor covering the **Privacy Rule, Security Rule, and Breach Notification Rule** (45 CFR Parts 160 and 164, as amended by HITECH). It serves both technical teams building systems that handle ePHI and compliance/legal teams managing organizational obligations. **What it does:** - **Reviews documents, systems, and architectures** for HIPAA compliance, producing structured findings with CFR citations, risk levels (High / Medium / Low), and remediation steps - **Generates HIPAA-compliant documents** from nine ready-to-use templates: Notice of Privacy Practices (NPP), Business Associate Agreements (BAA), Authorization Forms, Workforce Training Acknowledgments, Security Incident Reports, Risk Analysis Templates, and more — all with inline CFR citations - **Advises on technical safeguards** for modern cloud environments (AWS, Azure, GCP), FHIR APIs, mobile/BYOD, and DevOps pipelines — covering all 54 Security Rule implementation specifications (Required and Addressable) - **Explains HIPAA in plain language** for any audience — from developers needing encryption guidance to general staff learning what counts as PHI - **Guides breach response** using the 4-factor risk assessment, notification timelines, HHS reporting obligations, and scenario-by-scenario guidance **Trigger phrases:** `HIPAA`, `PHI`, `ePHI`, `covered entity`, `business associate`, `BAA`, `NPP`, `breach notification`, `minimum necessary`, `Privacy Rule`, `Security Rule` --- <a id="-nist-csf"></a> ### 6. <img src="https://assets.kitploit.com/production/public/readmes/13360/fba4d5c506ea7fcdc93306f04418b0eaf2a7dc0b8ba9e77ac0164e657dc7aaff.jpg" alt="NIST CSF" height="20" style="vertical-align:middle;object-fit:contain;"> NIST CSF **File:** `NIST Cybersecurity framework - Claude Skill/NIST Cybersecurity.skill` The NIST CSF skill turns Claude into an expert NIST Cybersecurity Framework advisor covering both **CSF 2.0** (February 2024) and **CSF 1.1** (April 2018), defaulting to the current CSF 2.0. It covers all six functions — **Govern, Identify, Protect, Detect, Respond, Recover** — including the new Govern function introduced in CSF 2.0. **What it does:** - Conducts structured **gap assessments** across all six CSF 2.0 functions, categories, and subcategories - Builds **Organisational Profiles** — Current and Target — aligned to business context, risk tolerance, and regulatory obligations - Assesses **Implementation Tiers** (1–4) across three dimensions and provides targeted advancement guidance - Creates **prioritised implementation roadmaps** with phased 30/60/90-day and strategic actions - **Maps CSF subcategories** to NIST SP 800-53, ISO 27001:2022, and CIS Controls v8 - Generates **policies aligned to CSF functions** — governance policy, incident response, data security, access control, and more - Guides **CSF 1.1 → CSF 2.0 migration** with a detailed subcategory mapping and migration checklist **Trigger phrases:** `NIST CSF`, `Cybersecurity Framework`, `CSF 2.0`, `Govern function`, `GV.SC`, `ID.AM`, `PR.AA`, `DE.CM`, `RS.MA`, `RC.RP`, `cybersecurity profile`, `implementation tiers`, `CSF gap assessment` --- <a id="-pci-dss"></a> ### 7. <img src="https://assets.kitploit.com/production/public/readmes/13360/9651b451d683651828153371df9dd17bf1a54db3a375de14d65d714ee6e5814a.png" alt="PCI DSS" height="20" style="vertical-align:middle;object-fit:contain;"> PCI DSS **File:** `PCI Compliance - Claude Skill/PCI-Compliance.skill` The PCI DSS skill turns Claude into an expert PCI DSS compliance advisor covering **PCI DSS v4.0.1** (June 2024 — current version), including all requirements that became mandatory on March 31, 2025. It covers all 12 requirements, all 8 SAQ types, merchant and service provider levels, and key v4.0 changes from v3.2.1. **What it does:** - **Scopes the Cardholder Data Environment (CDE)** — identifies what's in scope, assesses network segmentation, and recommends scope reduction via tokenisation or P2PE - **Selects the correct SAQ type** — walks through the decision tree for SAQ A, A-EP, B, B-IP, C, C-VT, P2PE, and D with rationale - Conducts structured **gap assessments** across all 12 requirements with QSA evidence requirements and common gaps - Provides **control implementation guidance** for any PCI DSS sub-requirement — what to implement, evidence needed, and common pitfalls - Generates **PCI DSS-aligned policies** — incident response, access control, cryptography, patch management, data retention, and more - Guides **v3.2.1 → v4.0.1 migration** including new requirements for MFA expansion, payment page script integrity (Req 6.4.3), phishing protection (Req 5.4.1), and automated log review (Req 10.4.1.1) - Explains **Defined vs Customised Approach** and when to use Targeted Risk Analysis (TRA) **Trigger phrases:** `PCI DSS`, `PCI compliance`, `cardholder data`, `CDE`, `SAQ`, `ROC`, `QSA`, `ASV scan`, `PAN`, `tokenisation`, `P2PE`, `merchant level`, `payment page`, `Req 8.4.2`, `Req 6.4.3` --- <a id="-tsa-cybersecurity"></a> ### 8. 🚨 TSA Cybersecurity [US] **File:** `TSA Compliance - Claude Skill/TSA-Compliance.skill` The TSA Cybersecurity skill turns Claude into an expert TSA cybersecurity directive advisor for **critical transportation infrastructure**. It covers all current TSA Security Directive series — **SD Pipeline-2021-01G**, **SD Pipeline-2021-02F**, **SD 1580-21-01E** (freight rail), and **SD 1582-21-01E** (transit/passenger rail) — plus the **November 2024 NPRM** proposing to formalise these directives as permanent federal regulations. > **Note on SSI:** TSA Security Directives are classified as **Sensitive Security Information (SSI)** under 49 CFR Part 1520. This skill is built from publicly available summaries, Federal Register notices, and DHS/CISA publications — not the classified full directive text. Covered entities receive the actual directive directly from TSA. **What it does:** - **Determines applicability** — which directive series applies to your organisation (pipeline, freight rail, transit, or bus) and what that means for your compliance obligations - Runs structured **gap assessments** across the four technical domains: IT/OT network segmentation, access controls (MFA), continuous monitoring, and patch management - **Drafts Cyber Risk Management Program (CRMP) documents**: Cybersecurity Implementation Plan (CIP/COIP), Incident Response Plan (IRP), Architecture Design Review (ADR), and Cybersecurity Assessment Plan (CAP) - Guides **OT/ICS-specific implementation** — data diodes, jump servers for legacy HMIs, passive monitoring tools (Claroty, Dragos, Nozomi), OT patch lifecycle with vendor coordination - Explains **24-hour CISA incident reporting** obligations: what qualifies, how to report, sample initial report language, and CIRCIA overlap - Advises on **annual IRP testing** — two objectives minimum, test scenarios, documentation requirements, and after-action review process - Explains the **2024 NPRM** impact: NIST CSF 2.0 alignment, CISA CPG baseline, proposed COIP structure, and what changes when the rule is finalised **Trigger phrases:** `TSA Security Directive`, `SD Pipeline-2021`, `SD 1580-21-01`, `SD 1582-21-01`, `TSA cybersecurity`, `Critical Cyber Systems`, `CCS`, `Cybersecurity Coordinator`, `Cybersecurity Implementation Plan`, `CIP`, `CRMP`, `IRP testing`, `Architecture Design Review`, `ADR`, `CAP`, `CISA 24-hour reporting`, `OT segmentation TSA`, `pipeline cybersecurity`, `rail cybersecurity directive`, `transit cybersecurity`, `TSA NPRM 2024` --- <a id="-iso-42001-ai-management-system"></a> ### 9. <img src="https://assets.kitploit.com/production/public/readmes/13360/94d64c693a5b55286e94f7b665a252f7981d797b4b7e7779f19ab215a3a3ee47.webp" alt="ISO 42001" height="20" style="vertical-align:middle;object-fit:contain;"> ISO 42001 AI Management System **File:** `ISO 42001 - Claude Skill/ISO-42001.skill` The ISO 42001 skill turns Claude into an expert **ISO/IEC 42001:2023** AI Management System (AIMS) advisor — the world's first international standard for AI governance. It serves both **AI providers** (organisations that develop or deploy AI) and **AI users** (organisations integrating third-party AI), covering the full certification lifecycle from gap assessment through Stage 2 audit readiness. **What it does:** - Conducts structured **gap assessments** across all mandatory clauses (4–10) and all **38 Annex A controls** (domains A.2–A.10) with 🔴/🟡/🟢 status, evidence requirements, and a phased remediation roadmap - Guides the mandatory **AI System Impact Assessment (AISIA)** step by step — identifying affected populations, assessing impact dimensions (severity, reversibility, breadth, human oversight), classifying impact level (Low/Medium/High), and determining proportionate control requirements - Performs **AI risk assessment** across all risk categories: model risks (bias, drift, hallucination, adversarial attacks), data risks (quality, poisoning, privacy in training data), operational risks (scope creep, human over-reliance), and supply chain risks (third-party model risk, API dependencies) - Generates a complete **Statement of Applicability (SoA)** covering all 38 Annex A controls (A.2.2–A.10.4) with applicability decisions, justifications, and implementation status - Drafts all core **AIMS policies** — AI Policy, AI Risk Management Policy, AI Acceptable Use Policy, Data Governance for AI Policy, AI Incident Management Policy, AI System Lifecycle Policy, and AI Supplier Management Policy — each with document control blocks and clause citations - Produces **Stage 1 and Stage 2 audit checklists** with RAG status, evidence requirements per clause, and common auditor focus areas - **Maps ISO 42001 to the EU AI Act** — aligns AISIA to the Fundamental Rights Impact Assessment (FRIA) for high-risk AI systems; maps Annex A controls to EU AI Act technical requirements - **Integrates ISO 42001 with ISO 27001** for organisations building a unified ISMS + AIMS **Trigger phrases:** `ISO 42001`, `ISO/IEC 42001`, `AI Management System`, `AIMS`, `AISIA`, `AI System Impact Assessment`, `responsible AI standard`, `AI governance standard`, `Annex A AI controls`, `AI risk assessment ISO`, `Statement of Applicability AI`, `AI policy ISO`, `AI certification`, `AI lifecycle controls`, `AI supplier management ISO`, `EU AI Act management system`, `NIST AI RMF ISO mapping`, `AI bias controls`, `AI transparency standard`, `AI incident management ISO` --- <a id="-iso-27701-privacy-information-management"></a> ### 10. <img src="https://assets.kitploit.com/production/public/readmes/13360/b05ef92cf5653e4c65e5e6ff9b54aad12fa9ffd3cbf4c65c09e8324f6e5db463.png" alt="ISO 27701" height="20" style="vertical-align:middle;object-fit:contain;"> ISO 27701 Privacy Information Management **File:** `ISO 27701 - Claude Skill/iso27701.skill` The ISO 27701 skill turns Claude into an expert **ISO/IEC 27701:2025** Privacy Information Management System (PIMS) advisor — covering the full lifecycle from gap assessment through certification. It handles both **ISO 27701:2025** (the new standalone edition) and **ISO 27701:2019** (the legacy ISO 27001 extension), and covers both **PII controllers** and **PII processors**. **What it does:** - Conducts structured **gap analyses** across all mandatory HLS clauses (4–10) and all 78 Annex A controls — 31 for PII controllers (A.1), 18 for PII processors (A.2), and 29 shared security controls (A.3) - Generates complete, audit-ready **PIMS policy documents** — Privacy Policy, Records of Processing Activities (RoPA), Data Subject Rights Procedure, Privacy by Design Procedure, Data Processing Agreements (DPAs), and more - Builds **privacy risk registers** focused on harm to PII principals, triggers DPIAs for high-risk processing, and produces risk treatment plans - Creates **Statements of Applicability (SoA)** scoped to the organization's role (controller, processor, or both) with applicability decisions and justification - Provides **control-by-control implementation guidance** for every A.1, A.2, and A.3 control — with purpose, implementation steps, audit evidence, and common pitfalls - Guides **2019 → 2025 transitions** with a full control mapping table, gap analysis checklist, and recommended timeline to the October 2028 deadline - **Maps ISO 27701 to GDPR** article by article, plus CCPA/CPRA, LGPD, PIPEDA, PDPA (Singapore/Thailand), and UK GDPR **Trigger phrases:** `ISO 27701`, `PIMS`, `privacy information management`, `PII controller`, `PII processor`, `privacy risk assessment`, `DPIA`, `data subject rights`, `records of processing activities`, `RoPA`, `privacy by design`, `data processing agreement`, `DPA`, `GDPR alignment ISO 27701`, `ISO 27701:2025`, `ISO 27701:2019`, `27701 transition`, `standalone PIMS`, `Annex A controller controls`, `Annex A processor controls` --- <a id="-dora-digital-operational-resilience"></a> ### 11. <img src="https://assets.kitploit.com/production/public/readmes/13360/d66c899f9e9c7cda51daceb14583af82e75aca1f0c7e9359e53f89ac6b47cac6.png" alt="DORA" height="20" style="vertical-align:middle;object-fit:contain;"> DORA [EU] — Digital Operational Resilience **File:** `DORA - Claude Skill/dora.skill` The DORA skill turns Claude into an expert advisor on **Regulation (EU) 2022/2554** (the Digital Operational Resilience Act) — the anchoring ICT regulation for EU financial entities since 17 January 2025. It encodes all 64 DORA articles, all 12 adopted RTS/ITS, and provides precise article-level guidance for every compliance workflow. It explicitly separates DORA from NIS2, legacy EBA ICT guidelines, and ISO 27001 — a common source of conflation in general LLM responses. **What it does:** - Conducts structured **DORA gap analyses** across all four pillars: ICT risk management framework (Chapter II, Art. 5–16), incident management (Chapter III, Art. 17–23), resilience testing / TLPT (Chapter IV, Art. 24–27), and ICT third-party risk (Chapter V, Art. 28–44) - Guides **ICT-related incident classification** against Art. 18 criteria and the materiality thresholds in CDR (EU) 2024/1772, with a full decision tree for major vs. non-major - Builds **three-stage incident reporting procedures** per Art. 19 and CDR (EU) 2025/301 — initial (4h), intermediate (72h), final (1 month) — including content requirements at each stage - Reviews and drafts **contractual provisions** per Art. 30(2)(a)–(i), flagging the common audit-rights gap with hyperscale cloud providers - Builds or validates the **Register of Information** with all mandatory fields per CIR (EU) 2024/2956 - Assesses **ICT concentration risk** per Art. 28(6) and Art. 29 — including multi-function reliance on a single cloud provider - Scopes **TLPT programmes** per Art. 26 and CDR (EU) 2025/1190, covering threat intelligence phase, red team test, mutual recognition, and tester qualification requirements - Drafts **ICT risk management framework** documentation per Art. 6–14 and CDR (EU) 2024/1774 - Precisely distinguishes **Chapter II** (proactive ICT risk governance) from **Chapter III** (reactive incident management) — a common compliance confusion point - References all **12 adopted RTS/ITS** by exact regulation number (CDR/CIR) with article-level mapping **Trigger phrases:** `DORA`, `Regulation (EU) 2022/2554`, `digital operational resilience`, `ICT risk management framework`, `DORA gap analysis`, `Art. 6 DORA`, `Art. 17 ICT incident`, `Art. 18 classification`, `Art. 19 incident reporting`, `Art. 26 TLPT`, `Art. 28 third-party risk`, `Art. 30 contractual provisions`, `Register of Information`, `CIR 2024/2956`, `CDR 2024/1772`, `CDR 2024/1773`, `CDR 2024/1774`, `CDR 2025/301`, `CDR 2025/1190`, `TLPT financial entities`, `ICT concentration risk`, `critical ICT TPSP`, `DORA vs NIS2`, `EBA ICT guidelines DORA`, `DORA incident classification`, `DORA reporting timelines`, `Chapter II DORA`, `Chapter III DORA` --- <a id="-dpdpa-india-digital-personal-data-protection"></a> ### 12. 🇮🇳 DPDPA [India] — Digital Personal Data Protection Act **File:** `DPDPA - Claude Skill/dpdpa.skill` The DPDPA skill turns Claude into an expert advisor on India's **Digital Personal Data Protection Act, 2023** and the finalized **DPDP Rules, 2025** (notified 13 November 2025, effective 13 May 2027). It covers all 44 sections of the Act and all 23 Rules, with precise section-level citations, GDPR-alignment mapping, and guidance calibrated for both Indian companies and global organizations with Indian data subjects. **What it does:** - Conducts structured **DPDPA gap analyses** covering notice and consent (Sections 5–6 + Rules 3–4), lawful processing (Section 7), Data Fiduciary obligations (Section 8 + Rules 6–9), children's data (Section 9 + Rules 10–12), and SDF obligations (Section 10 + Rule 13) --- [Read more](https://github.com/sushegaad/claude-skills-governance-risk-and-compliance)
