Compliance Priorities

Compliance Priorities

Prioritize the applicable regulations for "$ARGUMENTS" by business impact, enforcement deadlines, and customer demand to determine the optimal compliance sequence.

Prerequisites

None — this is a Phase 0 (Scope) skill.

Process

1. Read context files:

• Read plugins/compliance/shared/grc-lifecycle-guide.md for GRC methodology reference
• Read .metapowers/compliance/$ARGUMENTS/00-scope.md for the regulation inventory

1. Business impact scoring:

• For each applicable regulation, score revenue at risk without certification (0-10)
• Assess deal-blocking potential — how often is this certification requested in sales cycles?
• Estimate market access impact — does non-compliance lock out entire markets or verticals?

1. Urgency scoring:

• Score enforcement deadline proximity (0-10) — active enforcement vs. upcoming vs. future
• Score customer deadline pressure (0-10) — immediate customer requirements vs. nice-to-have
• Flag any regulations with imminent deadlines or recent enforcement actions

1. Effort scoring:

• Score implementation complexity (0-10) — scope of changes needed
• Estimate time to certification (months)
• Assess internal capability gaps — can this be done in-house or requires external help?

1. Priority ranking:

• Calculate weighted priority score (business impact 40%, urgency 35%, inverse effort 25%)
• Rank regulations from highest to lowest priority
• Identify quick wins (high impact, low effort) vs. strategic investments (high impact, high effort)
• Group into tiers: Tier 1 (immediate), Tier 2 (next 6 months), Tier 3 (12+ months)

1. Write the artifact to .metapowers/compliance/$ARGUMENTS/00-scope.md (append to existing) with sections:

• Scoring Matrix — table with impact, urgency, effort, and weighted scores per regulation
• Priority Tiers — Tier 1/2/3 groupings with rationale
• Quick Wins — low-effort, high-impact regulations to tackle first
• Strategic Investments — high-effort certifications that unlock major business value
• Dependencies — regulations that build on each other (e.g., ISO 27001 before CSA STAR)

Output

The priority analysis appended to .metapowers/compliance/$ARGUMENTS/00-scope.md. Present a summary to the user highlighting:

• Top 3 priority regulations and why
• Identified quick wins
• Key dependencies between certifications
• Recommended next step: run /compliance:control-framework $ARGUMENTS

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: bromso
• Source: bromso/metapowers
• License: MIT
• Homepage: https://bromso.github.io/metapowers/

Install and usage instructions live in the source repository linked above.