# Compliance Framework

> Implement compliance requirements (SOC2, GDPR, HIPAA). Design architecture for regulations. Map technical controls to compliance requirements. Use when building regulated systems.

- **Type:** Skill
- **Install:** `agentstack add skill-sethdford-claude-skills-compliance-framework`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [sethdford](https://agentstack.voostack.com/s/sethdford)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [sethdford](https://github.com/sethdford)
- **Source:** https://github.com/sethdford/claude-skills/tree/main/architect/architecture-governance/skills/compliance-framework

## Install

```sh
agentstack add skill-sethdford-claude-skills-compliance-framework
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Compliance Framework

Design systems that meet regulatory requirements and establish continuous compliance monitoring.

## Context

You are implementing compliance for regulated systems. Map regulations to technical controls. Design for audit readiness. Read requirements, existing controls, certification timelines.

## Domain Context

Based on compliance frameworks and regulatory standards:

- **SOC2**: Security, availability, processing integrity, confidentiality. Requires audit trail, access control, encryption.
- **GDPR**: Protects EU citizens' personal data. Requires consent, data portability, right-to-be-forgotten, breach notification.
- **HIPAA**: Health information privacy (US). Requires encryption, audit logs, access controls, business associate agreements.
- **PCI DSS**: Payment card data protection. Requires segmentation, encryption, monitoring, vendor management.

## Instructions

1. **Identify Applicable Standards**: Which regulations apply? GDPR (EU users)? HIPAA (health data)? SOC2 (enterprise customers)? PCI DSS (payment processing)?

2. **Map Controls to Architecture**: For each regulation, what technical controls needed? GDPR: encryption at rest/transit, audit logs, consent tracking. HIPAA: role-based access, encrypted backups, breach detection.

3. **Design for Audit**: Audit logs must be immutable, encrypted, sent to separate system. Log all data access, configuration changes, admin actions. Retention per regulation (GDPR: 3 years minimum).

4. **Build Operational Processes**: Change management: approve all changes, test in staging, audit trail. Incident response: detect, contain, notify (GDPR: 72 hours). Annual training on compliance.

5. **Plan for Verification**: Audit readiness: document controls, gather evidence. Penetration testing annually. Vulnerability scanning continuous. Third-party assessments (SOC2, HIPAA).

## Anti-Patterns

- **Compliance as Afterthought**: Build system, then add compliance controls. Result: hard to retrofit, costly. **Guard**: Design for compliance from start; embed controls in architecture.
- **Over-Compliance**: Implement controls for regulations you don't need. Result: cost, complexity. **Guard**: Identify exact requirements; implement only what's needed.
- **No Automation**: Manual evidence gathering for audits. Result: slow, error-prone. **Guard**: Automate log collection, evidence gathering, control testing.
- **Forgotten After Certification**: Achieve compliance, then relax. Result: drift, recertification failure. **Guard**: Continuous monitoring; treat compliance as ongoing, not one-time.

## Further Reading

- _SOC2 Compliance_ — security audit framework for service providers
- _GDPR Compliance_ — European data protection regulation
- _HIPAA Security Rule_ — health information protection (US)
- _Compliance is Not Security_ by James Ranall — compliance mindset and culture

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [sethdford](https://github.com/sethdford)
- **Source:** [sethdford/claude-skills](https://github.com/sethdford/claude-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-sethdford-claude-skills-compliance-framework
- Seller: https://agentstack.voostack.com/s/sethdford
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.