skill: compliance

should_trigger:
  - prompt: "What compliance frameworks do we need for a fintech operating in the EU?"
    why: Core scoping — map business attributes (financial entity, EU) to binding frameworks (DORA, GDPR-as-source, maybe SOC 2).
  - prompt: "Build us a SOC 2 readiness checklist with control owners and what proves each control."
    why: Core artifact — the control register with owner + evidence columns.
  - prompt: "We have an ISO 27001 audit in 90 days, set up the prep rhythm and evidence collection."
    why: Non-obvious — the deliverable is a cadence/runbook, not a document; audit-prep is squarely this skill.
  - prompt: "Map our controls — who owns what, how often each is reviewed, and what evidence backs it."
    why: The control register is the exact artifact; ownership + cadence + evidence is the skill's spine.
  - prompt: "Set up a continuous-compliance calendar so we stop scrambling the week before every audit."
    why: Non-obvious operating-rhythm trigger — the weekly control-health review and cadence calendar.
  - prompt: "Does the EU AI Act apply to our recommender system, and what's the deadline we have to hit?"
    why: Scoping to a dated framework — must surface 2 Aug 2026 as active and flag the Omnibus deferral as not-yet-adopted.
  - prompt: "¿Qué compliance necesitamos para una app de salud con datos médicos de usuarios europeos?"
    why: Spanish + multi-framework sector scoping (HIPAA-style PHI, GDPR-as-source, SOC 2), not a single document.

should_not_trigger:
  - prompt: "Write our privacy policy and cookie consent banner."
    route_to: gdpr-privacy
    why: Privacy-document drafting and consent UX — substance owned by gdpr-privacy, not program scoping.
  - prompt: "Draft the Terms of Service for our SaaS website."
    route_to: terms-conditions
    why: A one-to-many published legal document, not a control register or cadence.
  - prompt: "Fix the SQL injection and harden the auth on our API endpoints."
    route_to: secure-coding
    why: Code-level hardening (the evidence source), not the program-level control mapping.
  - prompt: "Review this vendor MSA and DPA before we sign it."
    route_to: contracts
    why: Negotiated two-party agreement review, not framework scoping.
  - prompt: "Write our internal data retention and classification policy text."
    route_to: data-policy
    why: Internal policy-document prose, not the control register that references it.

capability:
  - scenario: "We're a Series-A health SaaS with EU users and an AI triage feature that scores patient symptoms. Tell us what compliance we need and how to keep it true between audits."
    must_include:
      - Scopes to HIPAA for the PHI, flagging the 2024 NPRM as forthcoming/not-yet-finalized while noting OCR is already enforcing toward it
      - Treats GDPR as a control source for the EU users (and routes the privacy-document drafting to gdpr-privacy, not drafting it here)
      - Includes SOC 2 (Security TSC) for the enterprise-readiness angle and notes Type II tests operating effectiveness over a 3-12 month window
      - Scopes the EU AI Act high-risk obligations to the active 2 Aug 2026 date while flagging the 7 May 2026 Digital Omnibus proposed deferral to 2 Dec 2027 as not-yet-adopted
      - Produces a control register with owner / evidence / cadence columns, one row per control
      - Notes the SOC 2 / ISO 27001 ~60-70% overlap to keep a single multi-tagged register instead of duplicates
      - Stands up an operating rhythm with a weekly control-health review and a cadence calendar
      - Routes privacy-policy / DPA drafting to gdpr-privacy and contracts, and does NOT give a legal opinion

# Evals — compliance

These cases are graded by judgment, not by an automated runner. Feed each
`should_trigger` and `should_not_trigger` prompt to the skill router and confirm
the routing matches: triggers should land on `compliance`, and each
`should_not_trigger` prompt should route to the named sibling (`route_to`). For
the `capability` case, run the scenario through the skill and check the response
covers every item in `must_include` — especially the date-sensitive ones (EU AI
Act 2 Aug 2026 as active vs the not-yet-adopted Omnibus deferral; HIPAA NPRM as
forthcoming-not-law) and the structural ones (a register with owner/evidence/
cadence columns, the 60-70% overlap, a weekly control-health review). The
separate `scripts/verify.sh` mechanically lints a finished control register; run
it against a generated register to confirm no control is missing an owner,
evidence, or cadence.

# Framework cheat sheets

Current as of 2026-06-02. Numbers and dates are load-bearing — verify against
the primary source before quoting them in an audit response.

## SOC 2

- Built on **five Trust Services Criteria**: **Security** (the only mandatory
  one, the "Common Criteria"), **Availability**, **Processing Integrity**,
  **Confidentiality**, **Privacy**. Most start with Security alone and add
  criteria as customers demand.
- **Type I** = controls suitably designed at a **point in time**.
- **Type II** = controls **operating effectively over a window**, typically
  **3–12 months**. This is what enterprise buyers want, and it is why
  point-in-time evidence is insufficient.
- Not a certification — an auditor's attestation report. Renewed annually.

## ISO/IEC 27001:2022

- **93 Annex A controls** in **four themes**: Organizational (37), People (8),
  Physical (14), Technological (34).
- The **2013 → 2022 transition deadline passed 31 Oct 2025** — all live
  certificates are now on the 2022 standard. Do not reference the old 114-control
  / 14-domain structure.
- Requires a documented ISMS, risk assessment, Statement of Applicability, and
  internal audit. A real certification (vs SOC 2's attestation).

## SOC 2 ↔ ISO 27001 overlap

- **~60–70% of controls overlap**: risk assessment, access management, incident
  response, logging, change management, vendor management all count toward both.
- Practical consequence: maintain **one control register**, tag each control to
  every framework it satisfies, and generate per-framework views. Do not keep
  parallel registers.

## EU AI Act

Phased application:

| Obligation | Date |
| --- | --- |
| Prohibited practices + AI-literacy | 2 Feb 2025 |
| GPAI-model obligations + governance + penalties | 2 Aug 2025 |
| Annex III (use-based) high-risk obligations | **2 Aug 2026 — active legal date** |
| Annex I (product-regulated, incl. medical devices) | 2 Aug 2027 |

High-risk obligations include conformity assessment, registration, risk
management, data governance, logging, and human oversight.

**Digital Omnibus on AI** — a provisional trilogue agreement (**7 May 2026**)
proposes deferring Annex III high-risk to **2 Dec 2027** and Annex I to
**2 Aug 2028**. It is **NOT yet adopted**. Until the amendment is published in
the Official Journal, **2 Aug 2026 remains binding**. Plan to the original date;
record the deferral as forthcoming-not-final.

Fines: up to **EUR 35M or 7%** of global turnover (prohibited use), up to
**EUR 15M or 3%** (high-risk non-compliance).

## PCI DSS v4.0.1

- **Fully mandatory since 31 Mar 2025.** ~50 previously "best practice"
  future-dated requirements are now hard requirements, layered on the 12
  foundational requirements. Newly mandatory items include:
  - MFA for **all** accounts with access to the cardholder data environment.
  - Automated log review.
  - Internal vulnerability scanning.
  - Periodic account reviews.
  - A maintained hardware/software inventory.
- Scope is defined by where cardholder data is stored, processed, or transmitted
  — minimizing scope (e.g. tokenization, hosted payment pages) minimizes burden.

## HIPAA Security Rule (+ 2024 NPRM — forthcoming, not law)

- The current Security Rule is in force today.
- An **NPRM** (issued 27 Dec 2024, published in the Federal Register 6 Jan 2025,
  comment close 7 Mar 2025) proposes to:
  - Remove the **"required vs addressable"** distinction — nearly everything
    becomes required, with narrow exceptions.
  - Mandate **MFA** for ePHI access.
  - Require a written technology **asset inventory + network map**.
  - Patch **critical** risks in **15 days**, **high** in **30 days**.
  - Terminate workforce ePHI access within **1 hour** of departure.
  - If finalized, **240 days** to comply (covered entities 180 + business
    associates +60 for agreement updates).
- **As of mid-2026 the rule is still NOT finalized** — OCR received 4,700+
  comments and is still parsing them. But OCR has **begun citing the proposed
  standard in resolution agreements and enforcement**, so enforcement is already
  gravitating toward it. Scope to the current rule; prepare for the proposed one.

## DORA (Digital Operational Resilience Act)

- **In force since Jan 2025** for EU financial entities (and their critical ICT
  third-party providers). Four pillars: ICT risk management, incident reporting,
  digital operational resilience testing, and third-party (ICT) risk management.

## NIS2

- As of Mar 2026, **21 of 27 member states had transposed** it. Many set a first
  audit deadline of **30 Jun 2026**. Check the specific transposition for each
  member state you operate in — obligations vary in the national implementation.

## GDPR as a control source

GDPR is not "a checklist you certify against" — it feeds controls into your
register: lawful-basis records, access controls, breach-notification timelines,
vendor DPAs, and data-subject-rights handling. The *documents* (privacy notice,
ROPA, DSAR procedure) are drafted by `../gdpr-privacy/SKILL.md` and `../contracts/SKILL.md`;
here you only map them as evidence sources.

# Operating rhythm — schema, calendar, evidence, audit prep

The register is the source of truth. The cadence calendar, evidence catalog, and
audit-prep runbook are all generated from it.

## Control-register schema

A control register is a flat table, one row per control. Markdown or CSV — both
lint cleanly with `scripts/verify.sh`.

| Column | Required | Notes |
| --- | --- | --- |
| `control-id` | yes | Stable internal id, e.g. `AC-02`, `IR-01` |
| `framework` | yes | Every framework this control satisfies, multi-tagged |
| `owner` | yes | A named person/role — never "the team" |
| `evidence` | yes | The exact proving artifact and where it lives |
| `cadence` | yes | Review frequency, sized by risk |
| `last-verified` | recommended | Timestamp of the last attestation |
| `status` | recommended | `met` / `gap` / `in-progress` |

Optional leading `scope:` line names the frameworks in play, so `verify.sh` can
warn if a scoped framework has zero mapped controls:

```text
scope: SOC2, ISO27001, GDPR
| control-id | framework | owner | evidence | cadence | last-verified | status |
| --- | --- | --- | --- | --- | --- | --- |
| AC-02 | ISO27001 A.5.18, SOC2 CC6.2 | Head of IT | quarterly IdP access export, signed | quarterly | 2026-05-30 | met |
| IR-01 | ISO27001 A.5.24, SOC2 CC7.3 | Security Lead | incident runbook + last tabletop log | annual | 2026-04-12 | met |
```

## Cadence calendar

| Cadence | Work | Typical owner |
| --- | --- | --- |
| Daily | Automated control monitoring, drift/alert review | Security/Ops |
| Weekly | **Control-health review** — open gaps, stale evidence, overdue owners | Compliance lead |
| Monthly | Evidence refresh (high-risk controls); vuln-scan review | Control owners |
| Quarterly | Access recertification; vendor/third-party risk reassessment | IT / Vendor mgmt |
| Annual | Full risk assessment; policy review; pen test; audit prep | Compliance lead |

The **weekly control-health review** is the heartbeat. Without it, gaps surface
as audit findings instead of five-minute fixes.

## Evidence-source catalog

For each control, name where its evidence actually comes from. Common sources:

- **IdP / SSO** — access exports, MFA-enforcement config, deprovisioning logs.
- **Ticketing** — change-management approvals, incident records.
- **CI/CD** — build provenance, dependency-scan results, deploy approvals.
- **Cloud config** — encryption-at-rest settings, network rules, logging config.
- **HR system** — onboarding/offboarding timestamps, training completion.
- **Vendor portal / DPAs** — third-party security attestations, signed DPAs
  (drafted by `../contracts/SKILL.md`).
- **Policy repo** — versioned policy docs (text owned by `../data-policy/SKILL.md`,
  `../gdpr-privacy/SKILL.md`, `../terms-conditions/SKILL.md`).

Each evidence item must be **timestamped, mapped to the framework clause, and
owner-attested**.

## Audit-prep runbook

When an audit is announced (or T-90 days):

1. **Confirm scope** — frameworks, criteria/Annex selections, the audit window
   (for SOC 2 Type II, the 3–12 month period under test).
2. **Run a gap pass** — filter the register to `status != met`; assign each gap
   an owner and a close-by date.
3. **Refresh evidence** — for every in-scope control, confirm evidence exists,
   is timestamped within the window, and is owner-attested.
4. **Dry-run the interview** — for each control, can the owner produce the
   evidence and explain the control in one sentence? If not, that's a finding
   waiting to happen.
5. **Stand the rhythm back up** — the audit is a checkpoint, not the goal; the
   weekly review continues so the next audit is a non-event.

A program running the weekly review all year treats the audit as confirmation,
not as a crisis.

#!/usr/bin/env bash
set -euo pipefail

# ============================================================================
# NAME
#   verify.sh — lint a compliance control register
#
# USAGE
#   ./verify.sh <register.md|register.csv>
#   ./verify.sh                       # no arg / empty target -> exits 0
#
# WHAT IT DOES
#   1. Detects the register format (Markdown table or CSV).
#   2. Asserts the required columns exist:
#        control-id, framework, owner, evidence, cadence, status
#      (last-verified is recommended, not required).
#   3. FAILS if any data row is missing owner / evidence / cadence — the
#      cardinal sin of "checklist theater": a control nobody owns and nothing
#      proves.
#   4. WARNS (does not fail) if a framework named in a leading `scope:` line
#      has zero mapped controls in the register.
#
# GUARANTEES
#   - Read-only: never writes to or modifies the target.
#   - No dependencies beyond bash + awk + grep (stock macOS bash 3.2 OK).
#   - Exits 0 on a missing arg, an empty file, or a clean register — never a
#     false failure on nothing.
#
# EXIT CODES
#   0  Clean / empty / nothing to check.
#   1  At least one row missing owner, evidence, or cadence; or a required
#      column is absent.
# ============================================================================

RED=$'\033[31m'; YEL=$'\033[33m'; GRN=$'\033[32m'; RST=$'\033[0m'
if [ -n "${NO_COLOR:-}" ]; then RED=""; YEL=""; GRN=""; RST=""; fi

ok()   { printf '%s[ok]%s %s\n'   "$GRN" "$RST" "$*"; }
warn() { printf '%s[warn]%s %s\n' "$YEL" "$RST" "$*" >&2; }
bad()  { printf '%s[FAIL]%s %s\n' "$RED" "$RST" "$*" >&2; }

TARGET="${1:-}"

# No target, or it is not a regular file, or it is empty -> nothing to verify.
if [ -z "$TARGET" ]; then
  ok "no register given — nothing to verify"
  exit 0
fi
if [ ! -f "$TARGET" ]; then
  warn "register not found: $TARGET — nothing to verify"
  exit 0
fi
if [ ! -s "$TARGET" ]; then
  ok "register is empty — nothing to verify"
  exit 0
fi

REQUIRED="control-id framework owner evidence cadence status"

# awk does the parsing for both Markdown-pipe and CSV registers.
# It prints lint lines on stderr (FAIL:/WARN:) and the final verdict marker.
RESULT="$(awk -v required="$REQUIRED" '
  function trim(s) { gsub(/^[ \t]+|[ \t]+$/, "", s); return s }
  function norm(s) { s=trim(s); gsub(/[ \t]+/, " ", s); return tolower(s) }

  BEGIN {
    nreq = split(required, req, " ")
    delim = "|"            # assume markdown until a CSV header proves otherwise
    have_header = 0
    fails = 0
    rows = 0
  }

  # Capture a scope: line (markdown or plain) before the header.
  !have_header && tolower($0) ~ /^[ \t]*scope[ \t]*:/ {
    line = $0
    sub(/^[ \t]*[Ss][Cc][Oo][Pp][Ee][ \t]*:[ \t]*/, "", line)
    n = split(line, parts, /[,;]/)
    for (i = 1; i <= n; i++) {
      f = norm(parts[i])
      if (f != "") scope[f] = 1
    }
    next
  }

  # Skip markdown separator rows like | --- | --- |
  /^[ \t]*\|?[ \t:-]*\|[ \t:|-]*$/ && have_header { next }

  {
    raw = $0
    # Choose delimiter from the header line.
    if (!have_header) {
      if (raw ~ /\|/) delim = "|"; else if (raw ~ /,/) delim = ","; else next
    }

    # Split the row on the chosen delimiter.
    if (delim == "|") {
      sub(/^[ \t]*\|/, "", raw); sub(/\|[ \t]*$/, "", raw)
      ncol = split(raw, cells, /\|/)
    } else {
      ncol = split(raw, cells, /,/)
    }

    if (!have_header) {
      for (c = 1; c <= ncol; c++) {
        h = norm(cells[c])
        colidx[h] = c
      }
      # Verify required columns are present.
      missing = ""
      for (k = 1; k <= nreq; k++) {
        if (!(req[k] in colidx)) missing = missing " " req[k]
      }
      if (missing != "") {
        print "FAIL: missing required column(s):" missing > "/dev/stderr"
        fails++
      }
      have_header = 1
      next
    }

    rows++
    rownum = rows

    for (k = 1; k <= nreq; k++) {
      name = req[k]
      if (name != "owner" && name != "evidence" && name != "cadence") continue
      ci = colidx[name]
      val = (ci <= ncol) ? trim(cells[ci]) : ""
      if (val == "" || val == "-" || tolower(val) == "tbd" || tolower(val) == "n/a") {
        idc = colidx["control-id"]
        cid = (idc <= ncol) ? trim(cells[idc]) : ("row " rownum)
        print "FAIL: control [" cid "] has empty " name > "/dev/stderr"
        fails++
      }
    }

    # Record which scoped frameworks are referenced by some control.
    fc = colidx["framework"]
    fval = (fc <= ncol) ? norm(cells[fc]) : ""
    for (s in scope) { if (index(fval, s) > 0) seen[s] = 1 }
  }

  END {
    for (s in scope) {
      if (!(s in seen))
        print "WARN: scoped framework \"" s "\" has zero mapped controls" > "/dev/stderr"
    }
    print "ROWS=" rows " FAILS=" fails
  }
' "$TARGET")"

ROWS="$(printf '%s\n' "$RESULT" | sed -n 's/.*ROWS=\([0-9]*\).*/\1/p')"
FAILS="$(printf '%s\n' "$RESULT" | sed -n 's/.*FAILS=\([0-9]*\).*/\1/p')"
ROWS="${ROWS:-0}"; FAILS="${FAILS:-0}"

if [ "$ROWS" -eq 0 ] && [ "$FAILS" -eq 0 ]; then
  ok "no data rows found — nothing to verify"
  exit 0
fi

if [ "$FAILS" -gt 0 ]; then
  bad "$FAILS issue(s) in register — fix owner/evidence/cadence gaps before audit"
  exit 1
fi

ok "register clean: $ROWS control(s), required columns present, no owner/evidence/cadence gaps"
exit 0