A community-driven registry for Claude, Cursor, Windsurf, Cline & more. Not affiliated with Anthropic.
Are you the author? Sign in to claim
Claude Skills for Governance, Risk, & Compliance (GRC): Expert-level compliance guidance for ISO 27001, SOC 2, FedRAMP,
Expert-level compliance guidance for ISO 27001, SOC 2, FedRAMP, GDPR, HIPAA, NIST CSF, PCI DSS, TSA Cybersecurity, ISO 42001 AI Management System, ISO 27701 Privacy Information Management, DORA Digital Operational Resilience, India's Digital Personal Data Protection Act (DPDPA), CMMC 2.0 Cybersecurity Maturity Model Certification, NIST AI Risk Management Framework, SWIFT Customer Security Programme (CSP), Australian Information Security Manual (ISM), EU NIS2 Directive, CCPA/CPRA California Privacy, ITAR (International Traffic in Arms Regulations), Brazil's LGPD (Lei Geral de Proteção de Dados), EU CSRD (Corporate Sustainability Reporting Directive), CIS Controls v8 (CIS Top 18), EAR (Export Administration Regulations), NIST SP 800-53 (Security and Privacy Controls for Federal Systems), EU AI Act (Regulation (EU) 2024/1689), Section 508 (US Federal ICT Accessibility), WCAG (Web Content Accessibility Guidelines), NZISM (New Zealand Information Security Manual), Vietnam PDPL (Law on Personal Data Protection No. 91/2025/QH15), and EU CRA (Cyber Resilience Act, Regulation (EU) 2024/2847) — powered by Claude Skills.
Benchmarked across 150 test cases (5 per framework) using the eval framework — each graded against 5 verifiable assertions by independent agents. Skills scored 96% vs a baseline of 81% across 675 total assertions.
Claude Skills are installable knowledge packages that extend Claude's capabilities for specific domains. A skill is a .skill file — a bundled archive containing a SKILL.md instruction file and optional reference materials — that you upload to Claude once and use across all your conversations.
Once installed, a skill activates automatically when your conversation touches its topic area. You don't need to invoke it by name or use special commands. Claude simply becomes a deeper expert in that domain for the duration of your session.
Skills are ideal when you need:
How skills work under the hood: Each .skill file contains a primary SKILL.md that is loaded into Claude's context when the skill triggers, plus reference files that are loaded on demand for deeper sub-topics. This "progressive disclosure" pattern keeps context usage efficient while making comprehensive knowledge available when needed.
These skills are designed for professionals who work on information security, privacy, and regulatory compliance — whether at organizations seeking certification, development teams building compliant systems, or advisors supporting clients.
Security & Compliance Teams use these skills to accelerate gap assessments, generate first-draft policies, map controls, and prepare evidence packages — compressing weeks of reference work into minutes.
Software Developers & Engineers use them to understand what controls their systems must implement, audit code and architecture for compliance issues, and get actionable technical guidance tied to specific regulatory requirements.
Legal, Privacy & GRC Professionals use them to draft regulatory documents (DPAs, BAAs, privacy notices), answer client questions with precise regulatory citations, and stay current on framework requirements.
Healthcare Organizations use the HIPAA skill to assess systems, generate required notices and agreements, and train staff on obligations — without needing a compliance consultant for every question.
Cloud Service Providers pursuing federal government contracts use the FedRAMP skill to navigate the ATO process, write SSP narratives, manage POA&Ms, and prepare for 3PAO assessments.
Startups and SMBs use these skills to understand what a given framework requires of them, scope their compliance programs, and get expert-quality output without a large in-house team.
ISO 27001File: ISO 27001 - Claude Skill/iso27001.skill
The ISO 27001 skill turns Claude into an expert ISO 27001 Lead Auditor and ISMS implementation consultant. It covers both ISO 27001:2013 (114 controls, 14 domains) and ISO 27001:2022 (93 controls, 4 themes), defaulting to the current 2022 version.
What it does:
Trigger phrases: ISO 27001, ISMS, Annex A, Statement of Applicability, SoA, gap analysis, risk register, certification readiness, internal audit
SOC 2File: SOC 2 - Claude Skill/soc2.skill
The SOC 2 skill turns Claude into an expert SOC 2 compliance advisor grounded in the AICPA 2017 Trust Services Criteria (TSC) with 2022 Revised Points of Focus. It covers all five TSC: Security (CC1–CC9), Availability (A1), Confidentiality (C1), Processing Integrity (PI1), and Privacy (P1–P8).
What it does:
Trigger phrases: SOC 2, Trust Services Criteria, TSC, CC6, Type 1, Type 2, AICPA, audit readiness, control statement, evidence
FedRAMP [US]File: FedRamp - Claude Skill/fedramp.skill
The FedRAMP skill turns Claude into a knowledgeable FedRAMP advisor covering the full authorization lifecycle for Cloud Service Providers (CSPs) under the current NIST SP 800-53 Rev 5 baseline. It is current as of 2025–2026, incorporating the Rev 5 transition, the September 2026 OSCAL mandate, and December 2024 template updates.
What it does:
Trigger phrases: FedRAMP, ATO, SSP, POA&M, 3PAO, NIST 800-53, ConMon, AWS GovCloud, Azure Government, impact level, OSCAL
File: GDPR - Claude Skill/gdpr-compliance.skill
The GDPR skill turns Claude into an expert GDPR compliance assistant that bridges technical and legal perspectives. It covers the full EU GDPR regulation with notes on UK GDPR (DPA 2018) where the rules differ, and adapts its tone automatically — technical for developers, legally precise for compliance and privacy professionals.
What it does:
Trigger phrases: GDPR, data protection, privacy, personal data, DPA, DPIA, lawful basis, data subject rights, consent, RoPA, Schrems II, ICO, EDPB
HIPAA [US]File: HIPAA - Claude Skill/hipaa-compliance.skill
The HIPAA skill turns Claude into a knowledgeable HIPAA compliance advisor covering the Privacy Rule, Security Rule, and Breach Notification Rule (45 CFR Parts 160 and 164, as amended by HITECH). It serves both technical teams building systems that handle ePHI and compliance/legal teams managing organizational obligations.
What it does:
Trigger phrases: HIPAA, PHI, ePHI, covered entity, business associate, BAA, NPP, breach notification, minimum necessary, Privacy Rule, Security Rule
NIST CSFFile: NIST Cybersecurity framework - Claude Skill/NIST Cybersecurity.skill
The NIST CSF skill turns Claude into an expert NIST Cybersecurity Framework advisor covering both CSF 2.0 (February 2024) and CSF 1.1 (April 2018), defaulting to the current CSF 2.0. It covers all six functions — Govern, Identify, Protect, Detect, Respond, Recover — including the new Govern function introduced in CSF 2.0.
What it does:
Trigger phrases: NIST CSF, Cybersecurity Framework, CSF 2.0, Govern function, GV.SC, ID.AM, PR.AA, DE.CM, RS.MA, RC.RP, cybersecurity profile, implementation tiers, CSF gap assessment
PCI DSSFile: PCI Compliance - Claude Skill/PCI-Compliance.skill
The PCI DSS skill turns Claude into an expert PCI DSS compliance advisor covering PCI DSS v4.0.1 (June 2024 — current version), including all requirements that became mandatory on March 31, 2025. It covers all 12 requirements, all 8 SAQ types, merchant and service provider levels, and key v4.0 changes from v3.2.1.
What it does:
Trigger phrases: PCI DSS, PCI compliance, cardholder data, CDE, SAQ, ROC, QSA, ASV scan, PAN, tokenisation, P2PE, merchant level, payment page, Req 8.4.2, Req 6.4.3
File: TSA Compliance - Claude Skill/TSA-Compliance.skill
The TSA Cybersecurity skill turns Claude into an expert TSA cybersecurity directive advisor for critical transportation infrastructure. It covers all current TSA Security Directive series — SD Pipeline-2021-01G, SD Pipeline-2021-02F, SD 1580-21-01E (freight rail), and SD 1582-21-01E (transit/passenger rail) — plus the November 2024 NPRM proposing to formalise these directives as permanent federal regulations.
Note on SSI: TSA Security Directives are classified as Sensitive Security Information (SSI) under 49 CFR Part 1520. This skill is built from publicly available summaries, Federal Register notices, and DHS/CISA publications — not the classified full directive text. Covered entities receive the actual directive directly from TSA.
What it does:
Trigger phrases: TSA Security Directive, SD Pipeline-2021, SD 1580-21-01, SD 1582-21-01, TSA cybersecurity, Critical Cyber Systems, CCS, Cybersecurity Coordinator, Cybersecurity Implementation Plan, CIP, CRMP, IRP testing, Architecture Design Review, ADR, CAP, CISA 24-hour reporting, OT segmentation TSA, pipeline cybersecurity, rail cybersecurity directive, transit cybersecurity, TSA NPRM 2024
ISO 42001 AI Management SystemFile: ISO 42001 - Claude Skill/ISO-42001.skill
The ISO 42001 skill turns Claude into an expert ISO/IEC 42001:2023 AI Management System (AIMS) advisor — the world's first international standard for AI governance. It serves both AI providers (organisations that develop or deploy AI) and AI users (organisations integrating third-party AI), covering the full certification lifecycle from gap assessment through Stage 2 audit readiness.
What it does:
Trigger phrases: ISO 42001, ISO/IEC 42001, AI Management System, AIMS, AISIA, AI System Impact Assessment, responsible AI standard, AI governance standard, Annex A AI controls, AI risk assessment ISO, Statement of Applicability AI, AI policy ISO, AI certification, AI lifecycle controls, AI supplier management ISO, EU AI Act management system, NIST AI RMF ISO mapping, AI bias controls, AI transparency standard, AI incident management ISO
ISO 27701 Privacy Information ManagementFile: ISO 27701 - Claude Skill/iso27701.skill
The ISO 27701 skill turns Claude into an expert ISO/IEC 27701:2025 Privacy Information Management System (PIMS) advisor — covering the full lifecycle from gap assessment through certification. It handles both ISO 27701:2025 (the new standalone edition) and ISO 27701:2019 (the legacy ISO 27001 extension), and covers both PII controllers and PII processors.
What it does:
Trigger phrases: ISO 27701, PIMS, privacy information management, PII controller, PII processor, privacy risk assessment, DPIA, data subject rights, records of processing activities, RoPA, privacy by design, data processing agreement, DPA, GDPR alignment ISO 27701, ISO 27701:2025, ISO 27701:2019, 27701 transition, standalone PIMS, Annex A controller controls, Annex A processor controls
DORA [EU] — Digital Operational ResilienceFile: DORA - Claude Skill/dora.skill
The DORA skill turns Claude into an expert advisor on Regulation (EU) 2022/2554 (the Digital Operational Resilience Act) — the anchoring ICT regulation for EU financial entities since 17 January 2025. It encodes all 64 DORA articles, all 12 adopted RTS/ITS, and provides precise article-level guidance for every compliance workflow. It explicitly separates DORA from NIS2, legacy EBA ICT guidelines, and ISO 27001 — a common source of conflation in general LLM responses.
What it does:
Trigger phrases: DORA, Regulation (EU) 2022/2554, digital operational resilience, ICT risk management framework, DORA gap analysis, Art. 6 DORA, Art. 17 ICT incident, Art. 18 classification, Art. 19 incident reporting, Art. 26 TLPT, Art. 28 third-party risk, Art. 30 contractual provisions, Register of Information, CIR 2024/2956, CDR 2024/1772, CDR 2024/1773, CDR 2024/1774, CDR 2025/301, CDR 2025/1190, TLPT financial entities, ICT concentration risk, critical ICT TPSP, DORA vs NIS2, EBA ICT guidelines DORA, DORA incident classification, DORA reporting timelines, Chapter II DORA, Chapter III DORA
File: DPDPA - Claude Skill/dpdpa.skill
The DPDPA skill turns Claude into an expert advisor on India's Digital Personal Data Protection Act, 2023 and the finalized DPDP Rules, 2025 (notified 13 November 2025, effective 13 May 2027). It covers all 44 sections of the Act and all 23 Rules, with precise section-level citations, GDPR-alignment mapping, and guidance calibrated for both Indian companies and global organizations with Indian data subjects.
What it does:
Trigger phrases: DPDPA, Digital Personal Data Protection Act, India data protection, Data Fiduciary, Data Principal, Significant Data Fiduciary, SDF, Data Protection Board of India, DPBI, DPDP Rules 2025, Section 5 DPDPA, Section 6 DPDPA, Section 7 DPDPA, Section 8 DPDPA, Section 9 DPDPA, Section 10 DPDPA, Rule 3 DPDP, Rule 6 DPDP breach notification, Rule 12 parental consent, India privacy law, India digital privacy, DPDPA gap analysis, DPDPA vs GDPR, India data law, MeitY data protection, DigiLocker consent, India children data law, DPDPA consent requirements, DPDPA breach notification, India cross-border data transfer
CMMC 2.0 [US] — Cybersecurity Maturity Model CertificationFile: CMMC - Claude Skill/cmmc.skill
The CMMC 2.0 skill turns Claude into an expert CMMC compliance advisor for US defense contractors navigating the Cybersecurity Maturity Model Certification program. It covers all three CMMC levels — Level 1 (17 FAR 52.204-21 practices), Level 2 (110 NIST SP 800-171 Rev 2 practices), and Level 3 (110+ NIST SP 800-172 requirements) — under the final 32 CFR Part 170 rule (effective December 16, 2024).
What it does:
Trigger phrases: CMMC, CMMC 2.0, CMMC Level 2, CUI, Controlled Unclassified Information, NIST 800-171, DFARS 7021, DFARS 252.204-7021, C3PAO, SPRS score, defense contractor, DIB, DoD contractor, FCI, SSP CMMC, POA&M CMMC, gap analysis CMMC, DIBCAC, CUI scoping, 32 CFR Part 170
File: NIST AI RMF - Claude Skill/nist-ai-rmf.skill
The NIST AI RMF skill turns Claude into an expert advisor on the NIST AI Risk Management Framework (AI RMF 1.0), published January 2023 as NIST AI 100-1. It covers all four core functions — GOVERN, MAP, MEASURE, and MANAGE — with their 19 categories and subcategories, the AI RMF Playbook's suggested actions, and deep guidance on evaluating AI systems for trustworthiness.
What it does:
Trigger phrases: NIST AI RMF, AI RMF, NIST AI 100-1, AI Risk Management Framework, GOVERN function, MAP function, MEASURE function, MANAGE function, AI RMF Playbook, AI risk profile, AI trustworthiness, AI bias assessment, AI explainability, MEASURE 2.2, AI risk register, AI organizational profile, responsible AI framework, AI governance framework, AI incident response, AI RMF gap assessment
File: SWIFT CSP - Claude Skill/swift-csp.skill
The SWIFT CSP skill turns Claude into an expert advisor on the SWIFT Customer Security Controls Framework (CSCF) v2025 — the mandatory cybersecurity programme for all SWIFT network participants. It covers all 31 controls (23 mandatory + 8 advisory), all five architecture types (A1/A2/A3/A4/B), the KYC-SA annual attestation process, and complete cross-framework mappings to ISO 27001:2022, PCI DSS v4.0.1, and NIST CSF 2.0.
What it does:
Trigger phrases: SWIFT CSP, CSCF, KYC-SA, SWIFT security attestation, Alliance Access, SWIFT operator MFA, SWIFT secure zone, SWIFT secure flow zone, CSCF v2025, Control 4.2 SWIFT, Control 6.4 SWIFT, Control 7.1 SWIFT, SWIFT architecture type A1, SWIFT service bureau, Type B SWIFT, SWIFT incident response, SWIFT gap assessment, SWIFT mandatory controls, SWIFT hardware token, SWIFT log retention
File: ISM - Claude Skill/ism.skill
The ISM skill turns Claude into an expert advisor on the Australian Information Security Manual — the whole-of-government cybersecurity framework published by the Australian Signals Directorate (ASD) for Australian federal and state government entities and their supply chains. It covers all 22 guideline chapters, the six-step risk management cycle, control applicability markings (NC/OS/PROTECTED/SECRET/TOP SECRET), the IRAP assessment programme, system authorisation, and the Essential Eight relationship.
What it does:
Trigger phrases: ISM, Information Security Manual, ASD cybersecurity, IRAP assessment, IRAP assessor, system authorisation, ATO Australia, PROTECTED system, OFFICIAL Sensitive, NC OS PROTECTED, Essential Eight, ASD compliance, Australian government cybersecurity, ISM controls, ISM gap analysis, ISM chapter, ISM hardening, ISM OSCAL, cyber.gov.au, ASD IRAP
File: NIS2 - Claude Skill/nis2.skill
The NIS2 skill turns Claude into an expert advisor on the EU NIS2 Directive (Directive (EU) 2022/2555) — the European Union's overarching cybersecurity framework for essential and important entities. In force since 27 December 2022 (transposition deadline 17 October 2024), NIS2 replaces the original NIS1 Directive and significantly expands scope, strengthens incident reporting obligations, introduces management body accountability, and raises maximum penalties to €10M or 2% of global turnover.
What it does:
Trigger phrases: NIS2, NIS 2, Directive EU 2022 2555, essential entity, important entity, NIS2 compliance, NIS2 incident reporting, Article 21 NIS2, Article 23 NIS2, NIS2 gap analysis, NIS2 policy, NIS2 supply chain, NIS2 governance, NIS2 risk management, ENISA NIS2, NIS2 penalties, NIS2 transposition, NIS2 and DORA, NIS2 and ISO 27001, network information security directive
CCPA/CPRA [California] PrivacyFile: CCPA - Claude Skill/ccpa.skill
The CCPA/CPRA skill turns Claude into an expert advisor on California's comprehensive privacy laws — the California Consumer Privacy Act (CCPA, effective January 1, 2020) and the California Privacy Rights Act (CPRA/Proposition 24, effective January 1, 2023). CPRA significantly expanded CCPA, created the California Privacy Protection Agency (CPPA), introduced Sensitive Personal Information (SPI) as a new category, and added rights to correct PI, limit SPI use, and set retention periods.
What it does:
Trigger phrases: CCPA, CPRA, California Consumer Privacy Act, California Privacy Rights Act, Do Not Sell or Share, sensitive personal information California, CPPA, California privacy compliance, right to know California, right to delete California, California opt-out, GPC signal, Global Privacy Control, ad tech CCPA, CCPA gap analysis, CCPA vs GDPR, California data privacy, CCPA service provider, CCPA third party, CCPA penalty
ITAR [US] — International Traffic in Arms RegulationsFile: ITAR - Claude Skill/itar.skill
The ITAR skill turns Claude into an expert advisor on US defense export controls under 22 CFR Parts 120–130, administered by the Directorate of Defense Trade Controls (DDTC) at the US State Department. ITAR controls the export, re-export, and transfer of defense articles, defense services, and related technical data enumerated on the United States Munitions List (USML).
What it does:
Trigger phrases: ITAR, International Traffic in Arms Regulations, USML, United States Munitions List, DDTC, defense export, deemed export, TAA, technical assistance agreement, MLA, manufacturing license agreement, DSP-5, DSP-73, ITAR registration, ITAR violation, voluntary disclosure ITAR, ITAR vs EAR, commodity jurisdiction, defense article, defense service, ITAR compliance, technology control plan, Empowered Official
LGPD [Brazil] — General Data Protection LawFile: LGPD - Claude Skill/lgpd.skill
The LGPD skill turns Claude into an expert advisor on Brazil's Lei Geral de Proteção de Dados Pessoais (Law 13,709/2018), the comprehensive Brazilian data protection law enforced by the ANPD (Autoridade Nacional de Proteção de Dados). LGPD applies extraterritorially to any organisation processing personal data of individuals located in Brazil.
Trigger phrases: LGPD, Brazil data protection, Lei Geral de Proteção de Dados, ANPD, Brazilian privacy law, LGPD compliance, LGPD gap assessment, Encarregado, RIPD, LGPD legal basis, LGPD data subject rights, Brazil data breach, ANPD notification, LGPD vs GDPR, Brazil personal data, LGPD penalty, Brazil privacy policy
CSRD [EU] — Corporate Sustainability Reporting DirectiveFile: CSRD - Claude Skill/csrd.skill
The CSRD skill turns Claude into an expert advisor on EU Directive 2022/2464 (CSRD), which requires approximately 50,000 companies to disclose detailed environmental, social, and governance (ESG) information under the European Sustainability Reporting Standards (ESRS). CSRD came into force on 5 January 2023 and replaces the Non-Financial Reporting Directive (NFRD).
Trigger phrases: CSRD, Corporate Sustainability Reporting Directive, ESRS, double materiality, double materiality assessment, DMA, ESG reporting Europe, sustainability disclosure EU, non-financial reporting, ESRS E1, ESRS S1, ESRS G1, Scope 3 CSRD, transition plan ESRS, CSRD gap assessment, CSRD scope, EU sustainability reporting, ESRS assurance, XBRL sustainability, CSRD vs GRI, CSRD vs TCFD, EU Taxonomy CSRD, NFRD CSRD, ESRS materiality
File: CIS Controls - Claude Skill/cis-controls.skill
The CIS Controls v8 skill turns Claude into an expert CIS Controls advisor covering all 18 CIS Controls and 153 safeguards from the May 2021 v8 release, including explicit cloud and mobile coverage. It applies the Implementation Group (IG) framework — IG1 (56 safeguards, essential cyber hygiene), IG2 (130 safeguards, intermediate), and IG3 (153 safeguards, advanced) — to scope guidance to each organization's risk profile and resource level.
What it does:
Trigger phrases: CIS Controls, CIS Top 18, CIS v8, CIS Controls v8, Implementation Group, IG1, IG2, IG3, CIS safeguards, cyber hygiene controls, CIS gap assessment, CIS Controls NIST mapping, CIS Benchmarks, CIS CSAT, asset inventory CIS, vulnerability management CIS, CIS Controls ISO 27001, CIS Controls SOC 2, CIS Controls PCI DSS, CIS Controls CMMC, CIS Controls NIST CSF
File: EAR - Claude Skill/ear.skill
The EAR skill turns Claude into an expert Export Administration Regulations advisor with deep knowledge of all 15 CFR Parts 730–774, administered by the Bureau of Industry and Security (BIS). It guides exporters, manufacturers, technology companies, and compliance professionals through the full dual-use export control lifecycle — from item classification to licence analysis to enforcement response.
What it does:
Trigger phrases: EAR, Export Administration Regulations, ECCN, EAR99, BIS, export control, Commerce Control List, CCL, dual-use export, export licence, Entity List, Denied Persons List, deemed export, FDPR, Foreign Direct Product Rule, licence exception, ENC exception, voluntary self-disclosure, VSD, SNAP-R, export compliance programme, ECP, restricted party screening, export to China, export to Russia, de minimis rule, CCATS, EAR vs ITAR
File: NIST 800-53 - Claude Skill/nist-800-53.skill
The NIST SP 800-53 skill turns Claude into an expert federal security and privacy controls advisor covering the full SP 800-53 Rev 5 catalog (September 2020) and its companion publications — SP 800-53B baselines, SP 800-53A assessment procedures, and SP 800-37 Rev 2 Risk Management Framework. It serves federal agency teams, cloud service providers pursuing FedRAMP, system owners, ISSOs, and GRC professionals implementing FISMA-mandated controls.
What it does:
Trigger phrases: NIST SP 800-53, SP 800-53, NIST 800-53, federal security controls, RMF, Risk Management Framework, FISMA, ATO, Authority to Operate, FIPS 199, FIPS 200, FIPS 140, SP 800-53B, control baseline, Low baseline, Moderate baseline, High baseline, SSP narrative, System Security Plan, POA&M, Plan of Action, ConMon, continuous monitoring, SP 800-53A, security assessment, ODV, organization-defined value, control tailoring, common controls, inherited controls, AC-2, IA-2, SC-8, SI-2, SR family, PT family, supply chain risk, OSCAL, 3PAO, FedRAMP controls, ISSO, system owner, authorizing official
File: EU AI Act - Claude Skill/eu-ai-act.skill
The EU AI Act skill turns Claude into an expert EU AI Act compliance advisor covering the full Regulation (EU) 2024/1689 — the world's first comprehensive horizontal AI regulation, in force from 1 August 2024. It serves AI providers, deployers, importers, and authorised representatives operating in or placing AI on the EU market.
What it does:
Trigger phrases: EU AI Act, AI Act, Regulation 2024/1689, high-risk AI, prohibited AI, GPAI model, general-purpose AI, AI system classification, AI conformity assessment, CE marking AI, EU AI database, AI Office, AI Board, systemic risk AI, Art. 5 AI, Annex III AI, AI provider obligations, AI deployer obligations, human oversight AI, AI risk management, Art. 50 transparency, chatbot disclosure AI, AI Act compliance, GPAI obligations, open-source AI Act, AI Act penalty, AI Act timeline, AI Act GDPR
File: Section 508 - Claude Skill/section-508.skill
The Section 508 skill turns Claude into an expert US federal ICT accessibility compliance advisor covering the Revised Section 508 Standards (2018) (36 CFR Part 1194), which incorporate WCAG 2.0 Level A and AA as the technical standard for web content, software, and electronic documents. It supports federal agencies, contractors, and ICT vendors across the full compliance lifecycle — from accessibility audits and VPAT completion to PDF remediation, procurement RFP language, and undue burden determinations.
What this skill covers:
Trigger phrases: Section 508, 508 compliance, WCAG federal, VPAT, ACR accessibility, accessibility conformance report, ICT accessibility, federal accessibility, POUR principles, web accessibility 508, keyboard accessibility audit, screen reader testing, PDF accessibility, accessible federal website, undue burden 508, assistive technology testing, FAR 52.239-2, 508 procurement, JAWS testing, VoiceOver compliance, axe accessibility, colour contrast 508, focus visible 508, alt text federal
File: WCAG - Claude Skill/wcag.skill
The WCAG skill turns Claude into an expert advisor on WCAG 2.0, 2.1, and 2.2 — the W3C international standard for digital accessibility developed by the Web Accessibility Initiative (WAI). WCAG underpins accessibility laws worldwide: the EU EAA (EN 301 549), US Section 508 and ADA, UK Equality Act, and Australia's DDA all reference WCAG conformance. Supports developers, designers, product teams, and legal/compliance teams working on web, mobile, and digital content accessibility.
Key capabilities:
Trigger phrases: WCAG, WCAG 2.1, WCAG 2.2, web accessibility, POUR principles, accessibility audit, colour contrast, screen reader, keyboard accessibility, ARIA, focus visible, reflow, accessibility statement, EN 301 549, European Accessibility Act, WCAG conformance, success criteria, alt text, captions accessibility, SC 1.4.3, SC 4.1.2, NVDA, VoiceOver, JAWS screen reader, WCAG 2.2 upgrade
File: NZISM - Claude Skill/nzism.skill
The NZISM skill turns Claude into an expert advisor on the New Zealand Information Security Manual (NZISM) — the mandatory cybersecurity framework published by the Government Communications Security Bureau (GCSB) / National Cyber Security Centre (NCSC NZ) for NZ government agencies and their supply chains. It covers the NZ Government Information Classification System (ISCS) from Unclassified through Top Secret, all 18+ NZISM control sections, the Certification & Accreditation (C&A) process, and mandatory agency obligations.
Key capabilities:
Trigger phrases: NZISM, NZ government security, GCSB compliance, NCSC NZ, Restricted system NZ, Confidential system NZ, NZ information classification, agency security policy NZ, system certification NZ, C&A NZ, government cybersecurity New Zealand, NZISM gap analysis, NZISM controls, NZ classification ISCS, NZISM policy
File: Vietnam PDPL - Claude Skill/vn-pdpl.skill
The Vietnam PDPL skill turns Claude into an expert advisor on Vietnam's Law on Personal Data Protection No. 91/2025/QH15 — the country's first comprehensive personal data protection law, effective 1 January 2026 — and its implementing regulation Decree 356/2025/ND-CP. Administered by the Ministry of Public Security, the law applies to Vietnamese entities and foreign organisations processing personal data of Vietnamese citizens (extraterritorial reach).
Key capabilities:
Trigger phrases: Vietnam data privacy, VN-PDPL, Law 91/2025, Nghị định 356, Vietnamese personal data, Vietnam PDPL, cross-border transfer Vietnam, Vietnam breach notification, Vietnam data protection, Vietnamese data subjects
File: EU CRA - Claude Skill/eu-cra.skill
The EU CRA skill turns Claude into an expert advisor on Regulation (EU) 2024/2847 — the EU Cyber Resilience Act, published 20 November 2024 and fully applicable from 11 December 2027. This landmark regulation mandates cybersecurity requirements for all Products with Digital Elements (PDEs) — connected hardware and software — sold in the EU market, covering manufacturers, importers, and distributors.
Key capabilities:
Trigger phrases: EU CRA, Cyber Resilience Act, CRA compliance, product with digital elements, PDE, Annex I requirements, CRA conformity assessment, CE marking cybersecurity, SBOM EU regulation, ENISA vulnerability reporting, Class I CRA, Class II CRA, connected product security EU, IoT security regulation EU
| Scenario | Relevant Skill(s) |
|---|---|
| Preparing for an ISO 27001:2022 Stage 2 certification audit | ISO 27001 |
| Writing an Information Security Policy mapped to Annex A | ISO 27001 |
| Running a SOC 2 readiness assessment before engaging an auditor | SOC 2 |
| Documenting controls for a SOC 2 Type 2 report | SOC 2 |
| Scoping a FedRAMP Moderate authorization on AWS GovCloud | FedRAMP |
| Writing SSP control narratives for all 20 NIST 800-53 control families | FedRAMP |
| Auditing an API for GDPR compliance before product launch | GDPR |
| Drafting a DPIA for a new AI feature that processes personal data | GDPR |
| Generating a BAA for a healthcare SaaS vendor relationship | HIPAA |
| Assessing whether a data incident constitutes a reportable HIPAA breach | HIPAA |
| Building a compliance program that satisfies both ISO 27001 and SOC 2 | ISO 27001 + SOC 2 |
| Responding to a customer security questionnaire covering multiple frameworks | All skills |
| Onboarding a new compliance engineer who needs framework context quickly | Any skill |
| Preparing a risk register and treatment plan for an ISMS | ISO 27001 |
| Transitioning from ISO 27001:2013 to ISO 27001:2022 | ISO 27001 |
| Preparing for a FedRAMP Rev 4 → Rev 5 transition | FedRAMP |
| Assessing current cybersecurity posture using NIST CSF 2.0 | NIST CSF |
| Building a CSF organisational profile with Current and Target states | NIST CSF |
| Advancing from CSF Implementation Tier 1 to Tier 2 | NIST CSF |
| Migrating a cybersecurity programme from CSF 1.1 to CSF 2.0 | NIST CSF |
| Mapping ISO 27001 or SOC 2 controls to NIST CSF subcategories | NIST CSF + ISO 27001 / SOC 2 |
| Writing a Cybersecurity Governance Policy aligned to the CSF GV function | NIST CSF |
| Scoping a PCI DSS CDE for a cloud-hosted e-commerce platform | PCI DSS |
| Selecting the right SAQ type for a merchant using a hosted payment page | PCI DSS |
| Preparing for a Level 1 ROC with a QSA | PCI DSS |
| Implementing the new PCI DSS v4.0 payment page script integrity requirements | PCI DSS |
| Extending MFA to all CDE access per Req 8.4.2 | PCI DSS |
| Managing third-party service providers under PCI DSS Req 12.8 | PCI DSS |
| Determining whether your pipeline or rail operation is a TSA covered entity | TSA Cybersecurity |
| Drafting a Cybersecurity Implementation Plan (CIP) for pipeline OT/SCADA environments | TSA Cybersecurity |
| Planning and documenting annual IRP testing for TSA directive compliance | TSA Cybersecurity |
| Responding to ransomware on IT that may spread to OT — reporting obligations to CISA | TSA Cybersecurity |
| Conducting an Architecture Design Review (ADR) for IT/OT network segmentation | TSA Cybersecurity |
| Implementing MFA and PAM for legacy OT/HMI systems with limited native controls | TSA Cybersecurity |
| Understanding what changes if TSA's November 2024 NPRM becomes final regulation | TSA Cybersecurity |
| Aligning a TSA CRMP to NIST CSF 2.0 and CISA Cross-Sector CPGs | TSA Cybersecurity + NIST CSF |
| Running an ISO 42001 gap assessment for an AI provider with multiple ML models in production | ISO 42001 |
| Completing an AI System Impact Assessment (AISIA) for an automated hiring tool | ISO 42001 |
| Building a Statement of Applicability (SoA) covering all 38 ISO 42001 Annex A controls (A.2–A.10) | ISO 42001 |
| Drafting an AI Policy and AI Acceptable Use Policy for a financial services firm | ISO 42001 |
| Assessing whether a customer-facing AI system requires high-impact controls under ISO 42001 | ISO 42001 |
| Preparing evidence packages for ISO 42001 Stage 1 and Stage 2 certification audits | ISO 42001 |
| Mapping ISO 42001 AISIA requirements to EU AI Act Fundamental Rights Impact Assessment (FRIA) | ISO 42001 |
| Integrating an ISO 42001 AIMS with an existing ISO 27001 ISMS | ISO 42001 + ISO 27001 |
| Governing staff use of public AI tools (ChatGPT, Copilot) under Annex A control A.9.2 and A.9.4 | ISO 42001 |
| Running an ISO 27701:2025 gap assessment for a SaaS company acting as both PII controller and processor | ISO 27701 |
| Transitioning from ISO 27701:2019 certification to the 2025 standalone edition | ISO 27701 |
| Drafting a GDPR-aligned Data Processing Agreement (DPA) with all required Article 28 clauses | ISO 27701 |
| Building a Records of Processing Activities (RoPA) covering all processing operations | ISO 27701 |
| Completing a DPIA for a new AI feature that profiles users for targeted advertising | ISO 27701 |
| Implementing a Data Subject Rights handling procedure with response SLAs | ISO 27701 |
| Mapping ISO 27701:2025 controls to GDPR articles for a compliance audit | ISO 27701 |
| Assessing sub-processor management obligations for a cloud-native B2B SaaS | ISO 27701 |
| Integrating a PIMS with an existing ISO 27001:2022 ISMS to avoid duplicating controls | ISO 27701 + ISO 27001 |
| Running a DORA gap analysis for an EU credit institution ahead of a supervisory review | DORA |
| Classifying an ICT incident against Art. 18 criteria and CDR (EU) 2024/1772 thresholds | DORA |
| Building a three-stage incident reporting procedure (4h / 72h / 1 month) per Art. 19 | DORA |
| Reviewing ICT vendor contracts against Art. 30(2) mandatory provisions | DORA |
| Building or validating the Register of Information per CIR (EU) 2024/2956 | DORA |
| Assessing ICT concentration risk for a bank reliant on a single hyperscaler | DORA |
| Scoping a TLPT programme and evaluating whether the Art. 26 threshold applies | DORA |
| Drafting an ICT Third-Party Risk Policy satisfying CDR (EU) 2024/1773 | DORA |
| Advising on the interaction between DORA and NIS2 for a financial entity | DORA |
| Mapping DORA obligations to legacy EBA ICT guidelines and identifying what changed | DORA |
| Running a DPDPA gap analysis for an Indian SaaS company ahead of the May 2027 compliance deadline | DPDPA |
| Identifying which GDPR-compliant processing activities need fresh consent or re-mapping under DPDPA | DPDPA + GDPR |
| Designing a notice compliant with Section 5 and Rule 3, including multi-language obligations | DPDPA |
| Implementing a 72-hour breach notification pipeline per Section 8(6) and Rule 6 | DPDPA |
| Designing a children's data compliance programme with Rule 12 parental verification (DigiLocker, virtual tokens) | DPDPA |
| Assessing whether a digital platform must eliminate targeted advertising and behavioural tracking for under-18 users | DPDPA |
| Advising a global company on its India data transfer obligations — blacklist approach vs. GDPR's whitelist | DPDPA |
| Preparing for potential Significant Data Fiduciary designation — DPO appointment, DPIA, and audit readiness | DPDPA |
| Updating Data Processing Agreements with vendors to satisfy Rule 16 | DPDPA |
| Assessing whether a company relying on legitimate interests for analytics must obtain consent under DPDPA | DPDPA |
| Building a Data Principal rights fulfilment procedure covering access, correction, erasure, and nomination | DPDPA |
| Determining your CMMC level based on contract DFARS clauses and CUI handling | CMMC 2.0 |
| Running a CMMC Level 2 gap assessment across all 110 NIST SP 800-171 practices | CMMC 2.0 |
| Drafting a System Security Plan (SSP) covering all 110 practices with implementation narratives | CMMC 2.0 |
| Calculating your SPRS score and prioritising the highest-impact gap remediations | CMMC 2.0 |
| Preparing for a C3PAO assessment — evidence packages, critical practices, POA&M rules | CMMC 2.0 |
| Scoping CUI within your organisation and designing an enclave to reduce CMMC scope | CMMC 2.0 |
| Managing DFARS 252.204-7012 incident reporting obligations (72-hour DIBNET reporting) | CMMC 2.0 |
| Flowing down CMMC requirements to subcontractors handling CUI | CMMC 2.0 |
| Building an AI organizational profile using NIST AI RMF Current and Target states | NIST AI RMF |
| Running a GOVERN gap assessment for an organization starting its AI risk programme | NIST AI RMF |
| Evaluating a credit scoring model against MEASURE 2.x trustworthiness criteria | NIST AI RMF |
| Building an AI risk register mapped to NIST AI RMF categories for a deployed ML system | NIST AI RMF |
| Mapping NIST AI RMF to the EU AI Act Article 9 risk management system requirement | NIST AI RMF + ISO 42001 |
| Assessing bias and fairness of a hiring AI tool (demographic parity, equalized odds, EEOC 4/5ths rule) | NIST AI RMF |
| Designing a post-deployment AI monitoring programme using MEASURE 3.x and MANAGE 3.x | NIST AI RMF |
| Integrating NIST AI RMF with an existing NIST CSF programme | NIST AI RMF + NIST CSF |
| Determining your SWIFT architecture type (A1/A2/A3/A4/B) and getting the full CSCF v2025 control applicability matrix | SWIFT CSP |
| Running a CSCF v2025 gap assessment for an Alliance Access on-premises deployment | SWIFT CSP |
| Understanding why software OTP (Google Authenticator) fails Control 4.2 and remediating with hardware tokens before July attestation | SWIFT CSP |
| Preparing all evidence and completing the annual KYC-SA attestation via swift.com/myswift | SWIFT CSP |
| Developing a SWIFT-specific incident response plan covering 24-hour SWIFT notification and 30-day report obligations | SWIFT CSP |
| Verifying your service bureau's (Type B) KYC-SA attestation and understanding split control responsibilities | SWIFT CSP |
| Mapping existing ISO 27001 or PCI DSS controls to CSCF requirements to identify SWIFT-specific gaps | SWIFT CSP + ISO 27001 / PCI DSS |
| Remediating common CSCF non-compliance patterns: shared VLAN, stale patches, missing SIEM coverage, token inventory gaps | SWIFT CSP |
| Understanding which ISM control applicability markings (NC/OS/PROTECTED) apply to an Australian government cloud system | ISM |
| Preparing artefacts for an IRAP assessment of a PROTECTED-level system | ISM |
| Hardening a Windows Server 2022 deployment to ISM Chapter 13 requirements with evidence checklist | ISM |
| Mapping Essential Eight Maturity Level 2 requirements to their ISM guideline chapters | ISM |
| Understanding ISM compliance obligations for a private sector cloud provider under a government contract | ISM |
| Drafting a System Security Plan (SSP) for ATO sign-off on an OFFICIAL: Sensitive system | ISM |
| Understanding approved cryptographic algorithms and log retention periods under the ISM | ISM |
| Comparing ISM requirements with ISO 27001 controls to identify government-specific gaps | ISM + ISO 27001 |
| Determining whether a European energy company is an Essential or Important Entity under NIS2 and understanding its obligations | NIS2 |
| Walking through the NIS2 Art. 23 incident reporting workflow (24h/72h/1-month) after a ransomware attack | NIS2 |
| Performing a gap analysis between an existing ISO 27001:2022 ISMS and full NIS2 compliance | NIS2 + ISO 27001 |
| Drafting an NIS2-compliant incident response policy covering all 10 Art. 21 measures and Art. 23 reporting timelines | NIS2 |
| Explaining the DORA lex specialis relationship and identifying residual NIS2 obligations for a European bank | NIS2 + DORA |
| Understanding Art. 20 management body obligations, personal liability, and required cybersecurity training under NIS2 | NIS2 |
| Assessing supply chain security obligations under NIS2 Art. 21(2)(d) and Art. 26 ENISA coordinated risk assessments | NIS2 |
| Calculating maximum NIS2 penalty exposure and comparing EE vs IE supervisory regimes (Art. 32 vs Art. 33) | NIS2 |
| Determining whether a US e-commerce business meets any CCPA/CPRA threshold and understanding its core obligations | CCPA/CPRA |
| Handling a combined right-to-know and right-to-delete request from a California consumer, including identity verification and exceptions | CCPA/CPRA |
| Assessing whether sharing cookie IDs with an ad tech platform constitutes a CCPA 'sale' or CPRA 'sharing', and implementing opt-out mechanisms | CCPA/CPRA |
| Performing a gap analysis between an existing GDPR programme and CCPA/CPRA — identifying California-specific additions | CCPA/CPRA + GDPR |
| Classifying precise geolocation, health, and biometric data as CPRA Sensitive Personal Information and understanding the 15-business-day SPI limitation workflow | CCPA/CPRA |
| Drafting an at-collection privacy notice and a comprehensive privacy policy meeting all CCPA/CPRA disclosure requirements | CCPA/CPRA |
| Implementing Global Privacy Control (GPC) signal recognition as a valid opt-out from sale/sharing | CCPA/CPRA |
| Assessing CPPA enforcement risk and calculating penalty exposure for unintentional vs. intentional CCPA/CPRA violations | CCPA/CPRA |
| Determining whether a small professional services firm needs IG1, IG2, or IG3 controls — and getting a scoped 12-week quick-start plan | CIS Controls v8 |
| Running a CIS Controls v8 gap assessment for a healthcare organisation and mapping findings to HIPAA Security Rule safeguards | CIS Controls v8 + HIPAA |
| Implementing all 56 IG1 safeguards across endpoints, user accounts, backups, and training — prioritised by security impact | CIS Controls v8 |
| Deploying MFA across external applications, remote access, and admin accounts (Safeguards 6.3/6.4/6.5) and selecting phishing-resistant options | CIS Controls v8 |
| Mapping CIS Controls v8 to NIST CSF 2.0 subcategories for a cross-framework compliance programme | CIS Controls v8 + NIST CSF |
| Building a vulnerability management programme with authenticated scans, CVSS-based remediation SLAs, and tracking KPIs | CIS Controls v8 |
| Designing a SIEM and log management programme per Control 8 — what events to collect, retention standards, and NTP synchronisation | CIS Controls v8 |
| Classifying an RF power amplifier under the EAR — ECCN determination and licence requirement analysis for export to Germany | EAR |
| Assessing deemed export obligations for a Chinese national employee accessing controlled encryption source code | EAR |
| Responding to a discovered Entity List re-export violation — voluntary self-disclosure process and penalty mitigation | EAR |
| Determining whether AES-256 cybersecurity software requires a BIS licence for export to France, India, and Brazil | EAR |
| Designing a 7-element Export Compliance Programme for a semiconductor equipment company with customers in Europe and Asia | EAR |
| Determining whether a foreign-made chip uses US-origin equipment subject to the Foreign Direct Product Rule (FDPR) | EAR |
| Applying the ENC licence exception for a commercial encryption product and completing the one-time BIS notification | EAR |
| Categorising a federal HR system under FIPS 199 and selecting the correct SP 800-53B baseline | NIST SP 800-53 |
| Documenting an AC-2(3) OTS finding from a security assessment and building the POA&M with FedRAMP remediation timelines | NIST SP 800-53 |
| Implementing phishing-resistant MFA under IA-2(1) and IA-2(2) to satisfy EO 14028 and OMB M-22-09 | NIST SP 800-53 |
| Writing an SSP control narrative for SC-8(1) Transmission Confidentiality covering TLS 1.2/1.3 with FIPS 140-3 modules | NIST SP 800-53 |
| Performing a gap analysis between ISO 27001:2022 and FedRAMP Moderate baseline and mapping RMF steps to ATO package | NIST SP 800-53 |
| Tailoring a Moderate baseline to remove inapplicable controls, set ODVs, and document compensating controls for a legacy system | NIST SP 800-53 |
| Building a ConMon strategy with monthly vulnerability scan frequencies, annual penetration testing, and POA&M update cadence | NIST SP 800-53 |
| Classifying an AI-powered CV screening tool for European employers under the EU AI Act — risk tier and provider obligations | EU AI Act |
| Assessing whether a predictive policing AI tool violates EU AI Act Art. 5 prohibited practices | EU AI Act |
| Determining GPAI model obligations for an open-source LLM with 3×10²⁴ FLOPs training compute | EU AI Act |
| Navigating dual regulation for an AI diagnostic imaging tool CE-marked under the EU Medical Devices Regulation | EU AI Act |
| Understanding Art. 50(1) chatbot disclosure obligations and deployer vs GPAI provider obligations for an e-commerce AI | EU AI Act |
| Completing a VPAT 2.x (ACR) for federal procurement of enterprise software — all three tables, testing methodology disclosure | Section 508 |
| Auditing a public-facing web application for Section 508 compliance using keyboard-only and screen reader testing | Section 508 |
| Remediating 200 legacy PDF documents for Section 508 — tagged structure, reading order, form field labels, Alt text | Section 508 |
| Writing FAR 52.239-2 accessibility requirements into a federal procurement RFP and evaluating vendor VPAT submissions | Section 508 |
| Preparing a formal undue burden determination and documenting the alternative means of access obligation | Section 508 |
| Auditing a React application for WCAG 2.2 AA compliance — colour contrast, keyboard navigation, ARIA, focus management | WCAG |
| Determining which WCAG version and conformance level is required for legal compliance across US, EU, and UK markets | WCAG |
| Reviewing a design system's colour palette against SC 1.4.3 and identifying accessible replacement values | WCAG |
| Drafting a full web accessibility statement for a public sector website meeting EU Web Accessibility Directive requirements | WCAG |
| Understanding what new success criteria must be met to upgrade a WCAG 2.1 AA conformance claim to WCAG 2.2 AA | WCAG |
| Conducting a gap analysis for a NZ government agency deploying a Restricted-classified case management system | NZISM |
| Preparing a Certification & Accreditation (C&A) submission for a Restricted system — SSP, SRA, POA&M, and ATO sign-off | NZISM |
| Assessing whether hosting Restricted data on AWS Sydney meets NZISM obligations and what Accrediting Authority approvals are needed | NZISM |
| Drafting an NZISM-compliant Access Control Policy with embedded NZISM control IDs and a document classification block | NZISM |
| Advising on SaaS vendor due diligence and mandatory contractual security requirements under NZISM for In-Confidence data | NZISM |
| Running a VN-PDPL gap analysis for a foreign company processing Vietnamese personal data ahead of the 1 January 2026 effective date | VN-PDPL |
| Designing a valid consent mechanism under Vietnam Law 91/2025 — standalone notice, permitted formats, and withdrawal workflows | VN-PDPL |
| Building a 72-hour Ministry of Public Security breach notification workflow for a Vietnamese fintech after a data incident | VN-PDPL |
| Mapping an existing GDPR compliance programme to VN-PDPL — identifying gaps in lawful basis, DPO, and cross-border transfer rules | VN-PDPL + GDPR |
| Assessing cross-border data transfer obligations and preparing the impact assessment dossier under Article 20 for offshore cloud processing | VN-PDPL |
| Classifying a connected IoT product under EU CRA — Default, Class I, or Class II — and understanding the applicable conformity assessment route | EU CRA |
| Running an Annex I gap assessment for a software product placed on the EU market — all 10 Part I security properties and 9 Part II vulnerability obligations | EU CRA |
| Building a CRA-compliant vulnerability disclosure programme with coordinated disclosure, 24h/72h ENISA reporting, and CSIRT notification | EU CRA |
| Preparing technical documentation per Annex VII for a Class I product mandatory Notified Body conformity assessment | EU CRA |
| Implementing an SBOM programme in SPDX or CycloneDX format meeting EU CRA minimum content requirements and CI/CD integration | EU CRA |
Download the .skill file for the framework you need:
| Framework | Download |
|---|---|
| ISO 27001 | iso27001.skill |
| SOC 2 | soc2.skill |
| FedRAMP [US] | fedramp.skill |
| 🇪🇺 GDPR [EU] | gdpr-compliance.skill |
| HIPAA [US] | hipaa-compliance.skill |
| NIST CSF | NIST Cybersecurity.skill |
| PCI DSS | PCI-Compliance.skill |
| 🚨 TSA Cybersecurity [US] | TSA-Compliance.skill |
| 🤖 ISO 42001 AI Management System | ISO-42001.skill |
| 🔒 ISO 27701 Privacy Information Management | iso27701.skill |
| 🏦 DORA Digital Operational Resilience | dora.skill |
| 🇮🇳 DPDPA [India] — Digital Personal Data Protection Act | dpdpa.skill |
| 🛡️ CMMC 2.0 Cybersecurity Maturity Model Certification | cmmc.skill |
| 🤖 NIST AI Risk Management Framework | nist-ai-rmf.skill |
| 🏦 SWIFT Customer Security Programme (CSP) | swift-csp.skill |
| 🇦🇺 ISM [Australia] — Australian Information Security Manual | ism.skill |
| 🇪🇺 NIS2 [EU] Directive | nis2.skill |
| CCPA/CPRA [California] Privacy | ccpa.skill |
| ITAR [US] — International Traffic in Arms Regulations | itar.skill |
| LGPD [Brazil] — General Data Protection Law | lgpd.skill |
| CSRD [EU] — Corporate Sustainability Reporting Directive | csrd.skill |
| 🛡️ CIS Controls v8 — CIS Top 18 Cyber Hygiene | cis-controls.skill |
| 📦 EAR [US] — Export Administration Regulations | ear.skill |
| 🏛️ NIST SP 800-53 — Security and Privacy Controls for Federal Systems | nist-800-53.skill |
| 🤖 EU AI Act — Regulation (EU) 2024/1689 | eu-ai-act.skill |
| ♿ Section 508 [US] — Federal ICT Accessibility | section-508.skill |
| ♿ WCAG — Web Content Accessibility Guidelines | wcag.skill |
| 🇳🇿 NZISM [New Zealand] — Information Security Manual | nzism.skill |
| 🇻🇳 Vietnam PDPL — Law on Personal Data Protection | vn-pdpl.skill |
| 🇪🇺 EU CRA — Cyber Resilience Act | eu-cra.skill |
Open Claude and navigate to Customize → Skills.
Click Upload Skill and select the .skill file.
The skill is now active. Start a new conversation and ask your compliance question — Claude will automatically apply the skill.
Tip: You can install multiple skills at once. If you work across several frameworks (e.g., both ISO 27001 and SOC 2), install all of them — Claude will activate whichever is most relevant to each question.
If you use Claude Code — the AI-powered CLI for developers — these skills are also available as installable Claude Code plugins through a hosted marketplace. This is the recommended installation path for developers and teams, as it supports version-pinning, automatic updates, and team-wide distribution without any manual file handling.
Add the marketplace and install the skills you need directly from the terminal:
/plugin marketplace add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
/plugin install iso27001@grc-skills soc2@grc-skills fedramp@grc-skills gdpr-compliance@grc-skills hipaa-compliance@grc-skills nist-csf@grc-skills pci-compliance@grc-skills tsa-compliance@grc-skills iso42001@grc-skills iso27701@grc-skills dora@grc-skills dpdpa@grc-skills cmmc@grc-skills nist-ai-rmf@grc-skills swift-csp@grc-skills ism@grc-skills nis2@grc-skills ccpa@grc-skills itar@grc-skills lgpd@grc-skills csrd@grc-skills cis-controls@grc-skills ear@grc-skills nist-800-53@grc-skills eu-ai-act@grc-skills section-508@grc-skills wcag@grc-skills nzism@grc-skills vn-pdpl@grc-skills eu-cra@grc-skills
Teams can pre-wire the marketplace in .claude/settings.json so every developer gets the skills automatically when they open the project — no manual install required.
📖 Full installation instructions, team setup, and update guide → INSTALLATION.md
These skills were benchmarked using the Claude Skill Creator eval framework. 150 realistic test cases were run across all 30 skills — 5 per framework — covering gap analysis, policy drafting, control deep-dives, edge cases, and compliance advice scenarios. Each test case was evaluated against 5 objectively verifiable assertions by independent grader agents comparing skill-assisted vs. baseline Claude responses.
| Configuration | Pass Rate | Assertions Passed |
|---|---|---|
| With GRC Skills installed | 96% | 651 / 675 |
| Without skills (baseline Claude) | 81% | 547 / 675 |
| Delta | +15 points | +104 assertions |
| Skill | Test Cases | With Skill | Baseline | Delta | What Was Tested |
|---|---|---|---|---|---|
| ISO 27001 | 5 | 100% | 84% | +16% | Gap assessment; Policy drafting; 2013→2022 transition; Risk assessment; Management review CAP |
| SOC 2 | 5 | 100% | 84% | +16% | Type 1 vs 2; CC controls checklist; Availability criteria; Access control policy; Audit exception response |
| FedRAMP [US] | 5 | 84% | 76% | +8% | Authorization pathways; Impact levels; FedRAMP 20x; System boundary; POA&M remediation timelines |
| GDPR [EU] | 5 | 88% | 88% | +0% | US company checklist; Article 28 DPA; Subject access request; Cookie consent; 72-hour breach notification |
| HIPAA [US] | 5 | 92% | 88% | +4% | Covered entity analysis; BAA template; Encryption (addressable vs required); Risk analysis; Workforce violation |
| NIST CSF | 5 | 96% | 84% | +12% | CSF 2.0 overview; Ransomware recovery plan; Profile creation; Control mapping; Board reporting |
| PCI DSS | 5 | 92% | 88% | +4% | SAQ type selection; Req 3 stored data (v4.0); Breach obligations; Penetration testing; Tokenization scope |
| TSA Cybersecurity [US] | 5 | 100% | 96% | +4% | Pipeline directive requirements; CIRP elements; OT/IT segmentation; Airport applicability; TSA vs CIRCIA |
| ISO 42001 | 5 | 92% | 80% | +12% | AIMS applicability; Key requirements; AI-specific risks; Third-party LLM management; AI ethics controls |
| ISO 27701 | 5 | 100% | 80% | +20% | Extension to ISO 27001; GDPR mapping; Processor controls; PIA methodology; Certification as GDPR evidence |
| DORA [EU] | 5 | 88% | 72% | +16% | Five pillars; ICT incident reporting timelines; TLPT requirements; Third-party contracts; DORA vs EBA |
| DPDPA [India] | 5 | 96% | 80% | +16% | Applicability to foreign entities; Consent vs GDPR; Children's data (18-year threshold); Cross-border transfers; SDF obligations |
| CMMC 2.0 [US] | 5 | 100% | 100% | +0% | Level determination; SPRS scoring; CUI scoping; SSP structure; C3PAO assessment readiness |
| NIST AI RMF | 5 | 92% | 76% | +16% | Four functions overview; Hiring AI risk assessment; Credit scoring risk register; EU AI Act mapping; GOVERN gap assessment |
| SWIFT CSP | 5 | 100% | 48% | +52% | Architecture scoping (A1/A2/A3/A4/B); MFA hardware token requirement; CSCF v2025 gap assessment; KYC-SA attestation process; Incident response obligations |
| ISM [Australia] | 5 | 96% | 52% | +44% | OS control scoping and authorisation; IRAP assessment preparation; Chapter 13 system hardening; Essential Eight to ISM mapping; Supply chain cloud provider obligations |
| NIS2 [EU] | 5 | 96% | 80% | +16% | Energy company EE/IE classification; SaaS provider Art. 21 obligations; Ransomware Art. 23 reporting workflow; ISO 27001 vs NIS2 gap analysis; DORA lex specialis interaction |
| CCPA/CPRA [California] | 5 | 100% | 96% | +4% | E-commerce threshold analysis; Combined right-to-know and delete workflow; Ad tech sale vs sharing classification; GDPR-to-CCPA gap analysis; SPI classification for mobile app |
| ITAR [US] | 5 | 100% | 100% | 0% | USML jurisdiction analysis for military laptops; Deemed export for German engineer; DSP-73 temporary export for trade show; Violation and VSD process; TAA mandatory clauses for India |
| LGPD [Brazil] | 5 | 100% | 80% | +20% | Extraterritorial scope for US SaaS with Brazilian customers; Data deletion request across CRM/email/analytics; Sensitive health data marketing restrictions; Breach notification timelines (3 working days vs GDPR 72h); International transfer mechanisms to the US |
| CSRD [EU] | 5 | 100% | 72% | +28% | CSRD scope analysis for German listed manufacturer (PIE Wave 1); Double materiality vs GRI/TCFD; Post-DMA disclosure requirements for E1/S1/G1; GRI+TCFD to ESRS gap assessment; Non-EU company (US parent, €200M EU revenue) obligations |
| CIS Controls v8 | 5 | 100% | 80% | +20% | Implementation Group determination; Gap assessment for SaaS startup; MFA safeguard scoping (IG2); CIS v8 to NIST CSF 2.0 mapping; Vulnerability management programme with remediation SLAs |
| EAR [US] | 5 | 100% | 88% | +12% | RF amplifier ECCN classification for Germany export; Deemed export for Chinese/Australian dual national on 5D002; Entity List re-export violation and VSD process; AES-256 software ENC exception for France/India/Brazil; ECP design for semiconductor equipment company |
| NIST SP 800-53 | 5 | 92% | 84% | +8% | FIPS 199 categorization for federal HR system; AC-2(3) OTS finding and POA&M documentation; MFA controls and EO 14028 phishing-resistant MFA; SSP narrative for SC-8(1) Transmission Confidentiality; ISO 27001 to FedRAMP gap analysis and RMF steps |
| EU AI Act | 5 | 100% | 88% | +12% | CV screening tool high-risk classification under Annex III Area 4; Predictive policing Art. 5 prohibition analysis; Open-source GPAI model obligations with 3×10²⁴ FLOPs; AI diagnostic imaging tool dual MDR/AI Act regulation; E-commerce chatbot Art. 50(1) disclosure obligations |
| Section 508 [US] | 5 | 100% | 100% | 0% | VPAT 2.x ACR completion and testing methodology; Keyboard-only navigation failures and WCAG remediation; PDF forms accessibility remediation (200 PDFs); Federal procurement RFP requirements and VPAT evaluation; Undue burden exception process and alternative access obligations |
| WCAG [International] | 5 | 100% | 89% | +11% | Colour contrast audit (SC 1.4.3) with replacement suggestions; WCAG 2.2 upgrade criteria from 2.1 AA; React modal ARIA code review with corrected implementation; Legal compliance mapping across US/EU/UK; Accessibility statement for e-commerce site |
| NZISM [New Zealand] | 5 | 100% | 88% | +12% | Restricted system C&A gap analysis; AWS Sydney offshore hosting obligations; Access Control Policy with NZISM control IDs; Ransomware supplier incident response; SaaS vendor due diligence and contractual requirements |
| VN-PDPL [Vietnam] | 5 | 100% | 68% | +32% | Gap analysis for SaaS company with Vietnamese customers; Fintech breach notification 72-hour workflow; Micro-enterprise exemptions; Consent mechanism design; Consent withdrawal timeframes under Decree 356 |
| EU CRA [EU] | 5 | 100% | 80% | +20% | PDE scope and classification (Default/Class I/Class II); Annex I gap assessment for consumer IoT router; Vulnerability and ENISA reporting timelines; SBOM programme design; Manufacturer vs importer/distributor obligations |
📊 View the full eval results →
"This is awesome, thank you!" — Reddit u/ThePsychicCEO
"This is awesome! Any chance you can build one for ISO 42001?" — Reddit u/ComparisonThink7683
"As a rather new Claude Code user, I'm both impressed and thankful. It's really helpful that you release it publicly. I am at the stage where I understand the need for a well-written CLAUDE.md and skills. This will help me a lot." — Reddit u/bloulboi
"The skills approach is a good entry point — getting Claude to reason about specific frameworks is exactly the right instinct. The gap I kept hitting was that Claude could describe the compliance picture but couldn't act on it... this is a great start." — Reddit u/sensationweb
"Fantastic work. Going to follow this and test it out myself." — Reddit u/Efficient_Bus_923
"I've been doing something similar for the CIS controls and it's been brilliant so far. I'll be using this for ISO and SOC 2. Thanks!" — Reddit u/gpldn
"Hell ya. We just approved Claude for enterprise so I'll go check it out." — Reddit u/AcrobaticWatercress7
"I'll definitely check this out. I have a skill for threat modeling and am working on some other ones, this is super helpful." — Reddit u/lilgreenbite
"Awesome, thanks for sharing. I'm going to play around with this." — Reddit u/DeliciousNet593
Additional feedback from the Reddit community: r/grc · r/ClaudeAI
If you find an error, outdated regulatory reference, or missing coverage in any skill, please open a GitHub issue and include:
Have a compliance framework not covered here? Open a GitHub issue with the tag skill-request and describe the framework, your use case, and the audience it would serve. Community suggestions are welcome for frameworks such as NIST CSF, PCI DSS, CCPA, SOX, CMMC, and others.
Hemant Naik LinkedIn · hemant.naik@gmail.com
Built March 2026
The skills in this repository provide informational guidance based on publicly available regulatory and standards documentation. They do not constitute legal, audit, or professional compliance advice. Outputs should be reviewed by qualified professionals — such as a certified ISO 27001 Lead Auditor, licensed attorney, Data Protection Officer, or HIPAA compliance officer — before being relied upon for formal compliance purposes.
Regulatory requirements evolve. Always verify guidance against the latest official publications from the relevant standards body or regulatory authority.
Licensed under the MIT License.
npx CLI installing 100+ agents, commands, hooks, and integrations in one command
干净、强大、属于你的 AI Agent 平台 --AI agents, without the clutter.
Native macOS app to monitor Claude AI usage limits and watch your coding sessions live
Pocket Flow: Codebase to Tutorial