research
CommandStart or resume an academic research project — idea through literature, methodology, writing, feedback, and publishing
@grcengclubInstall CommandSecurity
Command
/saq-select
Help select the appropriate SAQ type
> /plugin marketplace add GRCEngClub/claude-grc-engineering
Command definition
saq-select.mddescription: Help select the appropriate SAQ type
SAQ Selection
Helps determine the appropriate Self-Assessment Questionnaire type.
Arguments
- `$1` - Business description or SAQ type (optional)
SAQ Types
| SAQ | For | Questions | |-----|-----|-----------| | **A** | Card-not-present, fully outsourced payment | ~20 | | **A-EP** | E-commerce with website affecting security | ~140 | | **B** | Imprint or standalone dial-out terminals | ~40 | | **B-IP** | Standalone IP-connected PTS POI terminals | ~80 | | **C** | Payment app connected to internet | ~150 | | **C-VT** | Web-based virtual terminal, no storage | ~80 | | **D-Merchant** | All other merchants | ~300+ | | **D-SP** | Service providers | ~300+ | | **P2PE** | Hardware terminals in validated P2PE solution | ~30 |
Selection Criteria
SAQ A Eligibility
- Card-not-present only (e-commerce, mail, phone)
- All payment processing outsourced
- No electronic cardholder data storage
- Website hosted entirely by PCI DSS compliant provider
SAQ A-EP Eligibility
- E-commerce only
- Website affects payment security (redirects, iframes)
- All payment processing outsourced
- No electronic cardholder data storage
SAQ B Eligibility
- Imprint-only machines, OR
- Standalone dial-out terminals (no IP)
- No electronic cardholder data storage
SAQ C Eligibility
- Payment application connected to internet
- No electronic cardholder data storage
- Standalone terminal or PC-based
Example
/pci-dss:saq-select "e-commerce with Stripe"
/pci-dss:saq-select A-EP
Read more
description: Help select the appropriate SAQ type
SAQ Selection
Helps determine the appropriate Self-Assessment Questionnaire type.
Arguments
- `$1` - Business description or SAQ type (optional)
SAQ Types
| SAQ | For | Questions | |-----|-----|-----------| | **A** | Card-not-present, fully outsourced payment | ~20 | | **A-EP** | E-commerce with website affecting security | ~140 | | **B** | Imprint or standalone dial-out terminals | ~40 | | **B-IP** | Standalone IP-connected PTS POI terminals | ~80 | | **C** | Payment app connected to internet | ~150 | | **C-VT** | Web-based virtual terminal, no storage | ~80 | | **D-Merchant** | All other merchants | ~300+ | | **D-SP** | Service providers | ~300+ | | **P2PE** | Hardware terminals in validated P2PE solution | ~30 |
Selection Criteria
SAQ A Eligibility
- Card-not-present only (e-commerce, mail, phone)
- All payment processing outsourced
- No electronic cardholder data storage
- Website hosted entirely by PCI DSS compliant provider
SAQ A-EP Eligibility
- E-commerce only
- Website affects payment security (redirects, iframes)
- All payment processing outsourced
- No electronic cardholder data storage
SAQ B Eligibility
- Imprint-only machines, OR
- Standalone dial-out terminals (no IP)
- No electronic cardholder data storage
SAQ C Eligibility
- Payment application connected to internet
- No electronic cardholder data storage
- Standalone terminal or PC-based
Example
/pci-dss:saq-select "e-commerce with Stripe" /pci-dss:saq-select A-EP
Ships withtrust-center
Open-source GRC Engineering resource for Claude. claude-grc-engineering turns technical evidence from cloud, SaaS, code, and security tools into framework-aligned findings, gap reports, remediation guidance, evidence packages, and OSCAL workflows.
430101 skills1 MCP
Stars on GitHub
Momentum
- stars in total
- 430
Other commands on trust-center.
@grcengclubInstall Commandcollect
CommandQuery AWS for compliance-relevant configuration across IAM, S3, CloudTrail, EBS, and emit findings conforming to the v1 contract.
@grcengclubInstall Commandsetup
CommandInstall the frdocx-to-froscal-ssp Python pipeline and verify its dependencies. Idempotent.
@grcengclubInstall Commandretrieve
CommandRetrieve a single AWS Secrets Manager secret value to stdout or a 0600-permission file. Opt-in retrieval mode — never writes to…
@grcengclubInstall Commandscan
CommandRun testssl.sh against one or more HTTPS endpoints and emit v1 Findings mapped to SOC 2, NIST 800-53, PCI DSS 4.0.1, ISO 27001,…
@grcengclubInstall CommandMore commands from other plugins.
audit
CommandAudit a file, directory, or whole repo for insecure default configuration: fallback secrets, default credentials, fail-open…
@trailofbitsInstall Commandagt-check
CommandCheck text against AGT prompt-injection, context-poisoning, and MCP threat detectors.
@microsoftInstall Commandarsenal
CommandShow which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from…
@awarexoneInstall Command