claude-skills-governance-risk-and-compliance

Claude Skills for Governance, Risk & Compliance (GRC)

Expert-level compliance guidance for ISO 27001, SOC 2, FedRAMP, GDPR, HIPAA, NIST CSF, PCI DSS, TSA Cybersecurity, ISO 42001 AI Management System, ISO 27701 Privacy Information Management, DORA Digital Operational Resilience, India's Digital Personal Data Protection Act (DPDPA), CMMC 2.0 Cybersecurity Maturity Model Certification, NIST AI Risk Management Framework, SWIFT Customer Security Programme (CSP), Australian Information Security Manual (ISM), EU NIS2 Directive, CCPA/CPRA California Privacy, ITAR (International Traffic in Arms Regulations), Brazil's LGPD (Lei Geral de Proteção de Dados), EU CSRD (Corporate Sustainability Reporting Directive), CIS Controls v8 (CIS Top 18), EAR (Export Administration Regulations), NIST SP 800-53 (Security and Privacy Controls for Federal Systems), EU AI Act (Regulation (EU) 2024/1689), Section 508 (US Federal ICT Accessibility), WCAG (Web Content Accessibility Guidelines), NZISM (New Zealand Information Security Manual), Vietnam PDPL (Law on Personal Data Protection No. 91/2025/QH15), EU CRA (Cyber Resilience Act, Regulation (EU) 2024/2847), Saudi Arabia GRC (NCA ECC, Saudi PDPL, SAMA, CST), UAE GRC (Federal PDPL, DIFC, ADGM, CBUAE, ICT Health Law), TISAX (VDA ISA / ENX automotive supplier security), TPRM (third-party/vendor risk), UK Cyber Essentials, and SOX ITGC — powered by Claude Skills. Updated Monthly.

Benchmarked across 180 test cases using the eval framework — each graded against at least 5 verifiable assertions by independent agents (902 assertions in total). Skills scored 89% vs a baseline of 55%.

Table of Contents

• What Are Claude Skills?
• Who Is This For?
• The Skills
  • ISO 27001
  • SOC 2
  • FedRAMP
  • GDPR
  • HIPAA
  • NIST CSF
  • PCI DSS
  • TSA Cybersecurity
  • ISO 42001 AI Management System
  • ISO 27701 Privacy Information Management
  • DORA Digital Operational Resilience
  • DPDPA India Digital Personal Data Protection
  • CMMC 2.0 Cybersecurity Maturity Model Certification
  • NIST AI Risk Management Framework
  • SWIFT Customer Security Programme (CSP)
  • Australian Information Security Manual (ISM)
  • EU NIS2 Directive
  • CCPA/CPRA California Privacy
  • ITAR — International Traffic in Arms Regulations
  • LGPD — Brazil's General Data Protection Law
  • CSRD — EU Corporate Sustainability Reporting Directive
  • CIS Controls v8 — CIS Top 18 Cyber Hygiene
  • EAR — Export Administration Regulations
  • NIST SP 800-53 — Security and Privacy Controls for Federal Systems
  • EU AI Act — Regulation (EU) 2024/1689
  • Section 508 — US Federal ICT Accessibility
  • WCAG — Web Content Accessibility Guidelines
  • NZISM — New Zealand Information Security Manual
  • Vietnam PDPL — Law on Personal Data Protection
  • EU CRA — Cyber Resilience Act
  • Saudi Arabia GRC — Country Compliance Advisor
  • UAE GRC — Country Compliance Advisor
  • TISAX — Trusted Information Security Assessment Exchange
  • TPRM — Third-Party Risk Management
  • Cyber Essentials / CE Plus — UK Baseline Certification
  • SOX ITGC — IT General Controls for SOX 404
• Potential Use Cases
• How to Install a Skill
• Install via Claude Code Marketplace
• Skill Evaluation
• Customer Testimonials
• Support
• Author
• Disclaimer

What Are Claude Skills?

Claude Skills are installable knowledge packages that extend Claude's capabilities for specific domains. A skill is a .skill file — a bundled archive containing a SKILL.md instruction file and optional reference materials — that you upload to Claude once and use across all your conversations.

Once installed, a skill activates automatically when your conversation touches its topic area. You don't need to invoke it by name or use special commands. Claude simply becomes a deeper expert in that domain for the duration of your session.

Skills are ideal when you need:

• Consistent, expert-level responses on a specialized topic
• Outputs formatted to professional or regulatory standards (e.g., audit-ready control narratives, policy templates with the right clauses)
• Domain knowledge that goes beyond general LLM training — such as knowing which specific NIST 800-53 controls apply to a given scenario, or which GDPR articles govern international data transfers

How skills work under the hood: Each .skill file contains a primary SKILL.md that is loaded into Claude's context when the skill triggers, plus reference files that are loaded on demand for deeper sub-topics. This "progressive disclosure" pattern keeps context usage efficient while making comprehensive knowledge available when needed.

Who Is This For?

These skills are designed for professionals who work on information security, privacy, and regulatory compliance — whether at organizations seeking certification, development teams building compliant systems, or advisors supporting clients.

Security & Compliance Teams use these skills to accelerate gap assessments, generate first-draft policies, map controls, and prepare evidence packages — compressing weeks of reference work into minutes.

Software Developers & Engineers use them to understand what controls their systems must implement, audit code and architecture for compliance issues, and get actionable technical guidance tied to specific regulatory requirements.

Legal, Privacy & GRC Professionals use them to draft regulatory documents (DPAs, BAAs, privacy notices), answer client questions with precise regulatory citations, and stay current on framework requirements.

Healthcare Organizations use the HIPAA skill to assess systems, generate required notices and agreements, and train staff on obligations — without needing a compliance consultant for every question.

Cloud Service Providers pursuing federal government contracts use the FedRAMP skill to navigate the ATO process, write SSP narratives, manage POA&Ms, and prepare for 3PAO assessments.

Startups and SMBs use these skills to understand what a given framework requires of them, scope their compliance programs, and get expert-quality output without a large in-house team.

The Skills

1. ISO 27001

File: ISO 27001 - Claude Skill/iso27001.skill

The ISO 27001 skill turns Claude into an expert ISO 27001 Lead Auditor and ISMS implementation consultant. It covers both ISO 27001:2013 (114 controls, 14 domains) and ISO 27001:2022 (93 controls, 4 themes), defaulting to the current 2022 version.

What it does:

• Runs structured gap analyses against mandatory clauses (4–10) and all Annex A controls
• Generates complete, audit-ready policy documents with document control blocks, scope statements, and clause-to-control mappings
• Provides step-by-step control implementation guidance for any Annex A control
• Builds risk registers and risk treatment plans using the likelihood × impact methodology
• Creates Statement of Applicability (SoA) templates covering all 93 controls
• Guides 2013 → 2022 transition, explaining the 11 new controls and mapping changes

Trigger phrases: ISO 27001, ISMS, Annex A, Statement of Applicability, SoA, gap analysis, risk register, certification readiness, internal audit

2. SOC 2

File: SOC 2 - Claude Skill/soc2.skill

The SOC 2 skill turns Claude into an expert SOC 2 compliance advisor grounded in the AICPA 2017 Trust Services Criteria (TSC) with 2022 Revised Points of Focus. It covers all five TSC: Security (CC1–CC9), Availability (A1), Confidentiality (C1), Processing Integrity (PI1), and Privacy (P1–P8).

What it does:

• Conducts gap analyses across in-scope TSC criteria with 🔴/🟡/🟢 status ratings and remediation roadmaps
• Drafts all 12 core SOC 2 policies (Information Security, Access Control, Incident Response, Change Management, Risk Assessment, Vendor Management, BCP/DR, and more)
• Documents controls in auditor-ready format: Control ID, TSC criterion, type, owner, frequency, evidence, and test procedure
• Produces evidence checklists mapped to each criterion, with sampling guidance for Type 1 vs Type 2 audits
• Handles vendor risk: tiering, 32-question security questionnaires, SOC 2 report review, CUEC tracking, and contractual requirements
• Adapts its tone — plain-language for first-time SOC 2 teams, technical AICPA-coded output for practitioners and auditors

Trigger phrases: SOC 2, Trust Services Criteria, TSC, CC6, Type 1, Type 2, AICPA, audit readiness, control statement, evidence

3. FedRAMP [US]

File: FedRamp - Claude Skill/fedramp.skill