Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →borghei/compliance-readiness
Cross-framework compliance readiness orchestrator.
Passed 18 of 23 test cases with the skill, and 16 of 23 without it.
2 fixed16 passed either way5 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our startup is preparing exclusively for a standalone SOC 2 Type II audit sprint with no other compliance standards in scope. How should we execute this single-framework audit prep?
| Checked | Without skill | With skill |
|---|---|---|
| recommends using a framework-specific SOC 2 audit prep skill rather than cross-framework orchestration | Missed | Passed |
The instructions your model reads when the skill loads.
The orchestrator skill for organizations pursuing multiple compliance frameworks. Reduces duplication, accelerates certification, and shares evidence across SOC 2, ISO 27001, NIST CSF, GDPR, HIPAA, and others.
When to use this skill vs. framework-specific audit-prep:
soc2-audit-prep, gdpr-audit-prep, etc.): single-framework sprint| Situation | Skill applies |
|---|---|
| Pursuing SOC 2 + ISO 27001 + NIST CSF in parallel | Yes — start here |
| Healthcare org pursuing SOC 2 + HIPAA + ISO 27001 | Yes |
| Building shared-evidence platform | Yes — see shared evidence strategy |
| Mapping one control to multiple frameworks | Yes — scripts/shared_evidence_finder.py |
| Deciding which framework to certify first | Yes — see sequencing decisions |
| Generating multi-framework roadmap | Yes — scripts/readiness_roadmap_generator.py |
| Single-framework audit prep | Use framework-specific skill |
Most controls are shared across compliance frameworks. A well-designed control catalog satisfies multiple frameworks simultaneously. Without coordination, you build separate evidence + procedures per framework — 3x the work, 3x the maintenance, 3x the auditor confusion.
Common shared controls:
| Control area | SOC 2 | ISO 27001 | NIST CSF | NIS2 | DORA | PCI-DSS | HIPAA | GDPR |
|---|---|---|---|---|---|---|---|---|
| Access control | CC6.1 | A.8.5 | PR.AA | Art.21.2.j | Art.9.4 | Req 7-8 | §164.312(d) | Art.32 |
| Encryption | CC6.7 | A.8.24 | PR.DS | Art.21.2.h | Art.9.2 | Req 3-4 | §164.312(a)(2)(iv) | Art.32 |
| Incident response | CC7.4 | A.5.24 | RS.MA | Art.23 | Art.17 | Req 12.10 | §164.308(a)(6) | Art.33 |
| Risk assessment | CC3.1 | Cl.6.1 | ID.RA | Art.21.1 | Art.6 | Req 12.2 | §164.308(a)(1) | Art.35 |
| Logging | CC7.2 | A.8.15 | DE.CM | Art.21.2.b | Art.10 | Req 10 | §164.312(b) | Art.30 |
| Vendor management | CC9.2 | A.5.19 | GV.SC | Art.21.2.d | Art.28 | Req 12.8 | §164.308(b) | Art.28 |
See references/control-mapping-soc2-iso27001-nist.md for the full mapping.
test cases passed, vs 16 / 23 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.