| name | generating-compliance-reports |
| description | Generate comprehensive compliance reports for security standards. Use when creating compliance documentation. Trigger with 'generate compliance report', 'compliance status', or 'audit compliance'. |
| version | 1.25.0 |
| allowed-tools | Read, Write, Edit, Grep, Glob, Bash(security:*), Bash(scan:*), Bash(audit:*) |
| license | MIT |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| tags | ["security","compliance","audit"] |
| compatibility | Designed for Claude Code, also compatible with Codex and OpenClaw |
Generating Compliance Reports
Overview
Generate structured compliance reports for major security frameworks including
PCI DSS, HIPAA, SOC 2, GDPR, and ISO 27001. This skill scans codebases,
configurations, and infrastructure definitions to assess compliance posture,
maps findings to specific framework controls, and produces audit-ready
documentation with evidence references and gap analysis.
Prerequisites
- Access to the target codebase, infrastructure configs, and policy documents in
${CLAUDE_SKILL_DIR}/
- Knowledge of the target compliance framework and its applicable scope
- Standard shell utilities and Grep/Glob available for evidence gathering
- Reference:
${CLAUDE_SKILL_DIR}/references/README.md for PCI DSS guidelines, HIPAA compliance checklist, SOC 2 framework overview, config schema, and API documentation
Instructions
- Determine the target compliance framework (PCI DSS, HIPAA, SOC 2, GDPR, ISO 27001, or custom) and identify applicable control domains based on the system under audit.
- Enumerate the control requirements for the target framework -- for PCI DSS, map the 12 requirements and their sub-controls; for HIPAA, map Administrative, Physical, and Technical Safeguards; for SOC 2, map Trust Services Criteria (CC1-CC9).
- Scan the codebase for evidence of control implementation: encryption at rest and in transit (TLS configuration, database encryption), access controls (RBAC definitions, IAM policies), logging and monitoring (audit log configuration, SIEM integration), and data retention policies.
- Evaluate each control as Compliant, Partially Compliant, Non-Compliant, or Not Applicable -- document the evidence file path and line number for each assessment.
- For Partially Compliant and Non-Compliant controls, describe the specific gap: what is missing, what risk it introduces, and what remediation is required.
- Calculate an overall compliance score as percentage of applicable controls that are fully compliant.
- Generate the report with these sections: Executive Summary, Scope and Methodology, Control-by-Control Assessment, Gap Analysis, Risk Rating, Remediation Roadmap with priority and effort estimates, and Evidence Appendix.
- Write the report to
${CLAUDE_SKILL_DIR}/compliance-report-[framework]-[date].md using the Write tool.
- Validate the report against the config schema in
${CLAUDE_SKILL_DIR}/references/README.md if applicable.
Output
- Compliance report: Markdown document with Executive Summary, Scope, Control Assessment (table with Control ID, Description, Status, Evidence, Gap), Risk Rating, and Remediation Roadmap
