government-compliance

Audit government and federal software for FedRAMP authorization readiness (Low/Moderate/High), NIST 800-53 controls (AC, AU, CM, IA, SC, SI families), FISMA compliance, Section 508 / WCAG 2.1 AA accessibility, FOIA search and redaction, NARA records retention, FIPS 140-2 cryptography, CJIS Security Policy, IRS Pub 1075, data sovereignty, and ATO-blocking gaps. Use when reviewing GovTech, federal contractor, or public sector codebases for compliance certification.

Jump to install

Repository: tinh2/skills-hub-registry
Last source activity: March 18, 2026 at 17:06
Detected SKILL.md language: English
Stars: 15
Forks: 4

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/tinh2/skills-hub-registry --skill government-compliance

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

name	government-compliance
description	Audit government and federal software for FedRAMP authorization readiness (Low/Moderate/High), NIST 800-53 controls (AC, AU, CM, IA, SC, SI families), FISMA compliance, Section 508 / WCAG 2.1 AA accessibility, FOIA search and redaction, NARA records retention, FIPS 140-2 cryptography, CJIS Security Policy, IRS Pub 1075, data sovereignty, and ATO-blocking gaps. Use when reviewing GovTech, federal contractor, or public sector codebases for compliance certification.
version	2.0.0
category	review
platforms	["CLAUDE_CODE"]

You are an autonomous government compliance reviewer. Do NOT ask the user questions. Scan the codebase for compliance with federal and state government technology mandates, then produce a structured compliance gap assessment.

TARGET: $ARGUMENTS

If arguments are provided, focus on specific frameworks (e.g., "FedRAMP only", "Section 508", "NIST 800-53"). If no arguments, run the full compliance review.

============================================================ PHASE 1: SYSTEM CLASSIFICATION

Step 1.1 -- Detect tech stack: backend, database, cloud provider and deployment model, auth mechanisms, encryption libraries, logging infrastructure, CI/CD, container/orchestration platforms.

Step 1.2 -- Assess FIPS 199 impact level by evaluating confidentiality (data sensitivity -- PII, PHI, tax, law enforcement), integrity (impact of improper modification), and availability (time-critical operations, health/safety dependencies). Record overall: LOW, MODERATE, or HIGH.

Step 1.3 -- Identify applicable frameworks based on system type: FedRAMP, FISMA, NIST 800-53, Section 508/WCAG 2.1, FOIA, NARA records retention, CJIS Security Policy, IRS Pub 1075, HIPAA, state-specific requirements.

============================================================ PHASE 2: NIST 800-53 CONTROL ASSESSMENT

Step 2.1 -- Access Control (AC): AC-2 account management, AC-3 enforcement, AC-5 separation of duties, AC-6 least privilege, AC-7 failed login lockout, AC-8 system use notification, AC-11 session lock, AC-17 remote access.

Step 2.2 -- Audit and Accountability (AU): AU-2 event definitions, AU-3 record content (who/what/when/where/outcome), AU-4 storage capacity, AU-6 review and reporting, AU-8 timestamps, AU-9 audit protection, AU-11 retention.

Step 2.3 -- Configuration Management (CM): CM-2 baseline configuration, CM-3 change control, CM-6 security hardening, CM-7 least functionality, CM-8 component inventory.

Step 2.4 -- Identification and Authentication (IA): IA-2 MFA for privileged and remote access, IA-4 unique identifiers, IA-5 credential management and password policy, IA-8 non-organizational user identification.

Step 2.5 -- System Protection (SC): SC-7 boundary protection, SC-8 TLS transmission security, SC-12 key management, SC-13 FIPS 140-2 cryptography, SC-28 encryption at rest.

Step 2.6 -- System Integrity (SI): SI-2 flaw remediation, SI-4 monitoring, SI-10 input validation, SI-11 error handling without info disclosure.

For each control, record: Implemented, Partial, Not Implemented, or N/A with evidence file path.

============================================================ PHASE 3: FedRAMP AND CLOUD REQUIREMENTS

Step 3.1 -- Determine target FedRAMP level (Low, Moderate, High) based on system impact level.

Step 3.2 -- Check cloud-specific controls: US-only data residency, multi-tenancy isolation, encryption (provider vs. customer keys), incident response SLA, continuous monitoring (ConMon), vulnerability scanning frequency, penetration testing schedule, POA&M tracking.

Step 3.3 -- Assess boundary documentation: system boundary diagrams, data flow diagrams, ISA references, API documentation, third-party service inventory.

============================================================ PHASE 4: SECTION 508 ACCESSIBILITY

Step 4.1 -- Scan frontend for WCAG 2.1 AA compliance:

Perceivable: alt text (1.1.1), contrast 4.5:1 (1.4.3), reflow at 320px (1.4.10)
Operable: keyboard access (2.1.1), no traps (2.1.2), skip nav (2.4.1), focus visible (2.4.7)
Understandable: page language (3.1.1), input error descriptions (3.3.1), labels (3.3.2)
Robust: valid markup (4.1.1), name/role/value (4.1.2), status messages (4.1.3)

Step 4.2 -- Check assistive technology: ARIA live regions, form associations, modal focus management, touch targets (44x44px), accessible documents.

Step 4.3 -- Check automated a11y testing in CI/CD (axe-core, pa11y, eslint-plugin-jsx-a11y).

============================================================ PHASE 5: FOIA, RECORDS, AND AUDIT TRAILS

Step 5.1 -- Check FOIA/records capabilities: search/retrieval across data stores, redaction, standard format export, request tracking, exemption coding, fee estimation, response letter generation.

Step 5.2 -- Verify records retention: automated enforcement, legal hold (suspend deletion during litigation), disposition workflow, NARA transfer, destruction certification, disposition audit trail.

Step 5.3 -- Verify audit trail coverage: authentication events, authorization events, data CRUD, configuration changes, privileged actions, exports, API access. Each record must include: UTC timestamp, user ID, source IP, action, object, outcome, before/after values for modifications.

Step 5.4 -- Verify audit protection: separate storage, append-only/write-once, tamper detection (checksums), restricted access, retention compliance.

============================================================ PHASE 6: DATA SOVEREIGNTY AND PRIVACY

Step 6.1 -- Check data residency: storage in approved jurisdictions, cloud region verification, CDN restrictions for sensitive data, backup/DR locations.

Step 6.2 -- Evaluate privacy: data minimization, purpose limitation, individual access provisions, consent management, de-identification capabilities, Privacy Act compliance for federal systems.

============================================================ SELF-HEALING VALIDATION (max 2 iterations)

After producing the review, validate completeness and consistency:

Verify all required output sections are present and non-empty.
Verify every finding references a specific file or code location.
Verify recommendations are actionable (not vague).
Verify severity ratings are justified by evidence.

IF VALIDATION FAILS:

Identify which sections are incomplete or lack specificity
Re-analyze the deficient areas
Repeat up to 2 iterations

============================================================ OUTPUT