메뉴
Operational compliance workflows: continuous monitoring, calendaring, POA&M management, change management, and framework transitions.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Audit preparation, evidence checklists, assessment simulation, gap analysis, and maturity scoring.
Draft SSP sections, SAR responses, boundary definitions, inheritance models, OSCAL guidance, and multi-framework coverage analyses.
Maps controls across cybersecurity frameworks using NIST IR 8477 Set-Theory Relationship Mapping (STRM). Use when helping with control implementation, compliance mapping, cross-framework alignment, or understanding control relationships.
Control lookup, cross-framework mapping, search, and coverage analysis across 15 compliance frameworks.
Review SSPs, narratives, POA&Ms, policies, and CRMs for structural completeness and quality.
Generate tabletop exercise scenarios for incident response and contingency planning.
| name | compliance-ops |
| description | Operational compliance workflows: continuous monitoring, calendaring, POA&M management, change management, and framework transitions. |
Manage day-to-day compliance operations including continuous monitoring, compliance calendaring, POA&M lifecycle, significant change analysis, deviation requests, and framework version transitions.
| Command | Description |
|---|---|
/grc:compliance-calendar | Recurring compliance activities by framework and frequency |
/grc:conmon-guide | Continuous monitoring guidance |
/grc:poam-help | POA&M management guidance |
/grc:significant-change | Significant change criteria analysis |
/grc:deviation-request | Deviation request templates |
/grc:rev5-transition | NIST Rev 4 to Rev 5 transition guide |
Use this skill when the user needs to:
grc-pro/knowledge/conmon/*.md — ISCM lifecycle, monthly/annual deliverables, automated toolinggrc-pro/knowledge/conmon/compliance-calendar.md — Consolidated compliance calendargrc-pro/knowledge/conmon/poam-management.md — POA&M lifecycle and severity timelinesgrc-pro/knowledge/audits/significant-change-criteria.md — FedRAMP significant change categoriesWhen the grc-mcp-server is available:
| MCP Tool | Use For |
|---|---|
grc_lookup_control | Control details for POA&M item context |
grc_lookup_risk | Risk details when assessing POA&M severity |
grc_search_risks | Find risks related to specific controls for change analysis |
grc_map_control | Map controls across frameworks during transitions |
grc_list_fetchers | List available evidence fetcher scripts for ConMon automation |
grc_run_fetcher | Execute evidence collection scripts for ConMon deliverables |
Fallback: If MCP tools are unavailable, read knowledge files directly from grc-pro/knowledge/conmon/.