tm-compliance

name	tm-compliance
description	Map threats and controls to compliance frameworks like OWASP Top 10, SOC2, PCI-DSS, HIPAA, GDPR. Generates compliance reports with coverage percentages and gaps. Use when checking compliance status, mapping to security frameworks, or generating audit documentation.
allowed-tools	Read, Write, Glob

Compliance Mapping

Purpose

Map your threat model to compliance frameworks to:

• Calculate compliance coverage percentages
• Identify compliance gaps
• Generate audit-ready documentation
• Track requirements across multiple frameworks

Usage

/tm-compliance [--framework <name>] [--policy <path>] [--gaps-only]

Arguments:

• --framework: Framework(s) to map: owasp, soc2, pci-dss, hipaa, gdpr, custom
• --policy: Path to custom policy document
• --gaps-only: Only show gaps/non-compliance

Supported Frameworks

OWASP Top 10 2021

ID	Name
A01	Broken Access Control
A02	Cryptographic Failures
A03	Injection
A04	Insecure Design
A05	Security Misconfiguration
A06	Vulnerable and Outdated Components
A07	Identification and Authentication Failures
A08	Software and Data Integrity Failures
A09	Security Logging and Monitoring Failures
A10	Server-Side Request Forgery (SSRF)

SOC2 Trust Services Criteria

Category	Description
CC6.1	Logical and Physical Access Controls
CC6.2	System Access Authentication
CC6.3	Access Restriction and Privileges
CC6.6	System Boundaries
CC6.7	Transmission Integrity
CC6.8	Data Integrity
CC7.1	Configuration Management
CC7.2	Change Management

PCI-DSS v4.0

Requirement	Description
1	Install and maintain network security controls
2	Apply secure configurations
3	Protect stored account data
4	Protect cardholder data during transmission
5	Protect from malicious software
6	Develop and maintain secure systems
7	Restrict access by business need
8	Identify users and authenticate access
9	Restrict physical access
10	Log and monitor access
11	Test security regularly
12	Support information security with policies

Mapping Process

For Each Framework Requirement

1. Identify related threats

   • Match requirement to STRIDE categories
   • Find threats in those categories

2. Identify related controls

   • Find controls that mitigate related threats
   • Check control implementation status

3. Assess compliance status

   • compliant: All related controls implemented
   • partial: Some controls implemented
   • non-compliant: No controls or all missing

4. Document evidence

   • Link to verified controls
   • Note gaps

Output Files

compliance.json

{
  "version": "1.0",
  "generated": "ISO-8601",
  "frameworks": [
    {
      "name": "OWASP Top 10 2021",
      "version": "2021",
      "overall_compliance": 82,
      "mappings": [
        {
          "requirement_id": "A01:2021",
          "requirement_name": "Broken Access Control",
          "description": "Restrictions on authenticated users not properly enforced",
          "stride_categories": ["elevation-of-privilege", "information-disclosure"],
          "related_threats": ["threat-010", "threat-011"],
          "related_controls": ["control-020", "control-021"],
          "status": "partial",
          "coverage": 85,
          "gaps": ["gap-005"],
          "evidence": [
            "RBAC implemented in src/middleware/authorize.ts",
            "Missing: Object-level authorization"
          ]
        }
      ]
    }
  ]
}

compliance-report.md (Visual Report)

# Compliance Report

**Generated**: [Date]
**Frameworks**: OWASP Top 10 2021, SOC2

## Executive Summary

COMPLIANCE OVERVIEW ═══════════════════════════════════════════════════════════

OWASP Top 10 2021 ───────────────────────────────────────────────────────── A01 Broken Access Control: ████████░░ 85% (1 gap) A02 Cryptographic Failures: ██████████ 100% A03 Injection: ███████░░░ 70% (3 gaps) A04 Insecure Design: ██████░░░░ 55% (5 gaps) A05 Security Misconfiguration: █████████░ 95% (1 gap) A06 Vulnerable Components: █████████░ 90% (1 gap) A07 Auth Failures: ████████░░ 75% (4 gaps) A08 Data Integrity Failures: ████████░░ 85% (2 gaps) A09 Logging Failures: ████████░░ 80% (2 gaps) A10 SSRF: ██████████ 100% ───────────────────────────────────────────────────────── OVERALL: ████████░░ 82%

SOC2 Trust Services ───────────────────────────────────────────────────────── CC6.1 Logical Access: █████████░ 90% (1 gap) CC6.2 Authentication: ████████░░ 80% (2 gaps) CC6.3 Access Restriction: █████████░ 95% (1 gap) ───────────────────────────────────────────────────────── OVERALL: █████████░ 88%

## OWASP Top 10 2021

### A01:2021 - Broken Access Control

┌─────────────────────────────────────────────────────────┐ │ STATUS: ⚠ Partial (85%) │ ├─────────────────────────────────────────────────────────┤ │ RELATED THREATS: │ │ • THREAT-010: IDOR in user profile │ │ • THREAT-011: Missing function-level access control │ │ │ │ CONTROLS: │ │ ✓ RBAC implementation │ │ ⚠ Object-level authorization (partial) │ │ │ │ GAPS: │ │ • GAP-005: Missing object-level checks │ │ │ │ EVIDENCE: │ │ src/middleware/authorize.ts:15-89 │ └─────────────────────────────────────────────────────────┘

### A02:2021 - Cryptographic Failures

┌─────────────────────────────────────────────────────────┐ │ STATUS: ✓ Compliant (100%) │ ├─────────────────────────────────────────────────────────┤ │ CONTROLS: │ │ ✓ TLS 1.3 enforced │ │ ✓ AES-256 encryption at rest │ │ ✓ Bcrypt password hashing │ │ │ │ EVIDENCE: │ │ src/config/tls.ts:5 │ │ src/db/encryption.ts:12 │ └─────────────────────────────────────────────────────────┘

[Additional requirements...]

STRIDE to Framework Mapping

OWASP Top 10

STRIDE Category	OWASP Requirements
Spoofing	A07
Tampering	A03, A08
Repudiation	A09
Information Disclosure	A01, A02
Denial of Service	A05
Elevation of Privilege	A01, A04

SOC2

STRIDE Category	SOC2 Criteria
Spoofing	CC6.1, CC6.2
Tampering	CC6.7, CC6.8
Repudiation	CC7.2
Information Disclosure	CC6.1, CC6.3
Denial of Service	CC6.6
Elevation of Privilege	CC6.3

Instructions for Claude

When executing this skill:

1. Load threat model state:

   • Read .threatmodel/state/threats.json
   • Read .threatmodel/state/controls.json
   • Read .threatmodel/state/gaps.json

2. Load framework definitions:

   • Reference built-in framework mappings
   • Load custom policies if specified

3. For each framework:

   • Map requirements to STRIDE categories
   • Find related threats
   • Find related controls
   • Assess coverage

4. Calculate compliance:

   • Per-requirement status
   • Per-framework percentage
   • Overall score

5. Generate reports with visuals IN THE FILES:

   • JSON for programmatic use
   • Markdown with ASCII progress bars, status boxes, and visual indicators
   • The compliance-report.md MUST include:
     • Visual progress bars: ████████░░ 85%
     • Status indicators: ✓, ⚠, ✗
     • Visual box frames for each requirement
   • These visuals go in the written file, not just console output

6. Console summary (also display to user):

   Compliance Mapping Complete
   ===========================
   
   Frameworks Analyzed: 2
   
   OWASP Top 10 2021:
     A01 Broken Access Control:     ████████░░ 85%  (1 gap)
     A02 Cryptographic Failures:    ██████████ 100%
     A03 Injection:                 ███████░░░ 70%  (3 gaps)
     ...
     Overall: 82%
   
   SOC2 Trust Services:
     CC6.1 Logical Access:          █████████░ 90%  (1 gap)
     CC6.2 Authentication:          ████████░░ 80%  (2 gaps)
     ...
     Overall: 88%
   
   Total Gaps: 11
     High Priority: 4
     Medium Priority: 5
     Low Priority: 2
   
   Files Created:
     .threatmodel/state/compliance.json
     .threatmodel/reports/compliance-report.md
   
   Next Steps:
     Run /tm-report to generate full risk report
   

Reference Files

• OWASP Top 10 2021
• STRIDE Framework