菜单
Operational compliance workflows: continuous monitoring, calendaring, POA&M management, change management, and framework transitions.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Audit preparation, evidence checklists, assessment simulation, gap analysis, and maturity scoring.
Draft SSP sections, SAR responses, boundary definitions, inheritance models, OSCAL guidance, and multi-framework coverage analyses.
Maps controls across cybersecurity frameworks using NIST IR 8477 Set-Theory Relationship Mapping (STRM). Use when helping with control implementation, compliance mapping, cross-framework alignment, or understanding control relationships.
Control lookup, cross-framework mapping, search, and coverage analysis across 15 compliance frameworks.
Review SSPs, narratives, POA&Ms, policies, and CRMs for structural completeness and quality.
Generate tabletop exercise scenarios for incident response and contingency planning.
| name | compliance-ops |
| description | Operational compliance workflows: continuous monitoring, calendaring, POA&M management, change management, and framework transitions. |
Manage day-to-day compliance operations including continuous monitoring, compliance calendaring, POA&M lifecycle, significant change analysis, deviation requests, and framework version transitions.
| Command | Description |
|---|---|
/grc:compliance-calendar | Recurring compliance activities by framework and frequency |
/grc:conmon-guide | Continuous monitoring guidance |
/grc:poam-help | POA&M management guidance |
/grc:significant-change | Significant change criteria analysis |
/grc:deviation-request | Deviation request templates |
/grc:rev5-transition | NIST Rev 4 to Rev 5 transition guide |
Use this skill when the user needs to:
grc-pro/knowledge/conmon/*.md — ISCM lifecycle, monthly/annual deliverables, automated toolinggrc-pro/knowledge/conmon/compliance-calendar.md — Consolidated compliance calendargrc-pro/knowledge/conmon/poam-management.md — POA&M lifecycle and severity timelinesgrc-pro/knowledge/audits/significant-change-criteria.md — FedRAMP significant change categoriesWhen the grc-mcp-server is available:
| MCP Tool | Use For |
|---|---|
grc_lookup_control | Control details for POA&M item context |
grc_lookup_risk | Risk details when assessing POA&M severity |
grc_search_risks | Find risks related to specific controls for change analysis |
grc_map_control | Map controls across frameworks during transitions |
grc_list_fetchers | List available evidence fetcher scripts for ConMon automation |
grc_run_fetcher | Execute evidence collection scripts for ConMon deliverables |
Fallback: If MCP tools are unavailable, read knowledge files directly from grc-pro/knowledge/conmon/.