Security Compliance Map

---
name: security-compliance-map
description: Map existing security controls to framework requirements — ISO 27001, NIST CSF, SOC 2, CIS, PCI DSS, HIPAA — showing which controls serve several frameworks and the gaps. Use when the user has controls in place and asks which requirements they meet or how to reuse a control across audits. Not for comparing frameworks clause by clause; see /compliance-cross-regulation-map.
metadata:
  argument-hint: "[project] [--skip-checks]"
---

# Compliance Map

Map security controls to compliance frameworks for "$ARGUMENTS" covering framework selection, control-to-framework mapping, multi-framework coverage analysis, and gap identification.

**Arguments.** `$ARGUMENTS` may contain the project name and optional flags. Take the first token as `<project>` and treat `--skip-checks` as a flag; never include flags in file paths. All paths below use `<project>`. If `--skip-checks` is present, skip the prerequisite check and, **before writing any artifact**, append one line to `.singularskills/log.jsonl`: `{"ts":"<ISO timestamp>","skill":"security-compliance-map","workflow":"security","phase":null,"project":"<project>","event":"skipped","artifact":"<artifact file>","note":"<reason or \"none given\">"}`.

## Process

1. **Select frameworks to map:**
   - Determine applicable frameworks based on industry, geography, and contractual requirements
   - Common frameworks: ISO 27001, NIST CSF, SOC 2, CIS Controls, PCI DSS, HIPAA, GDPR
   - If context is unclear, ask the user which frameworks are relevant
   - Read `references/security-controls-matrix.md` for reference control catalog

2. **Inventory existing security controls:**
   - Read `.singularskills/security/<project>/` directory for existing security artifacts
   - Catalog controls already defined across all phases (Govern, Identify, Protect, Detect, Respond, Recover)
   - For each control: document control ID, description, implementation status, evidence

3. **Create control-to-framework mapping matrix:**
   - Build a matrix with controls as rows and frameworks as columns
   - Map each control to applicable framework requirements
   - Use framework-specific control references:
     - **ISO 27001** — Annex A control numbers (A.5 through A.18)
     - **NIST CSF** — function/category/subcategory (e.g., PR.AC-1)
     - **SOC 2** — Trust Service Criteria (CC1 through CC9, availability, confidentiality, privacy)
     - **CIS Controls** — control numbers (CIS 1 through CIS 18)
     - **PCI DSS** — requirement numbers (1 through 12)
     - **HIPAA** — Security Rule sections (administrative, physical, technical safeguards)

4. **Identify controls satisfying multiple frameworks:**
   - Highlight controls that map to requirements across two or more frameworks
   - Quantify multi-framework coverage efficiency (controls providing the most cross-framework coverage)
   - Prioritize these high-leverage controls for implementation and evidence collection
   - Note where a single control satisfies requirements differently per framework (may need additional evidence)

5. **Identify framework-specific gaps:**
   - For each framework, list requirements NOT covered by current controls
   - Categorize gaps by severity: critical (mandatory requirements), significant (important but compensating controls may exist), minor (best practice)
   - Note where compensating controls may partially satisfy requirements
   - Estimate effort to close each gap

6. **Prioritize gap remediation:**
   - Rank gaps by: regulatory risk (fines, penalties), audit timeline, customer requirements, effort to remediate
   - Identify gaps that can be closed by extending existing controls vs. requiring new controls
   - Create remediation plan with owners, deadlines, and resource requirements
   - Define interim risk acceptance for gaps that cannot be immediately addressed

7. **Write the artifact** to `.singularskills/security/<project>/compliance-map.md` with heading:

   ## Compliance Map

   Include sections:
   - **Applicable Frameworks** — selected frameworks with rationale
   - **Control Inventory** — existing controls with implementation status
   - **Mapping Matrix** — controls mapped to framework requirements
   - **Multi-Framework Coverage** — controls providing cross-framework efficiency
   - **Gap Analysis** — uncovered requirements per framework with severity
   - **Remediation Plan** — prioritized gap closure with owners and timeline

## Output

The compliance map written to `.singularskills/security/<project>/compliance-map.md`. Present a summary to the user highlighting:
- Frameworks mapped and overall coverage percentage per framework
- High-leverage controls providing multi-framework coverage
- Critical gaps requiring immediate attention
- Remediation priorities and timeline

End the artifact with this paragraph, verbatim:

> **Not a penetration test or audit.** This artifact is generated analysis; validate findings against the live system and have material controls reviewed by a qualified security professional.