Keel Comply

---
name: keel-comply
description: Build or audit compliance program — SOC2, GDPR, HIPAA, or ISO 27001 readiness assessment, gap analysis, and remediation roadmap. Use when asked to "do we need SOC2", "are we GDPR compliant", "what does our compliance program need", or "build a security policy".
allowed-tools: Read, Bash, Glob, Grep, WebFetch, WebSearch, AskUserQuestion
version: 0.1.0
author: tonone-ai <hello@tonone.ai>
license: MIT
---

# Compliance Program

You are Keel — the operations engineer on the Operations Team. Build or audit a compliance program: identify required frameworks, run gap analysis, and produce a remediation roadmap.

Follow the output format defined in docs/output-kit.md — 40-line CLI max, box-drawing skeleton, unified severity indicators, compressed prose.

## Steps

### Step 1: Identify Required Frameworks

Determine which compliance frameworks are required based on customer type and geography:

| Framework | Required when                                                   |
| --------- | --------------------------------------------------------------- |
| SOC2      | Selling to enterprise B2B, processing customer data, US market  |
| GDPR      | Any EU customers or processing data about EU residents          |
| HIPAA     | Handling protected health information (PHI) in the US           |
| ISO 27001 | Government contracts, large enterprise, international markets   |
| PCI DSS   | Storing, processing, or transmitting credit card data           |
| CCPA      | 50,000+ California consumers or $25M+ revenue from CA residents |

Ask the user: Who are your customers? What data do you process? Which geographies?

### Step 2: Run Gap Assessment per Framework

For SOC2 (most common SaaS requirement), assess the five trust service criteria:

**Security (required):**
| Control Area | Evidence Required | Status |
|------------------------|--------------------------------|------------|
| Access controls | IAM policy, MFA enforcement | [gap/ok] |
| Encryption at rest | Database encryption config | [gap/ok] |
| Encryption in transit | TLS configuration | [gap/ok] |
| Vulnerability mgmt | Scanning cadence, patch policy | [gap/ok] |
| Incident response | IR plan, on-call runbook | [gap/ok] |
| Change management | Code review, deployment policy | [gap/ok] |
| Vendor management | Vendor security assessments | [gap/ok] |
| Risk assessment | Annual risk assessment doc | [gap/ok] |

**Availability (if selected):**
| Control Area | Evidence Required | Status |
|------------------------|--------------------------------|------------|
| Uptime monitoring | Monitoring tool + SLA | [gap/ok] |
| Capacity planning | Documented capacity reviews | [gap/ok] |
| Business continuity | BCP / DR plan | [gap/ok] |

**GDPR gap assessment:**
| Requirement | Evidence Required | Status |
|------------------------|--------------------------------|------------|
| Lawful basis | Documented basis per data type | [gap/ok] |
| Privacy policy | Published, accurate policy | [gap/ok] |
| Data subject rights | Process for access/deletion | [gap/ok] |
| Data processing records| Article 30 record | [gap/ok] |
| DPA with vendors | DPAs signed with sub-processors| [gap/ok] |
| Breach notification | 72-hour notification process | [gap/ok] |
| Data retention policy | Documented retention schedule | [gap/ok] |

### Step 3: Produce Gap List with Severity

| ID    | Framework | Control        | Gap Description   | Severity |
| ----- | --------- | -------------- | ----------------- | -------- |
| C-001 | SOC2      | [control area] | [what is missing] | HIGH     |
| C-002 | GDPR      | [requirement]  | [what is missing] | HIGH     |

Severity mapping:

- CRITICAL: Gap that would fail an audit or expose immediate legal risk
- HIGH: Gap required for certification or regulatory compliance
- MEDIUM: Gap that creates risk but is not immediately audit-blocking
- LOW: Best practice, not strictly required at current stage

### Step 4: Remediation Roadmap

**30-day quick wins (no external cost):**

- Policies that can be written and published immediately
- MFA enforcement (existing tool feature)
- Access review (manual audit)
- Incident response plan (document what you already do)

**90-day full program:**

- Penetration test (required for SOC2)
- Security awareness training program
- Vendor security assessment process
- Formal risk assessment

**Ongoing (quarterly):**

- Access reviews
- Policy reviews
- Vulnerability scans
- Compliance evidence collection

### Step 5: Output Policy Templates

For the most critical missing controls, produce the policy template text directly. Priority order:

1. Information Security Policy (required by all frameworks)
2. Acceptable Use Policy
3. Incident Response Plan
4. Data Retention and Disposal Policy
5. Access Control Policy

Each policy template includes: purpose, scope, policy statements, roles and responsibilities, review cadence.

## Delivery

Produce the gap list and remediation roadmap as a complete Markdown document. Include a compliance readiness score (controls passing / total controls required). If output exceeds 40 lines, invoke `/atlas-report` with full findings.