[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7CFPCZ1V3M4FGET1MJSJNM6":3,"skill-same:01M7CFPCZ1V3M4FGET1MJSJNM6":109},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":31,"commitSha":32,"skillDirectory":33,"forksCount":14,"repositoryHtmlUrl":34,"repositoryHomepageUrl":6,"ownerHtmlUrl":35,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":36,"install":37,"resources":50},"01M7CFPCZ1V3M4FGET1MJSJNM6","compliance-os",null,"Compliance OS — meta-orchestrator that lets compliance teams CONFIGURE which frameworks apply, COMPUTE cross-framework control overlap, SIMULATE internal audits, and CONSOLIDATE evidence across multiple frameworks. Four decisions: (1) Given a company profile, which of the 12 supported frameworks apply (ISO 27001\u002F13485\u002F42001\u002F14971, EU AI Act, MDR 745, GDPR, SOC 2, FDA QSR, NIST CSF 2.0, NIS2, HIPAA)? (2) Across selected frameworks, which controls overlap and how much evidence reuses? (3) For a given framework + scope, what does a realistic mock audit produce — drawing from the 205-scenario library? (4) Across selected frameworks, what's the unified evidence checklist with reuse map? Use when standing up a multi-framework program, planning the annual audit calendar, or preparing for certification stage 1. Does NOT replace per-framework skills (it orchestrates them).","azhri1990\u002Fjarvis-mega-repo","azhri1990","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F281207543?v=4","01M7BMC0WHXB2ZA9SH1PFJDYNS","Nashriq Mokhtar","01M7C4WMQVQ450E0NA99BG7BHA",0,"MIT","https:\u002F\u002Fgithub.com\u002Fazhri1990\u002Fjarvis-mega-repo\u002Fblob\u002Fmain\u002Frepos\u002FJ.A.R.V.I.S\u002Fcomponents\u002Fcore\u002Fclaude-skills\u002Fcompliance-os\u002Fskills\u002Fcompliance-os\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: \"compliance-os\"\ndescription: \"Compliance OS — meta-orchestrator that lets compliance teams CONFIGURE which frameworks apply, COMPUTE cross-framework control overlap, SIMULATE internal audits, and CONSOLIDATE evidence across multiple frameworks. Four decisions: (1) Given a company profile, which of the 12 supported frameworks apply (ISO 27001\u002F13485\u002F42001\u002F14971, EU AI Act, MDR 745, GDPR, SOC 2, FDA QSR, NIST CSF 2.0, NIS2, HIPAA)? (2) Across selected frameworks, which controls overlap and how much evidence reuses? (3) For a given framework + scope, what does a realistic mock audit produce — drawing from the 205-scenario library? (4) Across selected frameworks, what's the unified evidence checklist with reuse map? Use when standing up a multi-framework program, planning the annual audit calendar, or preparing for certification stage 1. Does NOT replace per-framework skills (it orchestrates them).\"\nlicense: MIT\nmetadata:\n  version: 1.0.0\n  author: Alireza Rezvani\n  category: compliance-os\n  domain: multi-framework-compliance-orchestration\n  updated: 2026-05-13\n  python-tools: framework_selector.py, cross_framework_mapper.py, audit_simulator.py, evidence_pool_generator.py\n  frameworks: iso-27001, iso-13485, iso-42001, iso-14971, eu-ai-act, eu-mdr-745, gdpr, soc-2, fda-qsr, nist-csf, nis2, hipaa\n---\n\n# Compliance OS — Meta-Orchestrator\n\nMulti-framework compliance program orchestration. **Four decisions, no per-framework deep-dive:**\n\n1. **Which frameworks apply to this company?** — `framework_selector.py` ranks the 12 supported frameworks against a company profile (industry, geography, AI use, medical, financial, headcount, customers, healthcare-PHI, NIS2 essential\u002Fimportant entity, US gov contractor) and returns applicable ones with dependency graph\n2. **How much do selected frameworks overlap?** — `cross_framework_mapper.py` computes control-level overlap with confidence rating; outputs unified control matrix + evidence-reuse opportunities\n3. **What does a mock audit produce?** — `audit_simulator.py` generates 8–15 finding scenarios with severity distribution matching IIA expectations + interview questions per control\n4. **What's the unified evidence checklist?** — `evidence_pool_generator.py` consolidates evidence across enabled frameworks; outputs which artefact satisfies which controls across which frameworks\n\nThis skill is **NOT** a per-framework deep-dive. The per-framework skills (`ra-qm-team\u002Fskills\u002Fiso42001-specialist\u002F`, `compliance-team-eu-ai-act\u002F`, `ra-qm-team\u002Fskills\u002Fgdpr-dsgvo-expert\u002F`, etc.) do the operational work. Compliance OS orchestrates them.\n\nThis skill is **NOT** a substitute for binding legal advice. Cross-framework mappings reflect published guidance (ISO standards, regulations, EDPB\u002FCommission guidance, IIA \u002F AICPA professional standards). Novel cross-walks should be reviewed with counsel.\n\n## Keywords\n\ncompliance orchestration, multi-framework compliance, compliance OS, cross-framework mapping, control overlap, evidence pool, evidence reuse, audit simulation, mock audit, internal audit programme, GRC, governance risk compliance, framework selector, compliance program, integrated compliance, ISO 19011, IIA IPPF, AICPA AT-C, NIST CSF profile, multi-cert program, SOC 2 + ISO 27001, ISO 27001 + ISO 42001, ISO 13485 + MDR 745, AI Act + ISO 42001, GDPR + ISO 27001, compliance officer, compliance team workflow, certification readiness\n\n## Quick Start\n\n```bash\n# Decision A: Which frameworks apply for the company?\npython scripts\u002Fframework_selector.py                          # embedded mid-stage AI SaaS sample\npython scripts\u002Fframework_selector.py path\u002Fto\u002Fprofile.json\n\n# Decision B: Compute cross-framework overlap\npython scripts\u002Fcross_framework_mapper.py                      # embedded ISO 27001 + SOC 2 sample\npython scripts\u002Fcross_framework_mapper.py path\u002Fto\u002Fcontrol_libs.json\n\n# Decision C: Simulate an audit\npython scripts\u002Faudit_simulator.py                             # embedded ISO 27001 sample\npython scripts\u002Faudit_simulator.py path\u002Fto\u002Faudit_scope.json\n\n# Decision D: Consolidate evidence checklist across frameworks\npython scripts\u002Fevidence_pool_generator.py                     # embedded 3-framework sample\npython scripts\u002Fevidence_pool_generator.py path\u002Fto\u002Fprogram.json\n```\n\n## Key Questions (ask these first)\n\n- **Have you named every applicable framework?** Forgetting one means rebuilding the audit program later. Run `framework_selector.py` with your profile.\n- **What's the most certificate \u002F regulation your company already operates?** That's your reuse anchor. Map every new framework against it.\n- **What's the audit calendar?** A multi-framework program means surveillance audits stacked through the year — plan auditor independence + capacity.\n- **Where is evidence stored?** Multi-framework programs collapse when evidence lives in one team's drive without an index. Run `evidence_pool_generator.py` to surface the reuse opportunities.\n- **What's the management-review cadence across frameworks?** Each framework wants its own management review, but a single integrated review (per ISO Annex SL) typically satisfies all of them with one calendar slot.\n- **Who owns the meta-program?** If no single accountable role, the program fragments.\n\n## Core Responsibilities\n\n### 1. Framework Selection\n\n**The framework:** company-profile JSON in → applicable-framework list out with dependency graph.\n\n**Deterministic logic:**\n- Medical device → ISO 13485 + ISO 14971 + (EU MDR 745 if EU market) + (FDA QSR if US market)\n- Customer-facing AI → ISO 42001 + EU AI Act (if EU users) + GDPR (if personal data)\n- B2B SaaS with enterprise customers → SOC 2 + ISO 27001 (often required for procurement)\n- EU customers + personal data → GDPR mandatory\n- Highly regulated industry (financial, health) → additional sectoral overlays\n\n**Run** `framework_selector.py` to apply the decision rules.\n\n### 2. Cross-Framework Control Mapping\n\n**The framework:** for each selected framework, parse its control library; compute overlap with other selected frameworks.\n\n**Per merged-control output:**\n- Mapping confidence (HIGH \u002F MEDIUM \u002F LOW)\n- Evidence-reuse opportunity (single artefact satisfies N controls)\n- Per-framework citation\n- Implementation guidance reusable across frameworks\n\n**Densest known overlap:** ISO 27001 Annex A ↔ SOC 2 Trust Services Criteria — historically ~75% control coverage shared. Adding ISO 42001 brings AI-specific controls; adding GDPR brings privacy-specific.\n\n**Run** `cross_framework_mapper.py` with framework control libraries.\n\n### 3. Audit Simulation\n\n**The framework:** generate a realistic mock internal audit per ISO 19011 + IIA IPPF standards.\n\n**Per audit output:**\n- 8–15 finding scenarios per ISO 19011 typical depth\n- Severity distribution: ≥ 40% observations\u002FOFI, ≤ 15% critical\u002Fmajor (IIA expectation for healthy programs)\n- Interview questions per scoped control (3–5 questions per control)\n- Document-review request list\n- Walk-through requests where applicable\n\n**Run** `audit_simulator.py` with framework + scope.\n\n### 4. Evidence Pool\n\n**The framework:** consolidate evidence requirements across enabled frameworks; identify reuse opportunities.\n\n**Output:**\n- Evidence artefact list (e.g., access-review log, supplier risk register, incident log)\n- Per artefact: list of (framework, control) tuples it satisfies\n- Reuse-leverage score (artefact A satisfies N controls across M frameworks)\n- Acquisition cost estimate (effort to produce + maintain)\n\n**Run** `evidence_pool_generator.py` with program config.\n\n## Workflows\n\n### Workflow 1: Program Bootstrap (multi-framework, 4–8 weeks)\n**Goal:** stand up a compliance program covering 2–4 frameworks simultaneously.\n\n```bash\n# 1. Run framework selector with company profile\npython scripts\u002Fframework_selector.py profile.json\n# 2. For each applicable framework, identify the per-framework skill and run its gap analysis\n# 3. Run cross-framework mapper to identify reuse opportunities\npython scripts\u002Fcross_framework_mapper.py control_libs.json\n# 4. Run evidence pool generator to consolidate\npython scripts\u002Fevidence_pool_generator.py program.json\n# 5. Cross-check with cs-compliance-officer agent\n# 6. Output: prioritized program backlog with owners + dates\n```\n\n### Workflow 2: Annual Audit Calendar (yearly)\n**Goal:** plan internal audit cycles covering all applicable frameworks.\n\n```bash\n# 1. Refresh framework selector if profile changed\npython scripts\u002Fframework_selector.py profile.json\n# 2. For each framework, run its internal-audit-plan tool\n#    (e.g., aims_audit_scheduler.py for ISO 42001; isms_audit_scheduler.py for ISO 27001)\n# 3. Coordinate the audit calendar across frameworks (auditor independence + capacity)\n# 4. Run audit simulator for each framework to prep auditors\npython scripts\u002Faudit_simulator.py scope.json\n# 5. Output: integrated audit calendar with owners + auditor assignments\n```\n\n### Workflow 3: Pre-Certification Readiness (per new framework, 6–12 weeks)\n**Goal:** prepare for an external certification audit.\n\n```bash\n# 1. Run gap analysis for the new framework\n#    (ISO 42001: aims_gap_analyzer.py; ISO 27001: compliance_checker.py; SOC 2: gap_analyzer.py)\n# 2. Run cross-framework mapper against already-certified frameworks\npython scripts\u002Fcross_framework_mapper.py control_libs.json\n# 3. Reuse evidence for HIGH-confidence mappings; build new for MEDIUM\u002FLOW\n# 4. Run audit simulator to dry-run the certification audit\npython scripts\u002Faudit_simulator.py scope.json\n# 5. Close remaining gaps before external auditor stage 1\n```\n\n### Workflow 4: Evidence Pool Consolidation (quarterly)\n**Goal:** keep the unified evidence pool fresh + reusable.\n\n```bash\n# 1. Refresh evidence pool generator\npython scripts\u002Fevidence_pool_generator.py program.json\n# 2. Identify HIGH-reuse-leverage artefacts (1 evidence -> 5+ controls)\n# 3. Confirm evidence freshness (within retention requirement per framework)\n# 4. Audit the evidence pool itself (no orphan controls, no stale evidence)\n```\n\n## Output Standards\n\n```\n**Bottom Line:** [one sentence — what's the multi-framework picture + biggest reuse opportunity]\n**The Decision:** [one of: framework-set | overlap-map | audit-plan | evidence-consolidation]\n**The Evidence:** [framework names + control IDs from the tool, not adjectives]\n**How to Act:** [3 concrete next steps with owners + dates]\n**Your Decision:** [the call only the compliance officer can make — which frameworks to pursue, audit cycle priority, evidence-reuse policy]\n```\n\n## Adjacent Skills\n\n- `ra-qm-team\u002Fskills\u002Fiso42001-specialist\u002F` — ISO 42001 deep-dive (paired with compliance-team-iso42001 plugin)\n- `ra-qm-team\u002Fskills\u002Feu-ai-act-specialist\u002F` — EU AI Act deep-dive (paired with compliance-team-eu-ai-act plugin)\n- `ra-qm-team\u002Fskills\u002Finformation-security-manager-iso27001\u002F` — ISO 27001 ISMS deep-dive\n- `ra-qm-team\u002Fskills\u002Fquality-manager-qms-iso13485\u002F` — ISO 13485 QMS deep-dive\n- `ra-qm-team\u002Fskills\u002Fgdpr-dsgvo-expert\u002F` — GDPR deep-dive\n- `ra-qm-team\u002Fskills\u002Fsoc2-compliance\u002F` — SOC 2 deep-dive\n- `ra-qm-team\u002Fskills\u002Ffda-consultant-specialist\u002F` — FDA QSR deep-dive\n- `ra-qm-team\u002Fskills\u002Fmdr-745-specialist\u002F` — EU MDR 745 deep-dive\n- `ra-qm-team\u002Fskills\u002Frisk-management-specialist\u002F` — ISO 14971 deep-dive\n- `c-level-advisor\u002Fchief-ai-officer-advisor\u002F` — Executive AI risk decisions (build-vs-buy, model selection)\n- `c-level-advisor\u002Fskills\u002Fgeneral-counsel-advisor\u002F` — Legal review for novel cases\n\n## References\n\n- [compliance_os_pattern.md](references\u002Fcompliance_os_pattern.md) — The meta-framework architecture (configure → map → simulate → consolidate → review); when to use vs not\n- [cross_framework_overlap.md](references\u002Fcross_framework_overlap.md) — The 9-framework × control-family overlap table with mapping confidence (Phase 3 expands to 12 frameworks via `cross_framework_mapper.py`)\n- [audit_simulation_methodology.md](references\u002Faudit_simulation_methodology.md) — ISO 19011 + IIA IPPF + AICPA AT-C audit-simulation principles + severity distribution heuristics\n- [evidence_management.md](references\u002Fevidence_management.md) — Evidence pool design + retention + freshness + reuse-leverage scoring\n- [multi_framework_audit_playbook.md](references\u002Fmulti_framework_audit_playbook.md) — Integrated audit programme for 2+ frameworks (Phase 2)\n- [evidence_artifact_reuse_index.md](references\u002Fevidence_artifact_reuse_index.md) — Empirically-derived reuse-leverage ranking across all 12 frameworks (Phase 3)\n\n## Phase 3 Asset: Mock Audit Scenario Library\n\n`assets\u002Fmock_audit_library.json` — 205 pre-built finding scenarios spanning 12 frameworks + 26 themes + 4 severity levels (34 critical, 88 major, 54 minor, 29 observation). Each scenario tags applicable frameworks; cross-reference `scripts\u002Fcross_framework_mapper.py` merged-controls catalogue to resolve framework-specific control IDs. Use as input to enrich `audit_simulator.py` mock audits, as a training resource for new internal auditors, or as the seed for finding-pattern detection across multi-framework programmes.\n\n---\n\n**Version:** 1.2.0\n**Status:** Production Ready\n","# Compliance OS — Meta-Orchestrator\n\nMulti-framework compliance program orchestration. **Four decisions, no per-framework deep-dive:**\n\n1. **Which frameworks apply to this company?** — `framework_selector.py` ranks the 12 supported frameworks against a company profile (industry, geography, AI use, medical, financial, headcount, customers, healthcare-PHI, NIS2 essential\u002Fimportant entity, US gov contractor) and returns applicable ones with dependency graph\n2. **How much do selected frameworks overlap?** — `cross_framework_mapper.py` computes control-level overlap with confidence rating; outputs unified control matrix + evidence-reuse opportunities\n3. **What does a mock audit produce?** — `audit_simulator.py` generates 8–15 finding scenarios with severity distribution matching IIA expectations + interview questions per control\n4. **What's the unified evidence checklist?** — `evidence_pool_generator.py` consolidates evidence across enabled frameworks; outputs which artefact satisfies which controls across which frameworks\n\nThis skill is **NOT** a per-framework deep-dive. The per-framework skills (`ra-qm-team\u002Fskills\u002Fiso42001-specialist\u002F`, `compliance-team-eu-ai-act\u002F`, `ra-qm-team\u002Fskills\u002Fgdpr-dsgvo-expert\u002F`, etc.) do the operational work. Compliance OS orchestrates them.\n\nThis skill is **NOT** a substitute for binding legal advice. Cross-framework mappings reflect published guidance (ISO standards, regulations, EDPB\u002FCommission guidance, IIA \u002F AICPA professional standards). Novel cross-walks should be reviewed with counsel.\n\n## Keywords\n\ncompliance orchestration, multi-framework compliance, compliance OS, cross-framework mapping, control overlap, evidence pool, evidence reuse, audit simulation, mock audit, internal audit programme, GRC, governance risk compliance, framework selector, compliance program, integrated compliance, ISO 19011, IIA IPPF, AICPA AT-C, NIST CSF profile, multi-cert program, SOC 2 + ISO 27001, ISO 27001 + ISO 42001, ISO 13485 + MDR 745, AI Act + ISO 42001, GDPR + ISO 27001, compliance officer, compliance team workflow, certification readiness\n\n## Quick Start\n\n```bash\n# Decision A: Which frameworks apply for the company?\npython scripts\u002Fframework_selector.py                          # embedded mid-stage AI SaaS sample\npython scripts\u002Fframework_selector.py path\u002Fto\u002Fprofile.json\n\n# Decision B: Compute cross-framework overlap\npython scripts\u002Fcross_framework_mapper.py                      # embedded ISO 27001 + SOC 2 sample\npython scripts\u002Fcross_framework_mapper.py path\u002Fto\u002Fcontrol_libs.json\n\n# Decision C: Simulate an audit\npython scripts\u002Faudit_simulator.py                             # embedded ISO 27001 sample\npython scripts\u002Faudit_simulator.py path\u002Fto\u002Faudit_scope.json\n\n# Decision D: Consolidate evidence checklist across frameworks\npython scripts\u002Fevidence_pool_generator.py                     # embedded 3-framework sample\npython scripts\u002Fevidence_pool_generator.py path\u002Fto\u002Fprogram.json\n```\n\n## Key Questions (ask these first)\n\n- **Have you named every applicable framework?** Forgetting one means rebuilding the audit program later. Run `framework_selector.py` with your profile.\n- **What's the most certificate \u002F regulation your company already operates?** That's your reuse anchor. Map every new framework against it.\n- **What's the audit calendar?** A multi-framework program means surveillance audits stacked through the year — plan auditor independence + capacity.\n- **Where is evidence stored?** Multi-framework programs collapse when evidence lives in one team's drive without an index. Run `evidence_pool_generator.py` to surface the reuse opportunities.\n- **What's the management-review cadence across frameworks?** Each framework wants its own management review, but a single integrated review (per ISO Annex SL) typically satisfies all of them with one calendar slot.\n- **Who owns the meta-program?** If no single accountable role, the program fragments.\n\n## Core Responsibilities\n\n### 1. Framework Selection\n\n**The framework:** company-profile JSON in → applicable-framework list out with dependency graph.\n\n**Deterministic logic:**\n- Medical device → ISO 13485 + ISO 14971 + (EU MDR 745 if EU market) + (FDA QSR if US market)\n- Customer-facing AI → ISO 42001 + EU AI Act (if EU users) + GDPR (if personal data)\n- B2B SaaS with enterprise customers → SOC 2 + ISO 27001 (often required for procurement)\n- EU customers + personal data → GDPR mandatory\n- Highly regulated industry (financial, health) → additional sectoral overlays\n\n**Run** `framework_selector.py` to apply the decision rules.\n\n### 2. Cross-Framework Control Mapping\n\n**The framework:** for each selected framework, parse its control library; compute overlap with other selected frameworks.\n\n**Per merged-control output:**\n- Mapping confidence (HIGH \u002F MEDIUM \u002F LOW)\n- Evidence-reuse opportunity (single artefact satisfies N controls)\n- Per-framework citation\n- Implementation guidance reusable across frameworks\n\n**Densest known overlap:** ISO 27001 Annex A ↔ SOC 2 Trust Services Criteria — historically ~75% control coverage shared. Adding ISO 42001 brings AI-specific controls; adding GDPR brings privacy-specific.\n\n**Run** `cross_framework_mapper.py` with framework control libraries.\n\n### 3. Audit Simulation\n\n**The framework:** generate a realistic mock internal audit per ISO 19011 + IIA IPPF standards.\n\n**Per audit output:**\n- 8–15 finding scenarios per ISO 19011 typical depth\n- Severity distribution: ≥ 40% observations\u002FOFI, ≤ 15% critical\u002Fmajor (IIA expectation for healthy programs)\n- Interview questions per scoped control (3–5 questions per control)\n- Document-review request list\n- Walk-through requests where applicable\n\n**Run** `audit_simulator.py` with framework + scope.\n\n### 4. Evidence Pool\n\n**The framework:** consolidate evidence requirements across enabled frameworks; identify reuse opportunities.\n\n**Output:**\n- Evidence artefact list (e.g., access-review log, supplier risk register, incident log)\n- Per artefact: list of (framework, control) tuples it satisfies\n- Reuse-leverage score (artefact A satisfies N controls across M frameworks)\n- Acquisition cost estimate (effort to produce + maintain)\n\n**Run** `evidence_pool_generator.py` with program config.\n\n## Workflows\n\n### Workflow 1: Program Bootstrap (multi-framework, 4–8 weeks)\n**Goal:** stand up a compliance program covering 2–4 frameworks simultaneously.\n\n```bash\n# 1. Run framework selector with company profile\npython scripts\u002Fframework_selector.py profile.json\n# 2. For each applicable framework, identify the per-framework skill and run its gap analysis\n# 3. Run cross-framework mapper to identify reuse opportunities\npython scripts\u002Fcross_framework_mapper.py control_libs.json\n# 4. Run evidence pool generator to consolidate\npython scripts\u002Fevidence_pool_generator.py program.json\n# 5. Cross-check with cs-compliance-officer agent\n# 6. Output: prioritized program backlog with owners + dates\n```\n\n### Workflow 2: Annual Audit Calendar (yearly)\n**Goal:** plan internal audit cycles covering all applicable frameworks.\n\n```bash\n# 1. Refresh framework selector if profile changed\npython scripts\u002Fframework_selector.py profile.json\n# 2. For each framework, run its internal-audit-plan tool\n#    (e.g., aims_audit_scheduler.py for ISO 42001; isms_audit_scheduler.py for ISO 27001)\n# 3. Coordinate the audit calendar across frameworks (auditor independence + capacity)\n# 4. Run audit simulator for each framework to prep auditors\npython scripts\u002Faudit_simulator.py scope.json\n# 5. Output: integrated audit calendar with owners + auditor assignments\n```\n\n### Workflow 3: Pre-Certification Readiness (per new framework, 6–12 weeks)\n**Goal:** prepare for an external certification audit.\n\n```bash\n# 1. Run gap analysis for the new framework\n#    (ISO 42001: aims_gap_analyzer.py; ISO 27001: compliance_checker.py; SOC 2: gap_analyzer.py)\n# 2. Run cross-framework mapper against already-certified frameworks\npython scripts\u002Fcross_framework_mapper.py control_libs.json\n# 3. Reuse evidence for HIGH-confidence mappings; build new for MEDIUM\u002FLOW\n# 4. Run audit simulator to dry-run the certification audit\npython scripts\u002Faudit_simulator.py scope.json\n# 5. Close remaining gaps before external auditor stage 1\n```\n\n### Workflow 4: Evidence Pool Consolidation (quarterly)\n**Goal:** keep the unified evidence pool fresh + reusable.\n\n```bash\n# 1. Refresh evidence pool generator\npython scripts\u002Fevidence_pool_generator.py program.json\n# 2. Identify HIGH-reuse-leverage artefacts (1 evidence -> 5+ controls)\n# 3. Confirm evidence freshness (within retention requirement per framework)\n# 4. Audit the evidence pool itself (no orphan controls, no stale evidence)\n```\n\n## Output Standards\n\n```\n**Bottom Line:** [one sentence — what's the multi-framework picture + biggest reuse opportunity]\n**The Decision:** [one of: framework-set | overlap-map | audit-plan | evidence-consolidation]\n**The Evidence:** [framework names + control IDs from the tool, not adjectives]\n**How to Act:** [3 concrete next steps with owners + dates]\n**Your Decision:** [the call only the compliance officer can make — which frameworks to pursue, audit cycle priority, evidence-reuse policy]\n```\n\n## Adjacent Skills\n\n- `ra-qm-team\u002Fskills\u002Fiso42001-specialist\u002F` — ISO 42001 deep-dive (paired with compliance-team-iso42001 plugin)\n- `ra-qm-team\u002Fskills\u002Feu-ai-act-specialist\u002F` — EU AI Act deep-dive (paired with compliance-team-eu-ai-act plugin)\n- `ra-qm-team\u002Fskills\u002Finformation-security-manager-iso27001\u002F` — ISO 27001 ISMS deep-dive\n- `ra-qm-team\u002Fskills\u002Fquality-manager-qms-iso13485\u002F` — ISO 13485 QMS deep-dive\n- `ra-qm-team\u002Fskills\u002Fgdpr-dsgvo-expert\u002F` — GDPR deep-dive\n- `ra-qm-team\u002Fskills\u002Fsoc2-compliance\u002F` — SOC 2 deep-dive\n- `ra-qm-team\u002Fskills\u002Ffda-consultant-specialist\u002F` — FDA QSR deep-dive\n- `ra-qm-team\u002Fskills\u002Fmdr-745-specialist\u002F` — EU MDR 745 deep-dive\n- `ra-qm-team\u002Fskills\u002Frisk-management-specialist\u002F` — ISO 14971 deep-dive\n- `c-level-advisor\u002Fchief-ai-officer-advisor\u002F` — Executive AI risk decisions (build-vs-buy, model selection)\n- `c-level-advisor\u002Fskills\u002Fgeneral-counsel-advisor\u002F` — Legal review for novel cases\n\n## References\n\n- [compliance_os_pattern.md](references\u002Fcompliance_os_pattern.md) — The meta-framework architecture (configure → map → simulate → consolidate → review); when to use vs not\n- [cross_framework_overlap.md](references\u002Fcross_framework_overlap.md) — The 9-framework × control-family overlap table with mapping confidence (Phase 3 expands to 12 frameworks via `cross_framework_mapper.py`)\n- [audit_simulation_methodology.md](references\u002Faudit_simulation_methodology.md) — ISO 19011 + IIA IPPF + AICPA AT-C audit-simulation principles + severity distribution heuristics\n- [evidence_management.md](references\u002Fevidence_management.md) — Evidence pool design + retention + freshness + reuse-leverage scoring\n- [multi_framework_audit_playbook.md](references\u002Fmulti_framework_audit_playbook.md) — Integrated audit programme for 2+ frameworks (Phase 2)\n- [evidence_artifact_reuse_index.md](references\u002Fevidence_artifact_reuse_index.md) — Empirically-derived reuse-leverage ranking across all 12 frameworks (Phase 3)\n\n## Phase 3 Asset: Mock Audit Scenario Library\n\n`assets\u002Fmock_audit_library.json` — 205 pre-built finding scenarios spanning 12 frameworks + 26 themes + 4 severity levels (34 critical, 88 major, 54 minor, 29 observation). Each scenario tags applicable frameworks; cross-reference `scripts\u002Fcross_framework_mapper.py` merged-controls catalogue to resolve framework-specific control IDs. Use as input to enrich `audit_simulator.py` mock audits, as a training resource for new internal auditors, or as the seed for finding-pattern detection across multi-framework programmes.\n\n---\n\n**Version:** 1.2.0\n**Status:** Production Ready\n",{"name":5,"license":15,"metadata":24,"description":7},{"author":25,"domain":26,"updated":27,"version":28,"category":5,"frameworks":29,"python-tools":30},"Alireza Rezvani","multi-framework-compliance-orchestration",1778630400000,"1.0.0","iso-27001, iso-13485, iso-42001, iso-14971, eu-ai-act, eu-mdr-745, gdpr, soc-2, fda-qsr, nist-csf, nis2, hipaa","framework_selector.py, cross_framework_mapper.py, audit_simulator.py, evidence_pool_generator.py","main","46d43f3edecde97283ac410e9051444d90120cfb","repos\u002FJ.A.R.V.I.S\u002Fcomponents\u002Fcore\u002Fclaude-skills\u002Fcompliance-os\u002Fskills\u002Fcompliance-os","https:\u002F\u002Fgithub.com\u002Fazhri1990\u002Fjarvis-mega-repo","https:\u002F\u002Fgithub.com\u002Fazhri1990","2026-10-10 07:58:58",{"source":8,"skillName":5,"commands":38,"prompt":48,"zipAvailable":49},[39,42,45],{"tool":40,"command":41},"npx","npx skills add azhri1990\u002Fjarvis-mega-repo --skill compliance-os",{"tool":43,"command":44},"bunx","bunx skills add azhri1990\u002Fjarvis-mega-repo --skill compliance-os",{"tool":46,"command":47},"pnpm","pnpm dlx skills add azhri1990\u002Fjarvis-mega-repo --skill compliance-os","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fazhri1990\u002Fjarvis-mega-repo\u002Fblob\u002Fmain\u002Frepos\u002FJ.A.R.V.I.S\u002Fcomponents\u002Fcore\u002Fclaude-skills\u002Fcompliance-os\u002Fskills\u002Fcompliance-os\u002FSKILL.md",true,[51,57,61,65,71,75,79,83,87,91,97,101,105],{"path":52,"resourceType":53,"resourceTypeDesc":54,"sizeBytes":55,"sourceHtmlUrl":56},"assets\u002Fcompany_profile_template.json","ASSET","资产文件",747,"https:\u002F\u002Fgithub.com\u002Fazhri1990\u002Fjarvis-mega-repo\u002Fblob\u002Fmain\u002Frepos\u002FJ.A.R.V.I.S\u002Fcomponents\u002Fcore\u002Fclaude-skills\u002Fcompliance-os\u002Fskills\u002Fcompliance-os\u002Fassets\u002Fcompany_profile_template.json",{"path":58,"resourceType":53,"resourceTypeDesc":54,"sizeBytes":59,"sourceHtmlUrl":60},"assets\u002Fcontrol_library_template.json",483,"https:\u002F\u002Fgithub.com\u002Fazhri1990\u002Fjarvis-mega-repo\u002Fblob\u002Fmain\u002Frepos\u002FJ.A.R.V.I.S\u002Fcomponents\u002Fcore\u002Fclaude-skills\u002Fcompliance-os\u002Fskills\u002Fcompliance-os\u002Fassets\u002Fcontrol_library_template.json",{"path":62,"resourceType":53,"resourceTypeDesc":54,"sizeBytes":63,"sourceHtmlUrl":64},"assets\u002Fmock_audit_library.json",88795,"https:\u002F\u002Fgithub.com\u002Fazhri1990\u002Fjarvis-mega-repo\u002Fblob\u002Fmain\u002Frepos\u002FJ.A.R.V.I.S\u002Fcomponents\u002Fcore\u002Fclaude-skills\u002Fcompliance-os\u002Fskills\u002Fcompliance-os\u002Fassets\u002Fmock_audit_library.json",{"path":66,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":69,"sourceHtmlUrl":70},"references\u002Faudit_simulation_methodology.md","REFERENCE","参考文档",8270,"https:\u002F\u002Fgithub.com\u002Fazhri1990\u002Fjarvis-mega-repo\u002Fblob\u002Fmain\u002Frepos\u002FJ.A.R.V.I.S\u002Fcomponents\u002Fcore\u002Fclaude-skills\u002Fcompliance-os\u002Fskills\u002Fcompliance-os\u002Freferences\u002Faudit_simulation_methodology.md",{"path":72,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":73,"sourceHtmlUrl":74},"references\u002Fcompliance_os_pattern.md",9505,"https:\u002F\u002Fgithub.com\u002Fazhri1990\u002Fjarvis-mega-repo\u002Fblob\u002Fmain\u002Frepos\u002FJ.A.R.V.I.S\u002Fcomponents\u002Fcore\u002Fclaude-skills\u002Fcompliance-os\u002Fskills\u002Fcompliance-os\u002Freferences\u002Fcompliance_os_pattern.md",{"path":76,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":77,"sourceHtmlUrl":78},"references\u002Fcross_framework_overlap.md",7071,"https:\u002F\u002Fgithub.com\u002Fazhri1990\u002Fjarvis-mega-repo\u002Fblob\u002Fmain\u002Frepos\u002FJ.A.R.V.I.S\u002Fcomponents\u002Fcore\u002Fclaude-skills\u002Fcompliance-os\u002Fskills\u002Fcompliance-os\u002Freferences\u002Fcross_framework_overlap.md",{"path":80,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":81,"sourceHtmlUrl":82},"references\u002Fevidence_artifact_reuse_index.md",11363,"https:\u002F\u002Fgithub.com\u002Fazhri1990\u002Fjarvis-mega-repo\u002Fblob\u002Fmain\u002Frepos\u002FJ.A.R.V.I.S\u002Fcomponents\u002Fcore\u002Fclaude-skills\u002Fcompliance-os\u002Fskills\u002Fcompliance-os\u002Freferences\u002Fevidence_artifact_reuse_index.md",{"path":84,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":85,"sourceHtmlUrl":86},"references\u002Fevidence_management.md",8475,"https:\u002F\u002Fgithub.com\u002Fazhri1990\u002Fjarvis-mega-repo\u002Fblob\u002Fmain\u002Frepos\u002FJ.A.R.V.I.S\u002Fcomponents\u002Fcore\u002Fclaude-skills\u002Fcompliance-os\u002Fskills\u002Fcompliance-os\u002Freferences\u002Fevidence_management.md",{"path":88,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":89,"sourceHtmlUrl":90},"references\u002Fmulti_framework_audit_playbook.md",9298,"https:\u002F\u002Fgithub.com\u002Fazhri1990\u002Fjarvis-mega-repo\u002Fblob\u002Fmain\u002Frepos\u002FJ.A.R.V.I.S\u002Fcomponents\u002Fcore\u002Fclaude-skills\u002Fcompliance-os\u002Fskills\u002Fcompliance-os\u002Freferences\u002Fmulti_framework_audit_playbook.md",{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"scripts\u002Faudit_simulator.py","SCRIPT","脚本",16126,"https:\u002F\u002Fgithub.com\u002Fazhri1990\u002Fjarvis-mega-repo\u002Fblob\u002Fmain\u002Frepos\u002FJ.A.R.V.I.S\u002Fcomponents\u002Fcore\u002Fclaude-skills\u002Fcompliance-os\u002Fskills\u002Fcompliance-os\u002Fscripts\u002Faudit_simulator.py",{"path":98,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":99,"sourceHtmlUrl":100},"scripts\u002Fcross_framework_mapper.py",22062,"https:\u002F\u002Fgithub.com\u002Fazhri1990\u002Fjarvis-mega-repo\u002Fblob\u002Fmain\u002Frepos\u002FJ.A.R.V.I.S\u002Fcomponents\u002Fcore\u002Fclaude-skills\u002Fcompliance-os\u002Fskills\u002Fcompliance-os\u002Fscripts\u002Fcross_framework_mapper.py",{"path":102,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":103,"sourceHtmlUrl":104},"scripts\u002Fevidence_pool_generator.py",13748,"https:\u002F\u002Fgithub.com\u002Fazhri1990\u002Fjarvis-mega-repo\u002Fblob\u002Fmain\u002Frepos\u002FJ.A.R.V.I.S\u002Fcomponents\u002Fcore\u002Fclaude-skills\u002Fcompliance-os\u002Fskills\u002Fcompliance-os\u002Fscripts\u002Fevidence_pool_generator.py",{"path":106,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":107,"sourceHtmlUrl":108},"scripts\u002Fframework_selector.py",13474,"https:\u002F\u002Fgithub.com\u002Fazhri1990\u002Fjarvis-mega-repo\u002Fblob\u002Fmain\u002Frepos\u002FJ.A.R.V.I.S\u002Fcomponents\u002Fcore\u002Fclaude-skills\u002Fcompliance-os\u002Fskills\u002Fcompliance-os\u002Fscripts\u002Fframework_selector.py",[110,117,124,131,138,145],{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":116,"publishedAt":19},"01M7CYPF9V9EMA4ZXS1TTCMBFH","syllabus","Generates a curated supplementary reading list from any course syllabus using Consensus academic search. Grill-me intake (syllabus input format + course audience + year range) plus a grouping forcing-options checkpoint before any search runs — so the reading list matches the course's level and recency need. Parses the syllabus to extract topics and learning outcomes, searches Consensus for recent peer-reviewed papers per topic, and produces a professionally formatted .docx with clickable Consensus links, plain-language summaries calibrated to audience level, and Bloom-higher-order discussion questions tied to course learning goals. Use when the user uploads a syllabus, course outline, or curriculum document and wants supplementary readings (e.g., 'create a reading list from this syllabus', 'find recent papers for my course') — even casual mentions with a syllabus attached should trigger this skill.","https:\u002F\u002Fgithub.com\u002Fazhri1990\u002Fjarvis-mega-repo\u002Fblob\u002Fmain\u002Frepos\u002Fproject-genesis\u002Fclaude-skills\u002Fresearch\u002Fsyllabus\u002Fskills\u002Fsyllabus\u002FSKILL.md",[],[],{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":123,"publishedAt":19},"01M7CYNRJDTQCRF5KGPMBMSB1S","pulse","Multi-source recency research skill that takes the pulse of any topic across Reddit, Hacker News, the open web, and optionally X\u002FTwitter within a configurable recent window (default 30 days). Forcing intake clarifies topic specificity, angle (trend\u002Fsentiment\u002Fproblems\u002Fopportunities\u002Fcomparison), time window, and platform scope before searching. Returns a synthesized briefing with citations, engagement metrics, and cross-platform pattern analysis. Use when the user requests multi-source recency intelligence on a topic (e.g., 'pulse on [topic]', 'what's happening with [topic]', 'what are people saying about [topic]', 'current conversation about [topic]', 'take the pulse of [topic]', 'trending: [topic]', 'find me info on [topic]'), and for competitor research, trend discovery, tool comparisons, and audience sentiment analysis.","https:\u002F\u002Fgithub.com\u002Fazhri1990\u002Fjarvis-mega-repo\u002Fblob\u002Fmain\u002Frepos\u002Fproject-genesis\u002Fclaude-skills\u002Fresearch\u002Fpulse\u002Fskills\u002Fpulse\u002FSKILL.md",[],[],{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":128,"categories":129,"keywords":130,"publishedAt":19},"01M7CYNAVSE84QD7HAWZWTY2FS","patent","Patent prior-art and landscape intelligence skill — not generic patent help. Commits to one of five sub-use-cases via forcing intake (novelty search \u002F freedom-to-operate \u002F competitive landscape \u002F acquisition diligence \u002F litigation prior-art) before any search runs. Searches Google Patents, Espacenet, USPTO, and optionally Lens.org for citation-graph signals. Output is an editable Word document (.docx) with verdict, ranked closest art (claim-text extracted), CPC-class-aware landscape, family-resolved hits, geographic coverage, FTO flags where applicable, strategy recommendations, and full audit log. Use when the user asks for patent searching or analysis (e.g., 'prior art search for [invention]', 'freedom to operate analysis for [product]'). Produces search signal, not legal advice — always recommends consulting a patent attorney before filing or licensing decisions. Trademark, copyright, and trade-secret questions are out of scope.","https:\u002F\u002Fgithub.com\u002Fazhri1990\u002Fjarvis-mega-repo\u002Fblob\u002Fmain\u002Frepos\u002Fproject-genesis\u002Fclaude-skills\u002Fresearch\u002Fpatent\u002Fskills\u002Fpatent\u002FSKILL.md",[],[],{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":137,"publishedAt":19},"01M7CYN0CE8P5ZN7WV2X06HKPC","notebooklm","Browser automation skill for controlling Google's NotebookLM. Use when the user wants anything done in NotebookLM (e.g., 'open NotebookLM', 'check my [name] notebook', 'ask my notebook about X', 'add [source] to NotebookLM', 'generate a Video Overview from my notebook', 'use NotebookLM Studio'). Handles reading and querying notebooks, adding sources (URLs, text, files, YouTube links, synthesized content), generating Studio outputs (Audio\u002FVideo Overviews, Mind Maps, Reports incl. Briefing Doc\u002FStudy Guide\u002FFAQ, Flashcards, Quiz, slide decks, infographics — discover the exact set from the live Studio panel; the UI evolves fast), and creating new notebooks. Requires browser automation environment — fails gracefully when unavailable.","https:\u002F\u002Fgithub.com\u002Fazhri1990\u002Fjarvis-mega-repo\u002Fblob\u002Fmain\u002Frepos\u002Fproject-genesis\u002Fclaude-skills\u002Fresearch\u002Fnotebooklm\u002Fskills\u002Fnotebooklm\u002FSKILL.md",[],[],{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":144,"publishedAt":19},"01M7CYMHZ3QRJ9BKRB859KW8TQ","litreview","Academic literature orientation skill that searches papers via free keyless APIs (PubMed E-utilities + OpenAlex) by default — with the Consensus MCP as an optional enhancement lane when connected — builds a strategic search plan using PICO (default) or SPIDER \u002F Decomposition \u002F hybrid as fallbacks, and synthesizes findings into a formatted Word (.docx) research guide. Grill-me intake (research question specificity + framework hint + tentative depth) before the recon search; a second forcing checkpoint after Phase 2 confirms framework + sub-areas + depth before searches consume budget. Configurable depth (5\u002F10\u002F20 queries) controls coverage vs. speed. Output is a 'launching pad' — an orientation guide that lets a researcher dive in confidently, not a finished review. Use when the user starts literature-oriented research (e.g., 'litreview on [topic]', 'literature review on [topic]', 'I'm starting a literature review on X', 'I'm writing a paper on X', 'help me research X', 'I'm doing research on X', 'can you help me research X'). Do NOT use for single one-off paper searches wanting a quick list — that's a plain PubMed\u002FOpenAlex (or Consensus) query.","https:\u002F\u002Fgithub.com\u002Fazhri1990\u002Fjarvis-mega-repo\u002Fblob\u002Fmain\u002Frepos\u002Fproject-genesis\u002Fclaude-skills\u002Fresearch\u002Flitreview\u002Fskills\u002Flitreview\u002FSKILL.md",[],[],{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":151,"publishedAt":19},"01M7CYM3D8YKV7R6DT4RNJSF0A","grants","NIH grant research skill for clinical researchers. Grill-me intake (research idea + career stage + preliminary data + environment + submission posture + known institute targets) locks down the funding strategy before any search runs. Runs a 5-facet Consensus positioning analysis (with draft Significance\u002FInnovation language), maps the research to the right NIH institutes and study sections via RePORTER, finds NOSIs and funded overlap, and produces an editable Word document (.docx) with budget\u002Fscope-aware mechanism recommendations, submission timelines, and a mandatory program officer recommendation. Use when the user asks about research funding or makes any grant-related request (e.g., 'grants for [topic]', 'find grants for my research idea', 'what grants match my research', 'help me find NIH funding', 'grant opportunities for my research'). NIH-only scope — non-NIH funders (PCORI, DOD CDMRP, VA, foundations) are out of scope and flagged at intake.","https:\u002F\u002Fgithub.com\u002Fazhri1990\u002Fjarvis-mega-repo\u002Fblob\u002Fmain\u002Frepos\u002Fproject-genesis\u002Fclaude-skills\u002Fresearch\u002Fgrants\u002Fskills\u002Fgrants\u002FSKILL.md",[],[]]