Compliance Review Skill

Goal

Verify that the codebase and system configuration meet applicable regulatory requirements. Produce a gap report with specific remediation actions.

Steps

1. Identify applicable regulations

   • Ask if unclear which regulations apply
   • SOC2 Type II: SaaS products, cloud services (trust criteria: security, availability, confidentiality)
   • PCI-DSS: any system handling payment card data
   • GDPR: processing data of EU residents
   • HIPAA: US healthcare data (PHI — Protected Health Information)
   • ISO 27001: general information security management

2. Run the applicable checklist