compliance-checklist（合规检查表） Skills下载安装命令和教程

安装方式

通过对话安装

复制提示词发给支持本地命令或 Skills 的 AI 助手，先确认命令和权限，再让它执行。

请帮我安装这个 Agent Skill：compliance-checklist（合规检查表）
来源仓库：https://github.com/hack23/riksdagsmonitor
仓库路径：skills/compliance-checklist
安装命令：
npx skills add https://github.com/hack23/riksdagsmonitor --skill compliance-checklist
安装前请先检查当前环境是否支持对应 CLI，并向我确认将要执行的命令、安装目录、联网范围和文件读写权限；确认后再执行。

命令行安装

复制命令到本机终端执行。该命令会通过 npx skills 从第三方来源获取 Skill；本站只展示命令，不托管安装包，也不自动执行。

skills.shnpx skills

npx skills add https://github.com/hack23/riksdagsmonitor --skill compliance-checklist

简介

compliance-checklist 用于查找、检索和筛选相关信息。

适合根据关键词或任务场景快速定位合规相关结果。
通过 npx skills add 命令从指定仓库安装并使用该技能。
安装前需确认权限范围和维护状态，注意可能触发联网或文件读写操作。
适用宿主包括 Codex、Claude、Cursor、Gemini CLI，接入前应确认版本、权限和运行环境要求。

SKILL.md

Compliance Checklist Skill

Purpose

This skill provides comprehensive guidance for multi-framework compliance alignment, demonstrating how a single set of ISMS controls can satisfy multiple international frameworks and regulatory requirements simultaneously.

Strategic Principles

1. Unified Compliance Framework

Single Control Set: One ISMS architecture satisfies multiple frameworks
Evidence-Based Mapping: Traceable controls to requirements
Continuous Compliance: Not one-time certification
Transparency: Public ISMS demonstrates capability

2. Framework Coverage

Framework	Purpose	Key Focus
ISO 27001:2022	Control backbone (Annex A)	Organizational, people, physical, technological controls
NIST CSF 2.0	Risk-based framework	6 functions (Govern, Identify, Protect, Detect, Respond, Recover)
CIS Controls v8.1	Operational security	Implementation Groups (IG1, IG2, IG3)
NIS2 Directive	EU cybersecurity	Governance, risk management, incident handling
EU CRA	Product cybersecurity	Annex I essential requirements, Annex II critical products
GDPR	Data protection	Privacy by design/default, breach notification
SOC 2 Type II	Trust services	Operational effectiveness over time
PCI DSS v4.0	Payment security	Cardholder data protection (SAQ A focus)
HIPAA	Healthcare data	PHI safeguards (consulting readiness)

ISO 27001:2022 Annex A Control Mapping

Organizational Controls (A.5)

A.5.1 Policies for Information Security

Implementation: Information Security Policy
NIST CSF 2.0: GV.PO-01 (Policy established and communicated)
CIS v8.1: 14.1 (Security policy dissemination)
Evidence: Policy documents, version control, approval records

A.5.2 Roles & Responsibilities

Implementation: Security roles defined in Information Security Policy
NIST CSF 2.0: GV.RR-02 (Roles and authorities established)
CIS v8.1: 14.3 (Document security responsibilities)
Evidence: Role descriptions, RACI matrix, responsibility assignments

A.5.3 Segregation of Duties

Implementation: Segregation of Duties Policy with compensating controls
NIST CSF 2.0: PR.AC-03 (Privileged access managed)
CIS v8.1: 6.1 (Access workflow enforcing SoD)
Evidence: SoD matrix, compensating controls, audit logs

A.5.4 Management Responsibilities

Implementation: Management commitment in Information Security Policy
NIST CSF 2.0: GV.OV-01 (Leadership supports risk management)
CIS v8.1: 17.1 (Designate incident handling leadership)
Evidence: Management review records, resource allocation

A.5.7 Threat Intelligence

Implementation: Risk Register, Threat Modeling Policy
NIST CSF 2.0: ID.RA-04 (Threat intelligence informs risk)
CIS v8.1: 7.1 (Vulnerability/threat intake)
Evidence: Threat assessments, risk register updates

A.5.8 Security in Project Management

Implementation: Secure Development Policy, Change Management
NIST CSF 2.0: PR.IP-01 (System development processes)
CIS v8.1: 16.1 (Secure application development)
Evidence: SDLC documentation, security requirements

A.5.9 Asset Inventory

Implementation: Asset Register
NIST CSF 2.0: ID.AM-01 (Assets inventoried)
CIS v8.1: 1.1 (Enterprise asset inventory)
Evidence: Asset register, discovery scans

A.5.10 Acceptable Use

Implementation: Acceptable Use Policy
NIST CSF 2.0: PR.AC-01 (Identities managed)
CIS v8.1: 14.1 (Security awareness including acceptable use)
Evidence: Policy acceptance records, training logs

A.5.12 Information Classification

Implementation: Data Classification Policy, CLASSIFICATION framework
NIST CSF 2.0: ID.AM-03 (Data assets classified)
CIS v8.1: 3.4 (Data classification scheme)
Evidence: Classification schema, labeled assets

People Controls (A.6)

A.6.2 Terms & Conditions of Employment

Implementation: Access Control Policy, employment contracts
NIST CSF 2.0: GV.RR-01 (Policies for managing cybersecurity workforce)
CIS v8.1: 14.2 (Security awareness training)
Evidence: Employment agreements, security clauses

A.6.4 Access to Assets

Implementation: Access Control Policy
NIST CSF 2.0: PR.AC-04 (Access permissions managed)
CIS v8.1: 6.1 (Least privilege access)
Evidence: Access control lists, permission reviews

Physical Controls (A.7)

A.7.1 Physical Security Perimeters

Implementation: Physical Security Policy (home office + AWS inherited controls)
NIST CSF 2.0: PR.AC-02 (Physical access managed)
CIS v8.1: 4.1 (Secure configuration baseline)
Evidence: Office security measures, cloud certifications

Technological Controls (A.8)

A.8.2 Privileged Access Rights

Implementation: Access Control Policy with MFA
NIST CSF 2.0: PR.AC-03 (Privileged access managed)
CIS v8.1: 6.8 (Role-based access control)
Evidence: MFA implementation, access reviews

A.8.3 Information Access Restriction

Implementation: Access Control Policy, Network Security Policy
NIST CSF 2.0: PR.AC-04 (Access permissions)
CIS v8.1: 6.1 (Access control implementation)
Evidence: Firewall rules, access logs

A.8.9 Configuration Management

Implementation: Change Management, Secure Development Policy
NIST CSF 2.0: PR.IP-01 (Configuration management)
CIS v8.1: 4.1 (Secure configuration)
Evidence: Configuration baselines, change records

A.8.10 Information Deletion

Implementation: Data Classification Policy, Asset Register
NIST CSF 2.0: PR.DS-03 (Data disposal)
CIS v8.1: 3.12 (Data disposal processes)
Evidence: Data retention policy, disposal logs

A.8.12 Data Leak Prevention

Implementation: Cryptography Policy, Network Security Policy
NIST CSF 2.0: PR.DS-01 (Data at rest protected)
CIS v8.1: 3.10 (Encrypt data in transit)
Evidence: Encryption implementation, DLP controls

A.8.19 Security in Development

Implementation: Secure Development Policy
NIST CSF 2.0: PR.IP-01 (Secure development practices)
CIS v8.1: 16.1 (Secure development process)
Evidence: SAST/DAST results, code reviews

A.8.23 Web Filtering

Implementation: Network Security Policy
NIST CSF 2.0: PR.PT-04 (Communications protected)
CIS v8.1: 9.2 (DNS filtering)
Evidence: Content filtering rules, logs

A.8.28 Secure Coding

Implementation: Secure Development Policy
NIST CSF 2.0: PR.IP-01 (Secure coding standards)
CIS v8.1: 16.1 (Secure development)
Evidence: Coding standards, security reviews

NIST CSF 2.0 Function Mapping

GOVERN (GV)

GV.PO: Policies establish cybersecurity expectations
GV.RR: Roles and responsibilities defined
GV.OV: Leadership provides oversight
GV.RM: Risk management strategy implemented

IDENTIFY (ID)

ID.AM: Assets inventoried and classified
ID.RA: Risks assessed and prioritized
ID.IM: Improvements identified
ID.BE: Business environment understood

PROTECT (PR)

PR.AC: Access controls implemented
PR.DS: Data security measures in place
PR.IP: Information protection processes
PR.PT: Protective technology deployed

DETECT (DE)

DE.AE: Anomalies detected
DE.CM: Continuous monitoring active
DE.DP: Detection processes established

RESPOND (RS)

RS.MA: Response management coordinated
RS.AN: Incidents analyzed
RS.CO: Response communications managed
RS.MI: Mitigation activities performed

RECOVER (RC)

RC.RP: Recovery planning documented
RC.IM: Improvements identified
RC.CO: Recovery communications managed

CIS Controls v8.1 Implementation Groups

IG1 (Basic Cyber Hygiene)

1.1: Inventory of Assets ✅
2.1: Inventory of Software ✅
3.10: Encrypt Data in Transit ✅
4.1: Secure Configuration ✅
5.1: Account Inventory ✅
6.8: Role-Based Access Control ✅

IG2 (Enterprise Security)

8.2: Collect Audit Logs ✅
10.1: Deploy Anti-Malware ✅
13.1: Security Event Alerting ✅
16.1: Secure Development Process ✅

IG3 (Advanced/Enterprise)

7.1: Threat Intelligence ✅
11.1: Data Recovery Capability ✅
14.1: Security Awareness Program ✅
17.1: Incident Response Planning ✅

NIS2 Directive Compliance

Article 20: Governance

Risk management measures approved by management
Business continuity plans documented
Supply chain security managed
Evidence: Business Continuity Plan, Third Party Management

Article 21: Technical/Operational Measures

Incident handling policies
Business continuity and disaster recovery
Security of network and information systems
Evidence: Incident Response Plan, Network Security Policy

Article 23: Incident Reporting

24-hour early warning for significant incidents
72-hour formal notification
Progress reports and final reports
Evidence: Incident Response Plan § Reporting

EU Cyber Resilience Act (CRA)

Annex I Essential Requirements

Secure by Design: Security throughout product lifecycle
Vulnerability Management: Handling and disclosure process
Security Updates: Automated update mechanisms
Evidence: Secure Development Policy, Vulnerability Management

Annex II Critical Products (Art. 6, 11)

Enhanced security requirements for critical products
Third-party conformity assessment
Continuous monitoring obligations
Evidence: CRA Conformity Assessment Process

GDPR Compliance

Core Articles

Art. 5: Data processing principles (lawfulness, fairness, transparency)
Art. 25: Data protection by design and by default
Art. 32: Security of processing
Art. 33: Breach notification (72 hours)
Evidence: Data Classification Policy, Privacy Policy

Swedish Dataskyddslagen

Local DPA notification requirements
Swedish-specific privacy considerations
Evidence: External Stakeholder Registry

SOC 2 Type II Trust Services Criteria

Common Criteria (CC)

CC1.1-1.5: Control environment
CC2.1-2.3: Communication and information
CC3.1-3.4: Risk assessment
CC4.1-4.2: Monitoring activities
CC5.1-5.3: Control activities
CC6.1-6.8: Logical/physical access controls
CC7.1-7.5: System operations
CC8.1: Change management
CC9.1-9.2: Risk mitigation

Trust Services Categories

Security: System protected against unauthorized access
Availability: System available as committed
Processing Integrity: Processing complete, valid, accurate, timely
Confidentiality: Confidential information protected
Privacy: Personal information handled per privacy notice

PCI DSS v4.0 (SAQ A Focus)

SAQ A (Outsourced Card Processing)

Req 1-2: Network security controls (AWS CloudFront, GitHub Pages)
Req 3-4: Cardholder data protection (Stripe handles all CHD)
Req 5-6: Vulnerability management (CodeQL, Dependabot)
Req 7-8: Access controls (GitHub MFA, SSH keys, GPG signing)
Req 9: Physical security (home office, AWS data centers)
Req 10-11: Monitoring and testing (audit logs, vulnerability scanning)
Req 12: Security policies (comprehensive ISMS documented)

Key Attestation

No CHD stored, processed, or transmitted on Hack23 systems
All payment processing via Stripe (PCI DSS certified)
Annual SAQ A completion with attestation

HIPAA Security Rule (Consulting Readiness)

Administrative Safeguards (§164.308)

Risk analysis and management ✅
Information access management ✅
Security awareness training ✅
Contingency planning ✅
Evidence: Risk Assessment Methodology

Physical Safeguards (§164.310)

Facility access controls ✅
Workstation security ✅
Device and media controls ✅
Evidence: Physical Security Policy

Technical Safeguards (§164.312)

Access controls ✅
Audit controls ✅
Integrity controls ✅
Transmission security ✅
Evidence: Cryptography Policy

Note: Hack23 AB does not currently process PHI. These mappings demonstrate consulting readiness for healthcare clients.

Compliance Verification Workflow

1. Quarterly Self-Assessment

Review Compliance Checklist
Update control implementation status
Document gaps and remediation plans
Record in management review

2. Evidence Collection

Policy documents (version controlled)
Configuration files (GitHub)
Audit logs (CloudTrail, GitHub audit)
Scan results (CodeQL, Dependabot, OpenSSF Scorecard)
Test results (backup tests, DR exercises)

3. Gap Analysis

Identify missing controls
Prioritize by risk and regulatory requirement
Create remediation action items
Track in issue management system

4. Continuous Monitoring

OpenSSF Scorecard (weekly)
Dependabot alerts (real-time)
CodeQL scans (on commit)
Backup validation (daily)
Incident detection (continuous)

Audit Readiness Checklist

Before External Audit

All policies current (annual review completed)
All registers updated (Asset, Risk, Stakeholder)
Quarterly management reviews documented
Incident log reviewed (even if no incidents)
Evidence accessible (GitHub, CloudTrail, logs)
Compliance Checklist current
Known gaps documented with remediation plans
Backups tested within last 90 days
DR exercise completed within last year
Vendor assessments current

Evidence Matrix

Control Domain	Primary Evidence	Secondary Evidence	Location
Policies	Policy documents	Approval records	GitHub repo
Access Control	MFA config, SSH keys	Access reviews	AWS IAM, GitHub
Vulnerability Mgmt	Scan results	Remediation records	CodeQL, Dependabot
Incident Response	IR plan	Incident logs	ISMS repo, GitHub Issues
BCP/DR	BCP/DR plans	Test results	ISMS repo, test logs
Change Management	Change records	Approval logs	GitHub PRs, commits
Asset Management	Asset Register	Discovery scans	ISMS repo, AWS Config
Monitoring	Audit logs	Alerting config	CloudTrail, GitHub audit

References

Hack23 ISMS Documentation

Compliance Checklist - Master compliance mapping
Information Security Policy - ISMS framework
Secure Development Policy - SDLC security
Classification Framework - Data and system classification
Risk Register - Enterprise risk management

Example Implementations

CIA Security Architecture - Full authentication implementation
CIA Compliance Manager Architecture - Frontend-only security
Riksdagsmonitor Security Architecture - Static site security

Framework References

ISO 27001:2022 - Information security management
NIST CSF 2.0 - Cybersecurity Framework
CIS Controls v8.1 - Security best practices
NIS2 Directive - EU cybersecurity requirements
EU CRA - Cyber Resilience Act

Remember

Unified Compliance: One ISMS serves multiple frameworks
Evidence-Based: Document everything, artifacts are proof
Continuous Monitoring: Compliance is ongoing, not annual
Risk-Based: Prioritize by business impact
Transparency: Public ISMS demonstrates capability
Multi-Framework: ISO + NIST + CIS + NIS2 + CRA + GDPR alignment
Audit Ready: Evidence always accessible
Gap Management: Know gaps, document remediation plans

适合场景

01

用户想查找某类 Agent Skill 时

02

需要根据任务场景推荐可安装能力包时

03

需要对比不同来源的安装命令和来源信息时

能力概览

能力 1

按任务关键词查找相关 Skills

能力 2

展示可复制的安装命令

能力 3

保留来源站点、仓库和原始说明，方便继续核验

能力 4

展示第三方安全扫描或审计结果

安装后应在对应宿主中按原始 README 的触发条件使用；具体调用方式请以来源页面和 README 为准。

平台分布

Codex

35.63%

按下载量换算31

Claude

29.02%

按下载量换算25

Cursor

20.78%

按下载量换算18

Gemini CLI

10.16%

按下载量换算9

安全审计

Gen Agent Trust Hub

通过

Socket

通过

Snyk

通过

权限和风险

需要联网

该 Skill 可能需要联网访问来源站点、仓库或外部 API；具体网络访问范围需要结合源码和 README 复核。

安装前确认

本站仅展示第三方公开信息，不托管安装包，不提供自动安装或运行环境。安装前应自行审查源码、依赖和命令行为。当前只有一个来源，正式发布前建议补源仓库或其他目录站核验。

来源信息

GitHub 仓库

github.com

/hack23/riksdagsmonitor

SKILL.md 来源

github.com

/hack23/riksdagsmonitor/tree/main/skills/compliance-checklist

skills-sh

skills.sh

/hack23/riksdagsmonitor/compliance-checklist

继续浏览同类 Skills

更多研究检索 Skills（73,675）返回 Skills 目录

上一个 Skill

compliance-checker（合规检查员）

compliance-checker 用于查找、检索和筛选相关信息，适合在 Codex、Claude、Cursor、Gemini CLI 中需要根据关键词、任务场景或来源线索快速定位候选结果时使用。可结合来源仓库、安装命令和原始 README 继续核验具体用法。安装前建议确认权限范围、维护状态，以及是否会触发联网、命令执行或文件读写。

下一个 Skill

compliance-legal（合规法律）

compliance-legal 用于查找、检索和筛选相关信息，适合在 Codex、Claude、Cursor、Gemini CLI 中需要根据关键词、任务场景或来源线索快速定位候选结果时使用。可结合来源仓库、安装命令和原始 README 继续核验具体用法。安装前建议确认权限范围、维护状态，以及是否会触发联网、命令执行或文件读写。