flow-compliance-validation

What this skill does

# Compliance Validation Flow

**You are the Core Orchestrator** for comprehensive compliance validation and attestation.

## Your Role

**You orchestrate multi-agent workflows. You do NOT execute bash scripts.**

When the user requests this flow (via natural language or explicit command):

1. **Interpret the request** and confirm understanding
2. **Read this template** as your orchestration guide
3. **Extract agent assignments** and workflow steps
4. **Launch agents via Task tool** in correct sequence
5. **Synthesize results** and finalize artifacts
6. **Report completion** with summary

## Compliance Validation Overview

**Purpose**: Validate project compliance with regulatory frameworks (GDPR, HIPAA, SOC2, PCI-DSS, ISO 27001, etc.)

**Key Deliverables**:
- Compliance Requirements Matrix
- Control Mapping Documentation
- Gap Analysis Report
- Remediation Plans
- Audit Evidence Package
- Compliance Attestation

**Success Criteria**:
- All applicable requirements identified and mapped
- Audit evidence collected for all controls
- Critical and high gaps remediated or risk accepted
- Control effectiveness validated
- Compliance attestation signed by Executive Sponsor

**Expected Duration**: 2-4 weeks (typical), 20-30 minutes orchestration

## Natural Language Triggers

Users may say:
- "Check compliance"
- "Validate GDPR compliance"
- "Run compliance audit"
- "Verify regulatory compliance"
- "Check SOC2 readiness"
- "Assess HIPAA compliance"
- "Prepare for ISO 27001 audit"

You recognize these as requests for this orchestration flow.

## Parameter Handling

### Compliance Framework Parameter

**Required**: User must specify which framework to validate

**Supported Frameworks**:
- **sox**: Sarbanes-Oxley Act (financial controls)
- **hipaa**: Health Insurance Portability and Accountability Act (healthcare data)
- **gdpr**: General Data Protection Regulation (EU data privacy)
- **pci-dss**: Payment Card Industry Data Security Standard (payment data)
- **iso27001**: ISO 27001 (information security management)
- **soc2**: SOC 2 Type I/II (service organization controls)
- **fedramp**: Federal Risk and Authorization Management Program (US government cloud)
- **ccpa**: California Consumer Privacy Act (California data privacy)
- **nist**: NIST Cybersecurity Framework (US government security)

### --guidance Parameter

**Purpose**: User provides upfront direction to tailor compliance focus

**Examples**:
```
--guidance "Focus on data privacy controls, GDPR Article 25 critical"
--guidance "Tight audit deadline, prioritize critical gaps only"
--guidance "First-time audit, need comprehensive evidence collection"
--guidance "Already have partial evidence from last year's audit"
```

**How to Apply**:
- Parse guidance for keywords: privacy, security, audit, deadline, evidence
- Adjust agent assignments (add privacy-officer for GDPR, security-architect for SOC2)
- Modify validation depth (comprehensive vs. streamlined based on timeline)
- Influence priority ordering (critical gaps first vs. complete coverage)

### --interactive Parameter

**Purpose**: You ask 6 strategic questions to understand compliance context

**Questions to Ask** (if --interactive):

```
I'll ask 6 strategic questions to tailor the compliance validation to your needs:

Q1: What are your top priorities for this compliance activity?
    (e.g., passing external audit, internal readiness, specific control areas)

Q2: What are your biggest compliance constraints?
    (e.g., time to audit, resource availability, technical limitations)

Q3: What compliance risks concern you most?
    (e.g., data breaches, audit failure, regulatory penalties)

Q4: What's your team's experience level with this framework?
    (Helps me gauge guidance depth and evidence collection support)

Q5: What's your target timeline for attestation?
    (Influences remediation prioritization and evidence collection pace)

Q6: Are there specific areas where you expect gaps?
    (e.g., encryption, access control, audit logging)

Based on your answers, I'll adjust:
- Agent assignments (add specialized reviewers)
- Validation depth (comprehensive vs. targeted)
- Priority ordering (critical controls first)
- Remediation approach (quick fixes vs. systematic improvements)
```

**Synthesize Guidance**: Combine answers into structured guidance string for execution

## Artifacts to Generate

**Primary Deliverables**:
- **Compliance Requirements Matrix**: Framework requirements mapped to controls → `.aiwg/compliance/requirements-matrix-{framework}.md`
- **Control Mapping**: Controls mapped to evidence → `.aiwg/compliance/control-mapping-{framework}.md`
- **Gap Analysis Report**: Identified compliance gaps → `.aiwg/compliance/gap-analysis-{framework}.md`
- **Remediation Plans**: Plans to address gaps → `.aiwg/compliance/remediation-plans-{framework}.md`
- **Evidence Collection Checklist**: Evidence inventory → `.aiwg/compliance/evidence-checklist-{framework}.md`
- **Control Testing Results**: Effectiveness validation → `.aiwg/compliance/control-testing-{framework}.md`
- **Compliance Report**: Executive summary → `.aiwg/reports/compliance-report-{framework}.md`
- **Attestation Statement**: Formal compliance attestation → `.aiwg/compliance/attestation-{framework}.md`

**Supporting Artifacts**:
- Control owner assignments
- Evidence repository index
- Risk acceptance documentation
- Audit readiness checklist

## Multi-Agent Orchestration Workflow

### Step 1: Map Compliance Requirements

**Purpose**: Identify applicable requirements and map to project controls

**Your Actions**:

1. **Initialize Compliance Assessment**:
   ```
   Create workspace:
   - .aiwg/compliance/
   - .aiwg/compliance/evidence/
   - .aiwg/compliance/working/
   ```

2. **Launch Requirements Mapping Agents** (parallel based on framework):

   **For GDPR**:
   ```
   Task(
       subagent_type="privacy-officer",
       description="Map GDPR requirements to controls",
       prompt="""
       Framework: GDPR (General Data Protection Regulation)

       Map GDPR requirements:
       1. Lawful Basis (Articles 6-9)
          - Consent management
          - Legitimate interest assessment
          - Contract necessity

       2. Data Subject Rights (Articles 12-23)
          - Right to access (Article 15)
          - Right to rectification (Article 16)
          - Right to erasure (Article 17)
          - Right to portability (Article 20)

       3. Privacy by Design (Article 25)
          - Data minimization
          - Purpose limitation
          - Storage limitation

       4. Data Protection (Articles 32-34)
          - Technical measures (encryption, pseudonymization)
          - Organizational measures (policies, training)
          - Breach notification (72-hour requirement)

       5. International Transfers (Articles 44-49)
          - Adequacy decisions
          - Standard contractual clauses
          - Binding corporate rules

       For each requirement:
       - Identify if applicable to project
       - Map to technical/administrative controls
       - Specify evidence requirements
       - Assign control owner (role)

       Output: .aiwg/compliance/requirements-matrix-gdpr.md
       """
   )
   ```

   **For HIPAA**:
   ```
   Task(
       subagent_type="security-architect",
       description="Map HIPAA requirements to controls",
       prompt="""
       Framework: HIPAA (Health Insurance Portability and Accountability Act)

       Map HIPAA requirements:
       1. Administrative Safeguards (§164.308)
          - Security Officer designation
          - Workforce training
          - Access management
          - Incident response procedures
          - Business Associate Agreements

       2. Physical Safeguards (§164.310)
          - Facility access controls
          - Workstation use policies
          - Device and media controls

       3. Technical Safeguards (§164.312)
          - Access control (unique user ID, encryption)
          - Audit controls (l