.

compliance/frameworks/fedramp-compliance/SKILL.md

@@ -0,0 +1,71 @@
+---
+name: fedramp-compliance
+description: Implement FedRAMP requirements for federal cloud services. Configure NIST 800-53 controls and continuous monitoring. Use when providing cloud services to US federal agencies.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# FedRAMP Compliance
+
+Implement FedRAMP requirements for federal cloud services.
+
+## Impact Levels
+
+```yaml
+levels:
+  low:
+    controls: ~125
+    use_case: Public data
+    
+  moderate:
+    controls: ~325
+    use_case: CUI, most federal systems
+    
+  high:
+    controls: ~425
+    use_case: Law enforcement, emergency services
+```
+
+## NIST 800-53 Families
+
+```yaml
+control_families:
+  AC: Access Control
+  AU: Audit and Accountability
+  AT: Awareness and Training
+  CM: Configuration Management
+  CP: Contingency Planning
+  IA: Identification and Authentication
+  IR: Incident Response
+  MA: Maintenance
+  MP: Media Protection
+  PE: Physical Protection
+  PL: Planning
+  PS: Personnel Security
+  RA: Risk Assessment
+  CA: Assessment and Authorization
+  SC: System and Communications Protection
+  SI: System and Information Integrity
+  SA: System and Services Acquisition
+  PM: Program Management
+```
+
+## Continuous Monitoring
+
+```yaml
+conmon:
+  vulnerability_scans: Monthly
+  penetration_tests: Annual
+  poa_m_updates: Monthly
+  security_assessment: Annual
+```
+
+## Best Practices
+
+- 3PAO assessment
+- SSP documentation
+- POA&M tracking
+- Continuous monitoring
+- Annual authorization

compliance/frameworks/gdpr-compliance/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: gdpr-compliance
+description: Implement GDPR data protection requirements. Configure consent management, data subject rights, and privacy by design. Use when processing EU personal data.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# GDPR Compliance
+
+Implement GDPR requirements for EU data protection.
+
+## Key Principles
+
+```yaml
+principles:
+  lawfulness: Legal basis for processing
+  purpose_limitation: Specific, explicit purposes
+  data_minimization: Adequate, relevant, limited
+  accuracy: Accurate and up to date
+  storage_limitation: No longer than necessary
+  integrity: Secure processing
+  accountability: Demonstrate compliance
+```
+
+## Data Subject Rights
+
+```yaml
+rights:
+  - Right to access
+  - Right to rectification
+  - Right to erasure
+  - Right to restrict processing
+  - Right to data portability
+  - Right to object
+  - Rights related to automated decisions
+```
+
+## Technical Implementation
+
+```python
+# Data export for portability
+def export_user_data(user_id):
+    return {
+        "profile": get_profile(user_id),
+        "activity": get_activity_log(user_id),
+        "preferences": get_preferences(user_id)
+    }
+
+# Right to erasure
+def delete_user_data(user_id):
+    anonymize_profile(user_id)
+    delete_activity_log(user_id)
+    log_deletion(user_id)
+```
+
+## Best Practices
+
+- Privacy impact assessments
+- Data processing agreements
+- Consent management
+- Breach notification (72 hours)
+- Data Protection Officer (if required)

compliance/frameworks/hipaa-compliance/SKILL.md

@@ -0,0 +1,74 @@
+---
+name: hipaa-compliance
+description: Implement HIPAA security and privacy rules. Configure PHI protections and BAA requirements. Use when handling healthcare data.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# HIPAA Compliance
+
+Implement HIPAA requirements for healthcare data protection.
+
+## HIPAA Rules
+
+```yaml
+security_rule:
+  administrative:
+    - Risk analysis
+    - Security management
+    - Workforce training
+    - Contingency planning
+    
+  physical:
+    - Facility access
+    - Workstation security
+    - Device controls
+    
+  technical:
+    - Access control
+    - Audit controls
+    - Integrity controls
+    - Transmission security
+```
+
+## Technical Safeguards
+
+```yaml
+requirements:
+  encryption:
+    at_rest: AES-256
+    in_transit: TLS 1.2+
+    
+  access_control:
+    - Unique user IDs
+    - Emergency access procedure
+    - Automatic logoff
+    - Encryption/decryption
+    
+  audit:
+    - Access logging
+    - Activity monitoring
+    - Log retention (6 years)
+```
+
+## AWS HIPAA Setup
+
+```bash
+# Enable CloudTrail for HIPAA auditing
+aws cloudtrail create-trail \
+  --name hipaa-audit-trail \
+  --s3-bucket-name hipaa-logs \
+  --is-multi-region-trail \
+  --enable-log-file-validation
+
+# Use HIPAA-eligible services only
+```
+
+## Best Practices
+
+- Business Associate Agreements (BAAs)
+- Minimum necessary access
+- Breach notification procedures
+- Regular risk assessments

compliance/frameworks/iso27001-compliance/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: iso27001-compliance
+description: Implement ISO 27001 Information Security Management System. Configure ISMS controls and risk management. Use when implementing enterprise security frameworks.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# ISO 27001 Compliance
+
+Implement ISO 27001 Information Security Management System.
+
+## ISMS Framework
+
+```yaml
+plan_do_check_act:
+  plan:
+    - Define scope
+    - Risk assessment
+    - Risk treatment plan
+    - Statement of Applicability
+    
+  do:
+    - Implement controls
+    - Security awareness
+    - Document procedures
+    
+  check:
+    - Internal audits
+    - Management review
+    - Performance measurement
+    
+  act:
+    - Corrective actions
+    - Continual improvement
+```
+
+## Annex A Controls
+
+```yaml
+control_domains:
+  A.5: Information security policies
+  A.6: Organization of information security
+  A.7: Human resource security
+  A.8: Asset management
+  A.9: Access control
+  A.10: Cryptography
+  A.11: Physical security
+  A.12: Operations security
+  A.13: Communications security
+  A.14: System acquisition/development
+  A.15: Supplier relationships
+  A.16: Incident management
+  A.17: Business continuity
+  A.18: Compliance
+```
+
+## Risk Assessment
+
+```yaml
+risk_assessment:
+  identify:
+    - Asset inventory
+    - Threat identification
+    - Vulnerability assessment
+    
+  analyze:
+    - Likelihood rating
+    - Impact rating
+    - Risk calculation
+    
+  evaluate:
+    - Risk acceptance criteria
+    - Prioritization
+    - Treatment options
+```
+
+## Best Practices
+
+- Management commitment
+- Risk-based approach
+- Document everything
+- Regular internal audits
+- Continuous improvement

compliance/frameworks/pci-dss-compliance/SKILL.md

@@ -0,0 +1,77 @@
+---
+name: pci-dss-compliance
+description: Implement PCI DSS requirements for payment card data. Configure cardholder data environment and security controls. Use when processing payment cards.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# PCI DSS Compliance
+
+Implement PCI DSS requirements for payment card security.
+
+## Requirements
+
+```yaml
+requirements:
+  1_firewall:
+    - Network segmentation
+    - Firewall configuration
+    - CDE isolation
+    
+  3_protect_data:
+    - Mask PAN display
+    - Encrypt stored data
+    - Key management
+    
+  6_secure_systems:
+    - Patch management
+    - Secure development
+    - Change control
+    
+  8_access_control:
+    - Unique IDs
+    - MFA for remote access
+    - Password policies
+    
+  10_logging:
+    - Audit trail
+    - Time synchronization
+    - Log retention (1 year)
+    
+  11_testing:
+    - Vulnerability scans
+    - Penetration testing
+    - IDS/IPS monitoring
+```
+
+## Network Segmentation
+
+```
+Internet --> DMZ --> Firewall --> CDE
+                                  |
+            Non-CDE <-- Firewall --
+```
+
+## Data Protection
+
+```yaml
+encryption:
+  at_rest: AES-256
+  in_transit: TLS 1.2+
+  key_storage: HSM or dedicated key vault
+  
+tokenization:
+  - Replace PAN with token
+  - Store mapping securely
+  - Reduce CDE scope
+```
+
+## Best Practices
+
+- Minimize CDE scope
+- Use tokenization
+- Quarterly vulnerability scans
+- Annual penetration tests
+- ASV scan certification

compliance/frameworks/soc2-compliance/SKILL.md

@@ -0,0 +1,82 @@
+---
+name: soc2-compliance
+description: Implement SOC 2 Trust Services Criteria. Configure security, availability, and processing integrity controls. Use when achieving SOC 2 certification.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# SOC 2 Compliance
+
+Implement SOC 2 Trust Services Criteria for certification.
+
+## Trust Services Criteria
+
+```yaml
+criteria:
+  security:
+    - Access controls
+    - Change management
+    - Risk assessment
+    - Incident response
+    
+  availability:
+    - System monitoring
+    - Disaster recovery
+    - Capacity planning
+    - SLA management
+    
+  processing_integrity:
+    - Input validation
+    - Processing completeness
+    - Output accuracy
+    
+  confidentiality:
+    - Data classification
+    - Encryption
+    - Access restrictions
+    
+  privacy:
+    - Data collection notice
+    - Consent management
+    - Data retention
+```
+
+## Key Controls
+
+```yaml
+controls:
+  CC6.1_logical_access:
+    - MFA enforcement
+    - Role-based access
+    - Access reviews
+    
+  CC7.2_monitoring:
+    - Log aggregation
+    - Alert thresholds
+    - Incident tracking
+    
+  CC8.1_change_management:
+    - Change requests
+    - Approval workflows
+    - Testing requirements
+```
+
+## Evidence Collection
+
+```bash
+# Access review export
+aws iam generate-credential-report
+aws iam get-credential-report
+
+# Audit logs
+aws cloudtrail lookup-events --start-time $(date -d '30 days ago' --iso)
+```
+
+## Best Practices
+
+- Continuous compliance monitoring
+- Annual risk assessments
+- Regular control testing
+- Documentation maintenance