.

compliance/governance/access-review/SKILL.md

@@ -0,0 +1,76 @@
+---
+name: access-review
+description: Conduct periodic access reviews and certifications. Implement access governance and recertification workflows. Use when managing access compliance.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# Access Review
+
+Implement periodic access review processes.
+
+## Review Process
+
+```yaml
+access_review_workflow:
+  1_extract:
+    - Pull access data from systems
+    - Generate access report
+    
+  2_review:
+    - Manager certification
+    - Risk-based prioritization
+    - Decision documentation
+    
+  3_action:
+    - Revoke unnecessary access
+    - Update exceptions
+    - Document decisions
+    
+  4_report:
+    - Compliance metrics
+    - Remediation tracking
+```
+
+## AWS IAM Review
+
+```bash
+# Generate credential report
+aws iam generate-credential-report
+aws iam get-credential-report --output text --query Content | base64 -d
+
+# Find inactive users
+aws iam list-users | jq -r '.Users[] | select(.PasswordLastUsed < "2024-01-01") | .UserName'
+
+# List unused access keys
+aws iam get-access-key-last-used --access-key-id AKIAXXXXXXXX
+```
+
+## Automation
+
+```python
+def generate_access_report():
+    users = get_all_users()
+    report = []
+    
+    for user in users:
+        report.append({
+            'user': user.email,
+            'roles': user.roles,
+            'last_login': user.last_login,
+            'manager': user.manager,
+            'review_status': 'pending'
+        })
+    
+    return report
+```
+
+## Best Practices
+
+- Quarterly reviews minimum
+- Risk-based frequency
+- Manager attestation
+- Automated revocation
+- Audit trail maintenance

compliance/governance/asset-inventory/SKILL.md

@@ -0,0 +1,74 @@
+---
+name: asset-inventory
+description: Maintain IT asset inventory and configuration management database. Track hardware, software, and cloud resources. Use when managing IT assets.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# Asset Inventory
+
+Maintain comprehensive IT asset tracking.
+
+## Asset Categories
+
+```yaml
+asset_types:
+  hardware:
+    - Servers
+    - Network devices
+    - Endpoints
+    
+  software:
+    - Applications
+    - Operating systems
+    - Licenses
+    
+  cloud:
+    - Compute instances
+    - Storage
+    - Databases
+    
+  data:
+    - Databases
+    - File shares
+    - Backups
+```
+
+## AWS Inventory
+
+```bash
+# List all resources
+aws resourcegroupstaggingapi get-resources
+
+# EC2 instances
+aws ec2 describe-instances --query 'Reservations[*].Instances[*].[InstanceId,InstanceType,State.Name]'
+
+# AWS Config
+aws configservice describe-configuration-recorders
+```
+
+## Asset Database Schema
+
+```yaml
+asset:
+  id: unique identifier
+  name: display name
+  type: hardware/software/cloud
+  owner: responsible team
+  classification: public/internal/confidential
+  location: physical/cloud location
+  status: active/retired/decommissioned
+  created: timestamp
+  updated: timestamp
+  tags: []
+```
+
+## Best Practices
+
+- Automated discovery
+- Regular reconciliation
+- Owner assignment
+- Classification tagging
+- Lifecycle tracking

compliance/governance/change-management/SKILL.md

@@ -0,0 +1,81 @@
+---
+name: change-management
+description: Implement change management processes. Configure CAB reviews, change windows, and rollback procedures. Use when managing production changes.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# Change Management
+
+Implement structured change management processes.
+
+## Change Process
+
+```yaml
+change_workflow:
+  1_request:
+    - Change description
+    - Risk assessment
+    - Rollback plan
+    - Testing evidence
+    
+  2_review:
+    - Technical review
+    - Security review
+    - CAB approval (if high risk)
+    
+  3_schedule:
+    - Change window
+    - Communication
+    - Resource allocation
+    
+  4_implement:
+    - Execute change
+    - Verify success
+    - Update documentation
+    
+  5_review:
+    - Post-implementation review
+    - Lessons learned
+```
+
+## Change Classification
+
+| Type | Risk | Approval | Example |
+|------|------|----------|---------|
+| Standard | Low | Pre-approved | Patching |
+| Normal | Medium | Manager | Config change |
+| Emergency | Variable | Expedited | Security fix |
+
+## Pull Request Template
+
+```markdown
+## Change Description
+
+## Risk Level
+- [ ] Low - Standard change
+- [ ] Medium - Normal change
+- [ ] High - CAB required
+
+## Testing
+- [ ] Unit tests pass
+- [ ] Integration tests pass
+- [ ] Staging deployment verified
+
+## Rollback Plan
+
+## Stakeholders Notified
+- [ ] Operations
+- [ ] Security
+- [ ] Business owners
+```
+
+## Best Practices
+
+- Clear change categories
+- Required approvals by risk
+- Rollback procedures documented
+- Post-change verification
+- Change freeze windows

compliance/governance/policy-as-code/SKILL.md

@@ -0,0 +1,69 @@
+---
+name: policy-as-code
+description: Implement policy as code with OPA, Sentinel, and Kyverno. Automate policy enforcement in CI/CD and infrastructure. Use when enforcing compliance through automation.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# Policy as Code
+
+Automate policy enforcement through code.
+
+## Open Policy Agent (OPA)
+
+```rego
+# deny_public_buckets.rego
+package terraform.s3
+
+deny[msg] {
+    resource := input.resource.aws_s3_bucket[name]
+    resource.acl == "public-read"
+    msg := sprintf("S3 bucket '%s' has public ACL", [name])
+}
+```
+
+## Kyverno (Kubernetes)
+
+```yaml
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: require-labels
+spec:
+  validationFailureAction: enforce
+  rules:
+  - name: check-labels
+    match:
+      resources:
+        kinds:
+        - Pod
+    validate:
+      message: "Label 'app' is required"
+      pattern:
+        metadata:
+          labels:
+            app: "?*"
+```
+
+## Checkov
+
+```bash
+# Scan Terraform
+checkov -d . --framework terraform
+
+# Custom check
+from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
+
+class S3Encryption(BaseResourceCheck):
+    def scan_resource_conf(self, conf):
+        return CheckResult.PASSED if 'encryption' in conf else CheckResult.FAILED
+```
+
+## Best Practices
+
+- Version control policies
+- Test policies in CI
+- Gradual rollout (warn → enforce)
+- Exception management

compliance/governance/vendor-management/SKILL.md

@@ -0,0 +1,73 @@
+---
+name: vendor-management
+description: Implement vendor risk management programs. Assess third-party security and maintain vendor inventory. Use when managing supplier security.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# Vendor Management
+
+Manage third-party vendor security risks.
+
+## Vendor Assessment
+
+```yaml
+assessment_process:
+  1_identify:
+    - Catalog all vendors
+    - Classify by risk tier
+    
+  2_assess:
+    - Security questionnaire
+    - SOC 2 review
+    - Penetration test results
+    
+  3_contract:
+    - Security requirements
+    - Data processing agreement
+    - SLAs
+    
+  4_monitor:
+    - Continuous monitoring
+    - Annual reassessment
+    - Incident notification
+```
+
+## Risk Tiers
+
+| Tier | Criteria | Assessment |
+|------|----------|------------|
+| Critical | Access to sensitive data | Full assessment, annual |
+| High | Significant data access | Questionnaire + SOC 2 |
+| Medium | Limited data access | Security questionnaire |
+| Low | No data access | Basic due diligence |
+
+## Security Questionnaire
+
+```yaml
+categories:
+  governance:
+    - Security policies
+    - Risk management
+    - Compliance certifications
+    
+  technical:
+    - Access controls
+    - Encryption
+    - Vulnerability management
+    
+  operational:
+    - Incident response
+    - Business continuity
+    - Change management
+```
+
+## Best Practices
+
+- Tier-based assessments
+- Regular reassessment
+- Contract security terms
+- Incident notification requirements
+- Exit strategy planning