compliance-control-foundation

What problem does it solve?

This Skill prevents compliance teams from maintaining separate, drifting control lists for ISO 27001, ISO 42001, and SOC 2 by creating one framework-agnostic baseline that can be projected into each standard without duplication.

Core Features & Use Cases

• Unified control catalog: Defines a single catalog across access control, cryptography, change management, logging and monitoring, incident response, vendor management, risk assessment, and AI governance when needed.
• Map-don't-rebuild workflow: Reuses shipped mechanisms such as authorization matrices, RLS audits, audit logs, incident runbooks, and supply-chain reviews instead of rewriting them as new controls.
• Honest compliance status: Records each control with an objective, owner, mechanism, evidence hook, and status such as implemented, partial, or missing so gaps remain visible.
• Framework-neutral output: Keeps clause and criteria references out of the catalog so projections and crosswalks can evolve independently.
• Use case: A company preparing for SOC 2 now and ISO 27001 later can use this Skill to produce one baseline control set that both programs consume.

Quick Start

Ask for a framework-neutral common control set for your organization, naming the target frameworks, the catalog owner, and the existing security artifacts you want mapped.