Use the Governance, risk and compliance pack

Install the Governance, risk and compliance pack, run its first task, and follow a typical session step by step.

Governance, risk and compliance drafts for compliance leads, DPOs and risk owners: a risk register with a checked heat map, a GDPR data protection impact assessment, a SOC 2 control-to-evidence map, and answers to a customer security questionnaire drawn from your own evidence, each prepared for a qualified person to review.

Reach for it when: An audit, a regulator, a new processing activity or a risk committee needs a written, defensible view of what could go wrong and what you do about it.

1. Install it

npx skilldrop-cli install --pack grc                 # Claude Code, your user folder
npx skilldrop-cli install --pack grc --project       # Claude Code, this repo
npx skilldrop-cli install --pack grc --ide cursor    # or kiro, codex, antigravity, copilot
npx skilldrop-cli install --pack grc --local         # this repo, hidden from git

In Claude Code you can also add the marketplace once (/plugin marketplace add sananthanarayan/skilldrop) and run /plugin install grc@skilldrop.

It brings core with it, so the shared skills are there too.

2. Run the first task: turn a list of worries into a scored, owned risk register

Before you start:

• A list of the risks you already worry about, with an owner for each if you know them

Paste this into your agent:

Build a risk register for our office relocation project. Risks: the lease on the new floor isn't signed yet (owner: Facilities Manager, Dana Cole), the network fit-out might slip past the move date (owner: IT Manager, Raj Patel), and staff may push back on desk sharing (owner: HR Business Partner, Lena Fox). Use a 5x5 scale; today is 2026-10-01.

How to tell it worked: risk-register writes a CSV where each risk has a cause, an event and a consequence, inherent and residual scores on a defined 5x5 scale, a named owner and a treatment with a date; its check script prints PASS, a heat map, and the top risks needing a decision.

If nothing happens: If the script fails, read its error lines: each names the row and the field to fix. If risk-register does not activate, ask for it by name ("use risk-register").

3. A typical session

Bring:

• the scope: a project, a product, a business unit or the whole company
• the risks you know about and who owns each
• for a DPIA: what personal data you process, why, where it goes and how long you keep it
• for SOC 2: the Trust Services Criteria in scope, the report type, and your controls list if you have one
• risk-register: Give it the scope, the risks and the owners. You get: A register CSV with each risk as cause, event and consequence, inherent and residual scores on a defined scale, treatments with dates, a checked heat map, and the top risks needing a decision. You decide: Which risks to accept, fund or avoid.
• dpia: For any activity that processes personal data and looks high risk, describe the processing, the data and the recipients. You get: A DPIA draft in the structure GDPR requires, with a data inventory, lawful basis per purpose, risks to individuals, measures, residual risk, a view on prior consultation, and questions for the DPO. You decide: Whether the DPO signs off, asks for more measures, or recommends prior consultation.
• soc2-evidence-map: Name the criteria in scope, Type I or Type II, the audit period, and your controls and systems. You get: A control-to-criteria map with the evidence an auditor will ask for, where it lives, who owns it, how often it is produced, and the gaps, as a table and a CSV.
• security-questionnaire-response: When a customer sends a security questionnaire, give it the form and your policies, audit report and earlier answers. You get: The customer's form filled in, with the document behind each answer, the questions your evidence doesn't cover marked as needing input, and conflicts and stale evidence flagged. You decide: What the security owner confirms, corrects or declines to answer before it is sent.
• doc-critique: Run it on the DPIA or the evidence map before it goes to the DPO or the auditor. You get: A verdict and severity-tagged findings with a fix for each. You decide: Send it, fix it, or go back for missing facts.

You end with: A risk register you can keep up to date, a DPIA draft ready for the DPO, and an evidence map that tells each control owner what to collect before the audit.

4. Run it as a loop

A loop runs the skills in order and stops at each gate for a verdict. Install and start one:

npx skilldrop-cli install --loop --pack grc

• comply: Take a change that carries risk (a launch, a new vendor, a new use of personal data) to a risk position its owner has signed: a risk register scored inherent and residual, a DPIA when personal data is processed, the evidence behind every control the ratings rely on, a script that checks the register, and a sign-off only the named owner can give. Say "run the comply loop on this". Stages: register → assess → evidence → check [G8] → sign-off [G8.1].

Next

• Every skill in the Governance, risk and compliance pack: what each one makes, needs and hands off to
• The pack's page, with one-click copy for every command
• Upgrade installed skills when a new version ships

Edit this page on GitHub · View source