Governance, risk and compliance
- When to use it
- Governance, risk and compliance drafts for compliance leads, DPOs and risk owners: a risk register with a checked heat map, a GDPR data protection impact assessment, a SOC 2 control-to-evidence map, and answers to a customer security questionnaire drawn from your own evidence, each prepared for a qualified person to review.
- Covers
- Manage risk and compliance (4)
- Where you decide
- G8.1 human — comply → sign-off
- Size
- 9 skills · 1 loop · 2 gates, 1 needs a person
npx skilldrop-cli install --pack grc
Installs 9 skills, including core.
Other ways to install
The pack's loops too, each as an invokable skill:
npx skilldrop-cli install --loop --pack grc
In Claude Code, as a plugin (after /plugin marketplace add sananthanarayan/skilldrop):
/plugin install grc@skilldrop
Into Cursor, Kiro or another IDE:
npx skilldrop-cli install --pack grc --ide cursor
Start here: Turn a list of worries into a scored, owned risk register
Paste this into your agent:
Build a risk register for our office relocation project. Risks: the lease on the new floor isn't signed yet (owner: Facilities Manager, Dana Cole), the network fit-out might slip past the move date (owner: IT Manager, Raj Patel), and staff may push back on desk sharing (owner: HR Business Partner, Lena Fox). Use a 5x5 scale; today is 2026-10-01.
- Before you start
- A list of the risks you already worry about, with an owner for each if you know them
- How to tell it worked
- risk-register writes a CSV where each risk has a cause, an event and a consequence, inherent and residual scores on a defined 5x5 scale, a named owner and a treatment with a date; its check script prints PASS, a heat map, and the top risks needing a decision.
- If nothing happens
- If the script fails, read its error lines: each names the row and the field to fix. If risk-register does not activate, ask for it by name ("use risk-register").
A typical session
When: An audit, a regulator, a new processing activity or a risk committee needs a written, defensible view of what could go wrong and what you do about it.
You bring:
- the scope: a project, a product, a business unit or the whole company
- the risks you know about and who owns each
- for a DPIA: what personal data you process, why, where it goes and how long you keep it
- for SOC 2: the Trust Services Criteria in scope, the report type, and your controls list if you have one
-
- You
- Give it the scope, the risks and the owners.
- You get
- A register CSV with each risk as cause, event and consequence, inherent and residual scores on a defined scale, treatments with dates, a checked heat map, and the top risks needing a decision.
- You decide
- Which risks to accept, fund or avoid.
-
- You
- For any activity that processes personal data and looks high risk, describe the processing, the data and the recipients.
- You get
- A DPIA draft in the structure GDPR requires, with a data inventory, lawful basis per purpose, risks to individuals, measures, residual risk, a view on prior consultation, and questions for the DPO.
- You decide
- Whether the DPO signs off, asks for more measures, or recommends prior consultation.
-
- You
- Name the criteria in scope, Type I or Type II, the audit period, and your controls and systems.
- You get
- A control-to-criteria map with the evidence an auditor will ask for, where it lives, who owns it, how often it is produced, and the gaps, as a table and a CSV.
-
- You
- When a customer sends a security questionnaire, give it the form and your policies, audit report and earlier answers.
- You get
- The customer's form filled in, with the document behind each answer, the questions your evidence doesn't cover marked as needing input, and conflicts and stale evidence flagged.
- You decide
- What the security owner confirms, corrects or declines to answer before it is sent.
-
- You
- Run it on the DPIA or the evidence map before it goes to the DPO or the auditor.
- You get
- A verdict and severity-tagged findings with a fix for each.
- You decide
- Send it, fix it, or go back for missing facts.
You end with: A risk register you can keep up to date, a DPIA draft ready for the DPO, and an evidence map that tells each control owner what to collect before the audit.
Loops
- comply — Take a change that carries risk (a launch, a new vendor, a new use of personal data) to a risk position its owner has signed: a risk register scored inherent and residual, a DPIA when personal data is processed, the evidence behind every control the ratings rely on, a script that checks the register, and a sign-off only the named owner can give.
register → assess → evidence → check [G8] → sign-off [G8.1]
Compare Governance, risk and compliance with another pack
Skills in this pack (4)
- dpia Draft a data protection impact assessment (DPIA) for one processing activity in the structure GDPR Article 35(7) requires — a systematic description of the processing and its purposes, necessity and proportionality, risks to the rights and freedoms of individuals, and the measures to address them — with a data inventory (categories, special category data, data subjects, sources, recipients, transfers outside the EEA, retention), the lawful basis per purpose, a likelihood × severity risk table scored for harm to people, residual risk, a view on prior consultation, and the open questions for the DPO. Use when the user needs a DPIA or PIA, is launching something that processes personal data in a new or risky way, or asks "do we need a DPIA", "write the DPIA for…", "privacy impact assessment". heavy
- risk-register Build or update an enterprise or project risk register — each risk written as cause, event and consequence, scored for likelihood and impact on a defined scale, inherent and residual ratings, a named owner, a treatment (avoid, reduce, transfer, accept), controls, a due date and a review trigger — with a heat map, the top risks that need a decision, and a stdlib script that validates the register CSV and flags overdue reviews. Use when the user wants a risk register, a risk log, a RAID log's risk section, a heat map, or says "what are our top risks", "update the risk register", "score these risks". standard
- security-questionnaire-response Answer a customer's security questionnaire from your own evidence: each question gets a direct answer (Yes, No, Partial or Not applicable), a short narrative, and the document and section it rests on. Questions the evidence doesn't cover are marked as needing input instead of being answered, and conflicts between sources, stale evidence and answers that would commit you to future work are flagged for the security owner. Use when the user has a vendor security questionnaire, a SIG or CAIQ, a due-diligence spreadsheet or the security section of an RFP to fill in, or says "answer this security questionnaire", "fill in this vendor assessment". standard
- soc2-evidence-map Map an organisation's controls to the SOC 2 Trust Services Criteria in scope (Security always, plus Availability, Confidentiality, Processing Integrity or Privacy if chosen), and for each control list the evidence an auditor will ask for, the system it lives in, the owner, how often it is produced, and the gaps — distinguishing Type I (designed and in place at a date) from Type II (operating over a period, sampled from a full population) — as a table and a CSV the team can work from. Use when the user is preparing for a SOC 2 audit or readiness assessment, says "SOC 2 evidence", "map our controls to the TSC", "what will the auditor ask for", "SOC 2 gap analysis". standard
Included from core (5)
- brief-intake Turn raw mess — a Slack thread, meeting transcript, Jira ticket, half-written Notion page, email chain, or paragraph of free-form context — into a structured brief that the downstream skill (adr-generator, design-doc, runbook-generator, exec-summary, slide-outliner) can consume without further intake. Use whenever the user has unstructured source material and is about to invoke another skilldrop skill, or when a draft is missing the load-bearing context the next step will need. standard
- context-graph Map the decisions behind a codebase from its ADRs, RFCs and design records — each record's status and date, what supersedes or amends what, which records cite which, the files and folders each decision governs, and with git the commits that implemented it and the commits that changed each decision's code since it was made, and who made them — then answer "why is it like this?" from the record and check the record is still true. Finds supersessions only one side records, current decisions pointing at code that is gone, code that has drifted from its decision, two current decisions governing the same path, and references to records that don't exist. Use when the user asks "why do we use X", "which decisions govern this file or service", "is this ADR still current", "has the code drifted since we decided this", "are our ADRs out of date", "what was decided before I change this", wants a map of the architecture decisions, or is onboarding onto a codebase's history. standard
- council-review Convene a council of distinct senior-engineer personas (Architect, Security, Operator/SRE, Pragmatist, User-Advocate, plus optional bench seats) to deliberate a decision, design, or code change — each takes an independent stance, the genuine disagreements are surfaced as named cruxes, and a Chair issues a reconciled verdict that records dissents and states what would change the decision. The "Claude Council." Use when a choice has real tradeoffs and one reviewer's voice isn't enough: architecture decisions, risky changes before merge, RFC/design scrutiny, "should we adopt X?", rewrite-vs-refactor, or a pre-mortem. heavy
- doc-critique Review an existing document — ADR, design doc, runbook, exec summary, tech-comparison matrix, deck outline, decision log — and produce a structured critique against the same quality bars the skilldrop generators enforce. Categorizes findings by severity (blocker / major / minor / nit), points to the exact section/line, and suggests a concrete fix for each. Use when the user wants a second-pair-of-eyes review before sharing a doc, or has been handed someone else's artifact and wants to know what to push back on. heavy
- output-hygiene Review agent-written text before it ships and strip the machine artifacts it carries — invisible Unicode, non-breaking spaces, homoglyphs, harness-added provenance trailers, trailing chat closers — then flag the prose tells a script cannot catch, each quoted with a rewrite. Use when the user wants to clean up AI-generated output, asks to remove a Claude watermark, attribution footer, or "Generated with" line, wants a draft that does not read as machine-written, or needs a pre-ship hygiene pass on a document, commit message, or pasted chat answer. standard