Can I use my own custom compliance policies?

Yes, you can use the --policy argument to specify a path to a custom policy document, allowing the skill to map threats to your organization's specific requirements.

Which frameworks are supported by the tm-compliance skill?

It natively supports OWASP Top 10 2021, SOC2 Trust Services Criteria, PCI-DSS v4.0, HIPAA, and GDPR, along with support for custom policy files.

Does this skill require an existing threat model?

Yes, it functions by analyzing existing threat model data (threats, controls, and gaps) typically stored in the .threatmodel/state directory.

What file formats are generated for the reports?

The skill generates two primary files: compliance.json for programmatic use and a visually rich compliance-report.md containing ASCII progress bars and status indicators.

Compliance Mapping Toolkit

Name: Compliance Mapping Toolkit
Author: josemlopez

byjosemlopez

보안 및 테스팅

Maps security threats and controls to major compliance frameworks like OWASP, SOC2, and PCI-DSS to generate audit-ready documentation.

소개

The Compliance Mapping Toolkit is a specialized skill for Claude Code that automates the alignment of your threat models with industry-standard regulatory frameworks. By bridging the gap between STRIDE categories and requirements from OWASP Top 10, SOC2, HIPAA, and more, it calculates coverage percentages and identifies critical security gaps. This skill is essential for security teams and developers who need to produce professional, visual audit reports and track compliance posture directly within their development environment.

주요 기능

Automated mapping of STRIDE threats to regulatory requirements
Visual report generation with ASCII progress bars and status indicators
0 GitHub stars
Identification of specific security gaps and non-compliance areas
Dual-format exports including machine-readable JSON and human-friendly Markdown
Support for OWASP Top 10, SOC2, PCI-DSS, HIPAA, and GDPR

사용 사례

Identifying missing security controls required by specific regulatory frameworks
Translating technical threat models into executive-level compliance summaries
Preparing for security audits by generating comprehensive coverage reports

소개

주요 기능

Automated mapping of STRIDE threats to regulatory requirements
Visual report generation with ASCII progress bars and status indicators
0 GitHub stars
Identification of specific security gaps and non-compliance areas
Dual-format exports including machine-readable JSON and human-friendly Markdown
Support for OWASP Top 10, SOC2, PCI-DSS, HIPAA, and GDPR

사용 사례

Identifying missing security controls required by specific regulatory frameworks
Translating technical threat models into executive-level compliance summaries
Preparing for security audits by generating comprehensive coverage reports