agentleFS
Sign inStart free
daemon-blockint-techdaemon-blockint-tech/Agentic-Enteprises-Skill/cloud-compliance-specialist/SKILL.md

cloud-compliance-specialist

Skill8 starsChanged 6 months agoMITView on GitHub

Guides cloud compliance—mapping SOC 2, ISO 27001, HIPAA, PCI DSS, FedRAMP, and data-residency requirements to cloud controls; collecting audit evidence from AWS, GCP, and Azure APIs; shared-responsibility narratives; CSPM/Config continuous monitoring; customer assurance questionnaires (CAIQ/SIG); and cloud-specific gap remediation before attestations. Use when scoping regulated workloads in cloud, preparing cloud control evidence for auditors, interpreting provider compliance artifacts (BAA, PCI AOC, FedRAMP packages), or proving residency and logging in multi-account estates—not for org-wide GRC programs and audit coordination without cloud evidence (compliance-specialist), non-cloud systems evidence automation (compliance-engineer), implementing security guardrails (cloud-security-engineer), legal DPAs or contract redlines (commercial-counsel), security strategy (cybersecurity), or CI pipeline gates only (devsecops).

1 other project uses a version of this.

Adopted by

Most recently taken up by

The file

We split this skill into the rules it gives an agent

1 rule. About 0 are common, 1 is distinctive, and 0 are very specific to this project.

  • ≈0

    Common · estimate

    Many files like this have a rule of this kind.

  • ≈1

    Distinctive · estimate

    This author's own choices. Worth a look.

  • 0

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Distinctive:

    Document data residency — regions, replication, cross-border transfers (technical facts)

    line 27

≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Cloud Compliance Specialist

When to Use

  • Scope cloud workloads for SOC 2, ISO 27001, HIPAA, PCI, FedRAMP, or regional privacy rules
  • Map framework controls to cloud-native evidence (Config, org trails, IAM reports, KMS)
  • Build evidence collectors from cloud APIs and central log archive
  • Prepare auditor walkthroughs for multi-account landing zones and SaaS on IaaS/PaaS
  • Respond to customer security questionnaires with cloud control proof
  • Design continuous cloud compliance dashboards (CIS conformance, posture rules)
  • Document data residency — regions, replication, cross-border transfers (technical facts)
  • Track cloud gap remediation before observation period or assessor visit
  • Interpret provider shared responsibility and inheritance in audit narratives

When NOT to Use

  • Enterprise-wide GRC program, policies, audit prep (non-cloud) → compliance-specialist
  • Org-wide technical evidence automation → compliance-engineer
  • Implement SCPs, IAM hardening, CSPM rules → cloud-security-engineer
  • Landing zone architecture without compliance lens → cloud-architect, enterprise-cloud-architect
  • Cloud program strategy and migration portfolio governance → vp-of-cloud
  • Legal advice, DPAs, regulatory interpretation → commercial-counsel, corporate-counsel
  • SOX financial controls and journal testing → senior-revenue-accountant
  • Pipeline SAST/SBOM configuration → devsecops
  • AI model regulatory classification → ai-risk-governance

Related skills

NeedSkill
VP cloud program and regulated placement themesvp-of-cloud
GRC program, scope, gap plans, audit coordinationcompliance-specialist
Cross-domain compliance and evidence automationcompliance-engineer
Cloud security control implementationcloud-security-engineer
Enterprise cloud governance and CCoEenterprise-cloud-architect
Cloud reference architecturecloud-architect
Security program strategycybersecurity
Pipeline and SSDF evidencedevsecops
Data governance and privacy architecturedata-architect
Physical DC compliance evidencedata-center-design-execution-lead
FinOps spend analysisfinops-analyst
GL mapping and invoice reconciliationcompute-accounting-manager
Security risk registers and third-party risk tierssecurity-risk-analyst

Core Workflows

1. Scope and shared responsibility

Cloud in-scope boundaries and provider vs customer duties for audits.

See references/cloud_compliance_scope.md.

2. Framework mapping in cloud

SOC 2, ISO, HIPAA, PCI, FedRAMP control patterns on cloud.

See references/framework_cloud_mapping.md.

3. Cloud evidence collection

API sources, samples, retention for assessors.

See references/cloud_evidence_collection.md.

4. Residency and sovereignty

Regions, replication, cross-border technical documentation.

See references/residency_sovereignty.md.

5. Continuous cloud monitoring

CSPM, Config rules, drift and exceptions.

See references/continuous_cloud_monitoring.md.

6. Audit readiness and customer assurance

Walkthroughs, CAIQ/SIG, gap closure.

See references/audit_readiness_cloud.md.

Outputs

  • Cloud compliance scope memo — accounts, services, data classes, inherited controls
  • Control-to-evidence matrix — framework ID, cloud check, source, cadence, owner
  • Evidence package — exports with timestamps and population notes
  • Residency diagram — regions, backups, DR, subprocessors (technical)
  • CCM dashboard spec — rules, thresholds, exception register
  • Assessor FAQ — shared responsibility, logging, encryption, access

Principles

  • Inherit explicitly — document what the hyperscaler attests vs what you must prove
  • Evidence from systems of record — APIs and logs, not screenshots alone
  • Scope narrow — exclude out-of-scope accounts and legacy unless required
  • Continuous over point-in-time — drift detection before the auditor finds it
  • Partner with security — compliance defines what; cloud-security-engineer implements how

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free