Compliance — scope the frameworks, build the register, run the rhythm

You turn a vague "we need to be compliant" into artifacts that survive an audit: a scoped framework list with current deadlines, a control register (one row per control, tagged to every framework it satisfies, each with an owner and an evidence source), a cadence calendar of the recurring work that keeps the program true between audits instead of scrambling once a year, and an evidence-source catalog.

Your job is scoping and orchestration, not legal opinion. You map the business to the frameworks, build the register, assign owners and cadences, and stand up the rhythm. You do not give legal advice; flag where a licensed specialist or auditor must sign off.

Route out — these are owned by siblings, not by you. You reference the resulting documents as evidence sources in the register; you do not write them here.

• Privacy notice, ROPA, DSAR flow, consent banner → ../gdpr-privacy/SKILL.md.
• Terms of Service, EULA, acceptable-use → ../terms-conditions/SKILL.md.
• Internal retention/classification policy text → ../data-policy/SKILL.md.
• Commercial contract / MSA / DPA clause drafting → ../contracts/SKILL.md.
• Hardening the code (authn, secrets, injection, headers) → ../secure-coding/SKILL.md.

Step 1 — Scope to the frameworks that actually bind

Do not copy a framework because a competitor has it. Map business attributes to obligations. Ask the operator the attribute questions, then apply this table.

Business attribute	Framework that binds	Current deadline / status (as of 2026-06-02)
Sells SaaS to enterprise / asked for a security report	SOC 2 (Security TSC mandatory)	Type II window 3–12 months; pick scope before you start
Wants an internationally recognized ISMS certificate	ISO/IEC 27001:2022	93 Annex A controls, 4 themes; 2013→2022 transition deadline passed 31 Oct 2025, all live certs are 2022
Stores / processes / transmits cardholder data	PCI DSS v4.0.1	Fully mandatory since 31 Mar 2025 — ~50 former "best practice" items (MFA on all CDE accounts, automated log review, internal vuln scans, periodic account reviews, asset inventory) are now hard requirements
Touches US protected health information (PHI/ePHI)	HIPAA Security Rule	In force today. A 2024 NPRM is NOT yet finalized (mid-2026) — flag forthcoming, but note OCR is already citing the proposed standard in enforcement
Handles personal data of EU/EEA users	GDPR (as a control source)	In force; feeds controls (access, breach notice, vendor DPAs). Document text → ../gdpr-privacy/SKILL.md
Builds or deploys an AI system, esp. high-risk use	EU AI Act	Phased — see below; 2 Aug 2026 is the active legal date for Annex III high-risk
Is an EU financial entity (or critical ICT vendor to one)	DORA	In force since Jan 2025 — ICT risk mgmt, incident reporting, resilience testing, third-party risk
Operates essential/important services in the EU	NIS2	Transposed in 21/27 member states by Mar 2026; many set a first audit deadline of 30 Jun 2026

EU AI Act — get the dates exactly right (high audit risk):

• Prohibited practices + AI-literacy: 2 Feb 2025.
• GPAI-model obligations + governance + penalties: 2 Aug 2025.
• Annex III (use-based) high-risk obligations: 2 Aug 2026.
• Annex I (product-regulated, incl. medical devices): 2 Aug 2027.
• The Digital Omnibus on AI (provisional trilogue agreement 7 May 2026) proposes deferring Annex III to 2 Dec 2027 and Annex I to 2 Aug 2028 — but this is NOT yet adopted. Until the amendment is published in the Official Journal, 2 Aug 2026 remains binding. Plan to the original date; flag the deferral as forthcoming-not-final.
• Fines: up to EUR 35M or 7% of global turnover (prohibited use), up to EUR 15M or 3% (high-risk non-compliance).

Rule: treat a not-yet-adopted amendment or an NPRM as forthcoming, never as law. Why: scoping to a draft that slips leaves you out of compliance on the date that is actually still in force. See references/frameworks.md for the per-framework control summaries.

Step 2 — Build the control register

One row per control. The register is the source of truth; everything else (checklists, audit responses, the cadence calendar) is generated from it.

Column	What goes in it
control-id	Stable internal id, e.g. AC-02
framework	Every framework this control satisfies (multi-tag)
owner	A named person/role accountable — never "the team"
evidence	The exact artifact that proves it, and where it lives
cadence	How often it is reviewed, sized by risk
last-verified	Timestamp of the last attestation
status	met / gap / in-progress

Bad → Good control:

Bad:  "We do access control."        (no owner, no proof, not testable)
Good: AC-02 | ISO A.5.18 + SOC2 CC6.2 + PCI 7.2 | owner: Head of IT |
      evidence: quarterly IdP access-export reviewed & signed |
      cadence: quarterly | last-verified: 2026-05-30 | status: met

The Good row is auditable: an auditor can ask the owner for the dated export and verify the claim in minutes.

Exploit the overlap — one control, many frameworks. SOC 2 and ISO 27001 overlap ~60–70% (risk assessment, access management, incident response, logging, change management, vendor management all count toward both). So:

• Bad: maintain a separate register per framework → the same control gets re-documented 3 times and drifts out of sync.
• Good: one register, each control tagged to all frameworks it satisfies. Generate the per-framework checklist as a filtered view.

Step 3 — Stand up the operating rhythm

Audit-readiness is a continuous state, not an annual project. Emit a cadence calendar and put the recurring work on real dates with owners.

Cadence	Recurring compliance work
Daily	Automated control monitoring / alerting (failed logins, drift)
Weekly	Control-health review — the heartbeat: walk open gaps, stale evidence, overdue owners
Monthly	Evidence refresh for high-risk controls; vulnerability-scan review
Quarterly	Access recertification; vendor/third-party risk reassessment
Annual	Full risk assessment; policy review; penetration test; audit prep

The weekly control-health review is the single habit that kills the annual scramble. Why: a gap caught weekly is a five-minute fix; a gap discovered during the audit window is a finding. The full calendar, register schema, and audit-prep runbook live in references/operating-rhythm.md.

Step 4 — Evidence discipline

Evidence is what an auditor tests. Every piece must be:

• Timestamped — undated evidence proves nothing about when the control ran.
• Mapped to the requirement — link the artifact back to the framework clause (e.g. this export proves ISO A.5.18 and SOC2 CC6.2).
• Owner-attested — the named owner signs/confirms it, so accountability is traceable.
• Refreshed on cadence — point-in-time evidence rots; a screenshot from last year does not prove a control operated over the audit window (Type II tests operating effectiveness across 3–12 months, not a single moment).

Store evidence where it is findable on demand, not assembled in a panic the week before the auditor arrives.

Anti-patterns

Anti-pattern	Why it fails	Do instead
Checklist with no owners	"Everyone's job" means no one's job; the auditor asks who, and the room goes silent	Every control names one accountable owner
Copying a framework you don't fall under	Wastes months certifying SOC 2 when the binding obligation was PCI DSS	Scope from business attributes (Step 1) first
Treating an NPRM / not-yet-adopted amendment as law	The draft slips; you're non-compliant on the date still legally in force	Plan to the active date; flag drafts as forthcoming
Point-in-time evidence	A single screenshot can't prove a control operated over the Type II window	Timestamped, periodic, owner-attested evidence
One register per framework	Same control re-documented 3× and drifts; the 60–70% overlap is wasted	One register, each control multi-tagged
Annual evidence scramble	Gaps surface as audit findings instead of weekly fixes	Weekly control-health review + cadence calendar
Drafting the privacy policy / DPA here	That's legal-document substance, a different skill's lane	Route to ../gdpr-privacy/SKILL.md / ../contracts/SKILL.md
Giving a legal opinion	You scope and orchestrate; you are not counsel	Flag where a licensed specialist or auditor must sign off

Verify

scripts/verify.sh <register> lints a control register (Markdown table or CSV): it checks the required columns exist and that no row is missing an owner, evidence, or cadence — the cardinal sin of checklist theater. Read-only, exits 0 on a clean or empty register.