From grc-engineer
Aggregates cached connector findings, maps them to specified compliance frameworks via SCF crosswalk, and generates prioritized gap reports with remediation links.
How this command is triggered — by the user, by Claude, or both
Slash command
/grc-engineer:gap-assessmentThe summary Claude sees in its command listing — used to decide when to auto-load this command
# /grc-engineer:gap-assessment Produce a multi-framework gap assessment by joining cached connector findings with the [Secure Controls Framework](https://securecontrolsframework.com) crosswalk (1,468 controls × 249 frameworks). ## Usage **Arguments**: - `<frameworks>` (required): comma-separated list. Use common names or SCF framework IDs. - Aliases: `SOC2`, `ISO-27001-2022`, `NIST-800-53-r5`, `PCI-DSS-4`, `FedRAMP-Moderate`, `FedRAMP-High`, `CMMC-2`, `HITRUST-CSF`, `CIS-v8`, `HIPAA`, `GDPR`, `NYDFS`, `DORA`, `Essential-8`, `IRAP`, `ISMAP`, `PBMM`, `GLBA` - Or: any SCF framework_id...
Produce a multi-framework gap assessment by joining cached connector findings with the Secure Controls Framework crosswalk (1,468 controls × 249 frameworks).
/grc-engineer:gap-assessment <frameworks> [options]
Arguments:
<frameworks> (required): comma-separated list. Use common names or SCF framework IDs.
SOC2, ISO-27001-2022, NIST-800-53-r5, PCI-DSS-4, FedRAMP-Moderate, FedRAMP-High, CMMC-2, HITRUST-CSF, CIS-v8, HIPAA, GDPR, NYDFS, DORA, Essential-8, IRAP, ISMAP, PBMM, GLBAcurl https://hackidle.github.io/scf-api/api/crosswalks.json | jq '.frameworks[].framework_id')Options:
--sources=<csv> — restrict to specific connectors (e.g. aws-inspector,github-inspector). Default: all connectors with cached findings.--output=<fmt> — markdown (default), json, sarif, oscal-ar--cache-dir=<path> — override ~/.cache/claude-grc/findings--report-dir=<path> — where to write the report bundle (default: ./gap-assessment-<run_id>/)--refresh — force a fresh collection from each source (delegates to each /<tool>:collect --refresh)--offline — use cached SCF data only; skip network--quiet — suppress progress output to stderr~/.cache/claude-grc/findings/<source>/*.json for Findings documents matching schemas/finding.schema.json v1.(control_framework, control_id) is resolved to one or more SCF control IDs.severity=critical or severity=high. Resolve before audit.severity=medium.severity=low.--output.When the user invokes /grc-engineer:gap-assessment, run the orchestrator directly:
node plugins/grc-engineer/scripts/gap-assessment.js <frameworks> [options]
The script reads args from argv. Pass through the user's flags unchanged. The script prints the report to stdout and progress/errors to stderr. It also writes a report bundle directory containing:
gap-report.md (or .json / .sarif / .oscal-ar)findings.normalized.json — intermediate canonical form, useful for re-rendering or downstream toolingFirst run — SOC 2 against a GitHub-only environment:
/grc-engineer:gap-assessment SOC2 --sources=github-inspector
Multi-framework optimization scan:
/grc-engineer:gap-assessment SOC2,FedRAMP-Moderate,ISO-27001-2022,NIST-800-53-r5
CI/CD integration (non-interactive):
node plugins/grc-engineer/scripts/gap-assessment.js SOC2,PCI-DSS-4 --output=sarif --quiet > gap.sarif
OSCAL export for a FedRAMP package:
/grc-engineer:gap-assessment FedRAMP-Moderate --output=oscal-ar --sources=aws-inspector
The markdown report has six sections:
Remediation refs of the form grc-engineer://generate-implementation/<control>/<cloud> are direct invocations of /grc-engineer:generate-implementation — the tool generates the Terraform, Python, or policy-as-code to fix it.
0 — success2 — usage error3 — no cached findings (nothing to assess)4 — no frameworks requested5 — SCF API unreachable and no cache6 — all findings failed validation/<tool>:setup followed by /<tool>:collect first.--offline./grc-engineer:pipeline-status — which connectors are configured, last-run, cache freshness/grc-engineer:map-controls-unified — one control across every framework/grc-engineer:optimize-multi-framework — "implement once, satisfy many" ROI analysis/grc-engineer:generate-implementation — produce remediation code for a control/grc-engineer:monitor-continuous — schedule recurring gap assessments with alertingnpx claudepluginhub grcengclub/claude-grc-engineering --plugin grc-engineer/gap-analysisPerforms structured gap analysis against compliance frameworks like FedRAMP or SOC2 for a given scope, generating assessment templates, interactive worksheets, gap summaries, heat maps, and remediation roadmaps.
/flow-compliance-validationOrchestrates compliance validation for <compliance-framework> (GDPR, HIPAA, SOC2, etc.) in [project-directory], generating requirements matrix, gap analysis report, remediation plans, and attestation.
/gap-analysisAnalyzes current security posture against HITRUST CSF requirements, identifies control gaps (missing, partial, documentation), prioritizes risks by category.
/track-complianceTracks compliance status across frameworks like SOC2, PCI-DSS, ISO27001; generates reports with overall scores, gaps, deadlines, trends in summary, detailed, or dashboard formats.
/complianceGenerates compliance attestations, auditor walkthroughs, buyer-facing badges, stack audits, and PR augmentation for security frameworks.
/posture-reviewGenerates cloud security posture review report from SentinelOne, listing misconfigurations by severity and domain, compliance gaps, client breakdowns, and remediation guidance.