From Orca Skills
Analyzes compliance gaps across frameworks (PCI DSS, SOC 2, CIS, NIST) — ranks failing controls by impact, identifies quick wins, and generates remediation plans. Use when asked about compliance status or failures.
How this skill is triggered — by the user, by Claude, or both
Slash command
/orca-skills:orca-compliance-gapThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Answers the question: **"Where are we failing, what's the fastest path to improve, and who owns the worst gaps?"**
Answers the question: "Where are we failing, what's the fastest path to improve, and who owns the worst gaps?"
Given a compliance framework (or all frameworks), analyzes failing controls ranked by blast radius, identifies quick wins (single-fix controls), breaks down gaps by account/business unit, and generates a prioritized remediation plan.
/orca-compliance-gap
/orca-compliance-gap PCI DSS
/orca-compliance-gap CIS AWS
/orca-compliance-gap SOC 2
Or natural language:
Parse user input to determine:
Query 1: All enabled frameworks with current scores
get_enabled_compliance_frameworks:
(no filters)
Query 2: Compliance trend over time
get_compliance_trend_over_time:
filters:
datetime_filter: 30
Query 3: Compliance by account
get_compliance_analysis_by_account_or_business_unit:
group_by: "accounts"
Query 4: Compliance by business unit
get_compliance_analysis_by_account_or_business_unit:
group_by: "business_units"
For the target framework (or the worst-scoring one if user said "all"), run Queries 5-8 in parallel. Query 6 depends on Query 5 (it needs the rule_ids), so run it after Query 5 returns.
Query 5: Failing control tests
get_compliance_framework_control_tests:
framework_id: <id>
filters:
status: "fail"
Query 6: Compliant + non-compliant assets per failing control (runs after Query 5)
Scope to the top N failing controls (default N=5) to keep response sizes manageable. The rule_id comes from Query 5's tests[].rule_id.
get_control_test_assets:
framework_id: <id>
rule_id: <tests[].rule_id from Query 5> # one call per top-N failing control
Returns { non_compliant_assets: [...], compliant_assets: [...] } — both arrays, so true pass/fail ratios are computable per control, not just a failure count.
Query 7: Framework stats
get_compliance_framework_stats_for_asset:
framework_id: <id>
Query 8: Assets with most failures
get_framework_assets_with_failed_controls_count:
framework_id: <id>
Query 9: Per-framework account breakdown
get_compliance_analysis_by_account_or_business_unit:
group_by: "accounts"
framework_ids: ["<framework_id>"]
A "quick win" is a failing control where:
non_compliant_assets.length from Query 6 (get_control_test_assets), not a guess (treat < 5 as low)Rank failing controls by:
get_control_test_assets), call get_related_compliance_frameworks_for_asset with the asset's group_unique_id as asset_unique_id. A control/asset participating in more frameworks gets priority.
result[] to entries where active === true. The result array includes frameworks with active: false (frameworks that could apply to this asset type but aren't enabled in the tenant). Counting them inflates cross-framework impact with frameworks the customer hasn't enabled.Map failing controls to accounts to identify:
Build a prioritized remediation plan:
Phase 1: Quick Wins (days)
Phase 2: Systematic Fixes (weeks)
Phase 3: Architectural Changes (months)
CRITICAL: Never leave the user with just data. After EVERY output layer, suggest the next action and offer to generate remediation code.
After the dashboard and after every drill-down section:
When the user selects a format:
compliance-fix-<control-id>.<ext> (e.g., .tf, .yml, .sh)Format mapping:
| User says | Extension | Template |
|---|---|---|
| Terraform | .tf | HCL with provider + resource blocks |
| CloudFormation | .cfn.yaml | YAML template with Parameters/Resources |
| Ansible | .yml | Playbook with tasks |
| CLI | .sh | Shell script with cloud CLI commands |
| Instructions | inline | Numbered step-by-step console walkthrough |
| Pulumi | .ts | TypeScript Pulumi program |
| ARM/Bicep | .bicep | Bicep template |
═══════════════════════════════════════════════════════════════════
COMPLIANCE GAP ANALYSIS — <framework or "All Frameworks">
<date> | <account scope>
═══════════════════════════════════════════════════════════════════
POSTURE: <overall assessment — 1 line>
┌─────────────────────────────────────────────────────────────────┐
│ FRAMEWORKS <N> enabled │
│ AVG SCORE <X>% │
│ WORST <framework> at <X>% │
│ BEST <framework> at <X>% │
│ TREND (30d) <improving / stable / degrading> │
│ QUICK WINS <N> controls fixable with single changes │
│ WORST ACCOUNT <account> — <X>% avg score │
└─────────────────────────────────────────────────────────────────┘
FRAMEWORK SCORES:
Framework Score Trend Status
─────────────────────────────────────────────────────────
<framework> <X>% ↓ -N% ⚠ DROPPED
<framework> <X>% → 0% ✓ STABLE
<framework> <X>% ↑ +N% ✓ IMPROVING
...
# Show the next line ONLY when fewer than 3 frameworks are enabled.
# Source from get_recommended_compliance_frameworks_to_enable.
Recommended additional frameworks (from connected providers <connected_providers>): <top 3 display_names>
TOP FAILING CONTROLS (highest impact):
[1] <control name> — failing on <N> assets, affects <M> frameworks
[2] <control name> — failing on <N> assets, affects <M> frameworks
[3] <control name> — failing on <N> assets, affects <M> frameworks
RECOMMENDED ACTION:
The fastest score improvement: fix <top control> — affects
<N> assets across <M> frameworks. I can generate the fix now.
What format? terraform | cloudformation | ansible | cli |
instructions | pulumi | arm/bicep
═══════════════════════════════════════════════════════════════════
Or drill down: controls | quick wins | accounts | trends |
remediation plan | <framework name> | full
═══════════════════════════════════════════════════════════════════
───────────────────────────────────────────────────────────────────
FAILING CONTROLS — <framework>
Score: <X>% (<P> pass, <F> fail of <T> total)
───────────────────────────────────────────────────────────────────
CRITICAL CONTROLS FAILING:
<control-id> <control name>
Assets failing: <N> | Frameworks: <list>
Fix: <1-line remediation summary>
Failing assets (from get_control_test_assets):
- <name> (<type>) — <ui_url>
- <name> (<type>) — <ui_url>
...
<control-id> <control name>
...
HIGH CONTROLS FAILING:
...
MEDIUM CONTROLS FAILING:
...
(Rendering the real failing assets — name, type, ui_url — per control is what lets
generated remediation code target actual resource IDs instead of a generic template.)
FIX NOW:
Pick any control and I'll generate the remediation code.
Choose format: terraform | cloudformation | ansible | cli |
instructions | pulumi | arm/bicep
───────────────────────────────────────────────────────────────────
───────────────────────────────────────────────────────────────────
QUICK WINS — Highest ROI Fixes
───────────────────────────────────────────────────────────────────
[1] <control name>
Fix: <specific action>
Impact: passes control in these active frameworks: <active framework
display_names from get_related_compliance_frameworks_for_asset,
filtered to active === true>
Failing assets (from get_control_test_assets):
- <name> (<type>) — <ui_url>
- ...
Score boost: ~<X>% across <frameworks>
Effort: LOW (single config change)
[2] <control name>
...
[3] <control name>
...
ESTIMATED TOTAL IMPROVEMENT:
Fixing all <N> quick wins → +<X>% average score improvement
LET'S DO IT:
I'll generate fixes for all quick wins in one batch.
Choose format: terraform | cloudformation | ansible | cli |
instructions | pulumi | arm/bicep
───────────────────────────────────────────────────────────────────
───────────────────────────────────────────────────────────────────
COMPLIANCE BY ACCOUNT
───────────────────────────────────────────────────────────────────
Account Avg Score Worst Framework Failures
──────────────────────────────────────────────────────────────────
<account-1> <X>% <framework> <Y>% <N>
<account-2> <X>% <framework> <Y>% <N>
...
WORST ACCOUNT DEEP DIVE — <account>:
Framework Score Gap from Target
──────────────────────────────────────────
<framework> <X>% -<Y>% from 90%
...
Top failures in this account:
<control> — <N> assets
...
───────────────────────────────────────────────────────────────────
───────────────────────────────────────────────────────────────────
COMPLIANCE TRENDS — Last 30 Days
───────────────────────────────────────────────────────────────────
Date Avg Score Direction Notable Changes
──────────────────────────────────────────────────────
Apr 17 <X>% ─ <note>
Apr 10 <X>% ↓ -N% <note>
Apr 03 <X>% → 0% <note>
Mar 27 <X>% ↑ +N% <note>
FRAMEWORKS THAT DROPPED:
<framework>: <from>% → <to>% (<reason if detectable>)
FRAMEWORKS THAT IMPROVED:
<framework>: <from>% → <to>% (<what was fixed>)
───────────────────────────────────────────────────────────────────
───────────────────────────────────────────────────────────────────
REMEDIATION PLAN — Path to <target>% Compliance
───────────────────────────────────────────────────────────────────
PHASE 1: QUICK WINS (this week)
Expected improvement: +<X>%
[ ] <fix 1> — <N> assets, <M> frameworks
[ ] <fix 2> — <N> assets, <M> frameworks
[ ] <fix 3> — ...
PHASE 2: SYSTEMATIC FIXES (this month)
Expected improvement: +<X>%
[ ] <fix pattern> — <N> assets across <M> accounts
[ ] <fix pattern> — ...
PHASE 3: ARCHITECTURAL (this quarter)
Expected improvement: +<X>%
[ ] <change> — requires <team/resource>
[ ] <change> — ...
PROJECTED SCORES AFTER EACH PHASE:
Framework Current Phase 1 Phase 2 Phase 3
─────────────────────────────────────────────────────
<framework> <X>% <Y>% <Z>% <W>%
...
START NOW:
Tell me which phase to start with and your preferred format.
I'll generate implementation code for each fix in that phase.
Format: terraform | cloudformation | ansible | cli |
instructions | pulumi | arm/bicep
───────────────────────────────────────────────────────────────────
Show controls, account breakdown, and remediation plan for just that framework.
Show all sections in order.
Call get_recommended_compliance_frameworks_to_enable (no params) and render the tenant-aware
recommendations from its response: frameworks[].display_name and connected_providers.
⚠ No compliance frameworks enabled in Orca.
To get started, enable frameworks in:
Orca Console → Compliance → Framework Settings
Recommended for your connected providers (<connected_providers>):
• <frameworks[0].display_name>
• <frameworks[1].display_name>
• <frameworks[2].display_name>
...
If the tool returns an empty frameworks list, fall back to one line: "No tenant-specific recommendations available — enable a CIS Benchmark for your cloud provider to start."
⚠ Framework "<input>" not found.
Available frameworks:
<list of enabled frameworks>
Try: /orca-compliance-gap <exact framework name>
✅ <framework> — 100% compliant!
All <N> controls passing across <M> assets.
Last failure resolved: <date>
Recommendation: Set up alerts for score regression.
| Tool | Purpose | Parameter |
|---|---|---|
get_enabled_compliance_frameworks | All framework scores | optional filters |
get_compliance_trend_over_time | Score history | filters.datetime_filter (7/14/30) |
get_compliance_analysis_by_account_or_business_unit | Account/BU breakdown | group_by ("accounts" or "business_units") |
get_compliance_framework_control_tests | Failing controls per framework | framework_id, optional filters |
get_compliance_framework_stats_for_asset | Per-framework detailed stats | framework_id |
get_framework_assets_with_failed_controls_count | Worst assets per framework | framework_id |
get_control_test_assets | Compliant + non-compliant assets for one control test | framework_id, rule_id |
get_related_compliance_frameworks_for_asset | All frameworks an asset participates in (active + inactive) | asset_unique_id (= group_unique_id from get_control_test_assets) |
get_compliance_analysis_by_account_or_business_unit | Per-account score per framework (heatmap replacement) | group_by: "accounts", framework_ids: ["<id>"] |
| Tool | Purpose | When |
|---|---|---|
get_control_test_alerts | Alerts for a specific control | "controls" drill-down |
get_recommended_compliance_frameworks_to_enable | Tenant-aware framework recommendations | empty-state edge case + sparse-coverage dashboard hint |
discovery_search | Find assets related to a control failure | When investigating specific gaps |
framework_id comes from get_enabled_compliance_frameworks responsefilters object can contain: datetime_filter, providers, accounts, framework_ids, business_unitsdatetime_filter values: 7, 14, 30 (days)group_by is an enum: "accounts" or "business_units"framework_ids on get_compliance_analysis_by_account_or_business_unit is top-level, NOT under filters — nesting it under filters is silently ignored or failsrule_id (e.g. rcad0b53623) is the second key needed for get_control_test_assets, sourced from get_compliance_framework_control_tests → tests[].rule_idasset_unique_id (e.g. CodeRepository_<acct>_<resource> or vm_<acct>_<resource>) for get_related_compliance_frameworks_for_asset is sourced from get_control_test_assets → *_assets[].group_unique_idget_related_compliance_frameworks_for_asset returns inactive frameworks too — filter active: true before counting/orca-alert-triage for individual alert deep-dives from failing controls, /orca-impact-analysis for fix impact.get_enabled_compliance_frameworks already returns top_accounts and stats.accounts.data (per-account pass/fail counts across the framework). Only call get_compliance_analysis_by_account_or_business_unit when you need the per-account score per framework (e.g. the heatmap replacement in Query 9); otherwise prefer the inline data.Every compliance tool can return tens to hundreds of KB. Without scoping, the skill will hit context limits before it can rank or render. Default scoping rules:
get_compliance_framework_control_tests: pass filters.providers and/or filters.assets_categories whenever the user query implies a scope (e.g. "PCI on AWS" → providers: ["aws"]).get_control_test_assets: call only on the top-N failing controls (default N=5), never on every failing control by default.get_related_compliance_frameworks_for_asset: call only on the top-N failing assets per control (default N=3), and de-duplicate by group_unique_id across controls.get_enabled_compliance_frameworks: when answering a single-framework question, pass filters.framework_ids: ["<id>"] instead of fetching all.npx claudepluginhub orcasecurity/orca-skills --plugin orca-skillsMakes cloud accounts compliant with security/industry frameworks via iterative Prowler Cloud setup, reporting, and remediation. Handles provider configuration, framework selection, and step-by-step compliance checking.
Provides senior GRC analyst expertise across 15 frameworks including NIST 800-53, FedRAMP, FISMA, CMMC, SOC 2, ISO 27001. Supports control lookups, cross-mapping, document review, audit prep, compliance workflows.
Guides security professionals in implementing defense-in-depth architectures, achieving compliance (SOC2, ISO27001, GDPR, HIPAA), threat modeling, risk assessment, incident response, and embedding security throughout the SDLC.