From afdocs
AI-Friendly Compliance Standard. Use when mapping security controls to compliance frameworks (OWASP, NIS2, ISO 27001, etc.), creating risk assessments, checklists, or compliance scorecards.
How this skill is triggered — by the user, by Claude, or both
Slash command
/afdocs:afcsThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Use this skill to map AFSS security controls to external compliance frameworks, create risk assessments, and generate compliance scorecards.
Use this skill to map AFSS security controls to external compliance frameworks, create risk assessments, and generate compliance scorecards.
docs/
compliance/
frameworks.yaml ← framework registry (required)
mappings/
owasp-web-2021.md ← one mapping per framework
nis2-article-21.md
checklists/
owasp-web-2021-checklist.md ← one checklist per framework
risk-assessments/
system-risk-assessment.md
scorecards/
compliance-scorecard.md
scorecards.yaml ← scorecard registry (optional)
| Type | Description |
|---|---|
compliance-framework | Registers a framework the system tracks |
compliance-mapping | Maps framework requirements → AFSS controls/policies |
compliance-checklist | Actionable verification checklist for a framework |
risk-assessment | Likelihood x impact analysis |
compliance-scorecard | Quantitative coverage and maturity scoring |
frameworks:
- framework_id: owasp-web-2021
name: OWASP Top 10 Web Application Security Risks (2021)
version: "2021"
type: industry-standard # regulation | industry-standard | internal
url: https://owasp.org/Top10/
requirements_count: 10
mapping_path: docs/compliance/mappings/owasp-web-2021.md
checklist_path: docs/compliance/checklists/owasp-web-2021-checklist.md
status: active # active | planned | deprecated
last_reviewed: 2026-02-10
---
mapping_id: owasp-web-2021
name: OWASP Top 10 (2021) Compliance Mapping
type: compliance-mapping
framework_id: owasp-web-2021
scope: system
status: active
owner: security-team
last_reviewed: 2026-02-10
coverage_summary:
total_requirements: 10
fully_covered: 7
partially_covered: 2
not_covered: 1
not_applicable: 0
coverage_percent: 80
---
## Framework Overview
Brief description, official URL, why it applies.
## Requirement Mapping Table
| Req ID | Requirement | AFSS Controls | AFSS Policies | Coverage | Notes |
|--------|-------------|---------------|---------------|----------|-------|
| A01:2021 | Broken Access Control | auth-rls-user-profiles | authorization | full | |
| A08:2021 | Software Integrity | — | — | none | No CI/CD integrity |
Coverage values: `full` | `partial` | `none` | `not-applicable`
## Gap Analysis
For each `partial` or `none` entry:
- What is missing
- Recommended AFSS control to create
- Impact on compliance posture
## Remediation Plan
| Priority | Req ID | Gap | Remediation | Target Date | Owner |
|----------|--------|-----|-------------|-------------|-------|
| 1 | A08 | No integrity checks | Create control | 2026-Q2 | platform |
---
assessment_id: system-risk-2026-q1
name: System Risk Assessment — 2026 Q1
type: risk-assessment
scope: system
methodology: likelihood-impact-5x5
status: current
owner: security-team
assessment_date: 2026-02-10
next_assessment: 2026-05-10
---
Likelihood (1-5) x Impact (1-5) = Score (1-25)
| Score | Category |
|---|---|
| 1-4 | Low |
| 5-9 | Medium |
| 10-16 | High |
| 17-25 | Critical |
| Risk ID | Threat ID | Description | L | I | Score | Treatment | Control IDs | Owner |
|---|---|---|---|---|---|---|---|---|
| RISK-001 | threat-disclosure-data-leak | User data exposure | 2 | 5 | 10 | mitigate | auth-rls-user-profiles | platform |
Treatment: mitigate | accept | transfer | avoid
## Summary
Overall compliance: 80% (8/10 frameworks fully mapped)
## Per-Framework Scores
| Framework | Coverage | Maturity | Trend |
|-----------|----------|----------|-------|
| OWASP Web 2021 | 80% | Managed | ↑ |
| NIS2 Article 21 | 60% | Defined | → |
## Maturity Assessment
Initial → Defined → Managed → Measured → Optimized
## Trend
Quarterly comparison.
## Action Items
Top-priority remediation items.
control_id references MUST match AFSS controls.yamlpolicy_id references MUST match AFSS policies.yamlThreat ID references MUST match AFSS threat modelprocedure_idnpx claudepluginhub securitymonster/afdocs --plugin afdocsMaps controls and provides guidance for aligning development with ISO 27001, SOC 2, NIST CSF 2.0, and CIS Controls. Use for audit prep, SSDLC, and framework comparisons.
Provides senior GRC analyst expertise across 15 frameworks including NIST 800-53, FedRAMP, FISMA, CMMC, SOC 2, ISO 27001. Supports control lookups, cross-mapping, document review, audit prep, compliance workflows.
Map security controls to compliance framework requirements (NIST, CIS, ISO 27001, PCI-DSS, HIPAA, GDPR, SOC 2).