cloud-compliance-specialist

Original：🇺🇸 English

Translated

Guides cloud compliance—mapping SOC 2, ISO 27001, HIPAA, PCI DSS, FedRAMP, and data-residency requirements to cloud controls; collecting audit evidence from AWS, GCP, and Azure APIs; shared-responsibility narratives; CSPM/Config continuous monitoring; customer assurance questionnaires (CAIQ/SIG); and cloud-specific gap remediation before attestations. Use when scoping regulated workloads in cloud, preparing cloud control evidence for auditors, interpreting provider compliance artifacts (BAA, PCI AOC, FedRAMP packages), or proving residency and logging in multi-account estates—not for org-wide GRC programs and audit coordination without cloud evidence (compliance-specialist), non-cloud systems evidence automation (compliance-engineer), implementing security guardrails (cloud-security-engineer), legal DPAs or contract redlines (commercial-counsel), security strategy (cybersecurity), or CI pipeline gates only (devsecops).

2installs

Sourcedaemon-blockint-tech/agentic-enteprises-skill

Added on2026-05-20

NPX Install

npx skill4agent add daemon-blockint-tech/agentic-enteprises-skill cloud-compliance-specialist

SKILL.md Content

View Translation Comparison →

Cloud Compliance Specialist

When to Use

Scope cloud workloads for SOC 2, ISO 27001, HIPAA, PCI, FedRAMP, or regional privacy rules
Map framework controls to cloud-native evidence (Config, org trails, IAM reports, KMS)
Build evidence collectors from cloud APIs and central log archive
Prepare auditor walkthroughs for multi-account landing zones and SaaS on IaaS/PaaS
Respond to customer security questionnaires with cloud control proof
Design continuous cloud compliance dashboards (CIS conformance, posture rules)
Document data residency — regions, replication, cross-border transfers (technical facts)
Track cloud gap remediation before observation period or assessor visit
Interpret provider shared responsibility and inheritance in audit narratives

When NOT to Use

Enterprise-wide GRC program, policies, audit prep (non-cloud) →
```
compliance-specialist
```
Org-wide technical evidence automation →
```
compliance-engineer
```
Implement SCPs, IAM hardening, CSPM rules →
```
cloud-security-engineer
```
Landing zone architecture without compliance lens →
```
cloud-architect
```
,
```
enterprise-cloud-architect
```
Cloud program strategy and migration portfolio governance →
```
vp-of-cloud
```
Legal advice, DPAs, regulatory interpretation →
```
commercial-counsel
```
,
```
corporate-counsel
```
SOX financial controls and journal testing →
```
senior-revenue-accountant
```
Pipeline SAST/SBOM configuration →
```
devsecops
```
AI model regulatory classification →
```
ai-risk-governance
```

Related skills

Need	Skill
VP cloud program and regulated placement themes	`vp-of-cloud`
GRC program, scope, gap plans, audit coordination	`compliance-specialist`
Cross-domain compliance and evidence automation	`compliance-engineer`
Cloud security control implementation	`cloud-security-engineer`
Enterprise cloud governance and CCoE	`enterprise-cloud-architect`
Cloud reference architecture	`cloud-architect`
Security program strategy	`cybersecurity`
Pipeline and SSDF evidence	`devsecops`
Data governance and privacy architecture	`data-architect`
Physical DC compliance evidence	`data-center-design-execution-lead`
FinOps spend analysis	`finops-analyst`
GL mapping and invoice reconciliation	`compute-accounting-manager`
Security risk registers and third-party risk tiers	`security-risk-analyst`

Core Workflows

1. Scope and shared responsibility

Cloud in-scope boundaries and provider vs customer duties for audits.

See
references/cloud_compliance_scope.md
.

2. Framework mapping in cloud

SOC 2, ISO, HIPAA, PCI, FedRAMP control patterns on cloud.

See
references/framework_cloud_mapping.md
.

3. Cloud evidence collection

API sources, samples, retention for assessors.

See
references/cloud_evidence_collection.md
.

4. Residency and sovereignty

Regions, replication, cross-border technical documentation.

See
references/residency_sovereignty.md
.

5. Continuous cloud monitoring

CSPM, Config rules, drift and exceptions.

See
references/continuous_cloud_monitoring.md
.

6. Audit readiness and customer assurance

Walkthroughs, CAIQ/SIG, gap closure.

See
references/audit_readiness_cloud.md
.

Outputs

Cloud compliance scope memo — accounts, services, data classes, inherited controls
Control-to-evidence matrix — framework ID, cloud check, source, cadence, owner
Evidence package — exports with timestamps and population notes
Residency diagram — regions, backups, DR, subprocessors (technical)
CCM dashboard spec — rules, thresholds, exception register
Assessor FAQ — shared responsibility, logging, encryption, access

Principles

Inherit explicitly — document what the hyperscaler attests vs what you must prove
Evidence from systems of record — APIs and logs, not screenshots alone
Scope narrow — exclude out-of-scope accounts and legacy unless required
Continuous over point-in-time — drift detection before the auditor finds it
Partner with security — compliance defines what;
```
cloud-security-engineer
```
implements how