compliance-cross-regulation-map git:20261029.7f379eeA

Immutable. This exact content never changes and is served at /api/v1/blob/dba55ff339ab12cc.

---
name: compliance-cross-regulation-map
description: Show clause by clause how controls satisfy several regulations at once, such as SOC 2, ISO 27001 and GDPR, highlighting high-coverage controls and the minimum control set. Use when the user asks how two or more frameworks overlap or wants a standalone crosswalk without running the full compliance program.
metadata:
  argument-hint: "[project] [--skip-checks]"
---

# Cross-Regulation Map

Show how controls map across multiple regulations for "$ARGUMENTS" to identify high-coverage controls, regulation-unique requirements, and implementation priority based on coverage efficiency.

**Arguments.** `$ARGUMENTS` may contain the project name and optional flags. Take the first token as `<project>` and treat `--skip-checks` as a flag; never include flags in file paths. All paths below use `<project>`. If `--skip-checks` is present, skip the prerequisite check and, **before writing any artifact**, append one line to `.singularskills/log.jsonl`: `{"ts":"<ISO timestamp>","skill":"compliance-cross-regulation-map","workflow":"compliance","phase":null,"project":"<project>","event":"skipped","artifact":"<artifact file>","note":"<reason or \"none given\">"}`.

## Prerequisites

None — this is a utility skill.

## Process

1. **Read context files:**
   - Read `references/grc-lifecycle-guide.md` for GRC methodology reference
   - Read `references/control-mapping-template.md` for mapping structure
   - Read any existing compliance artifacts in `.singularskills/compliance/<project>/` for context (if they exist)

2. **Select regulations to map:**
   - Identify the regulations to include in the cross-regulation map
   - If scope file exists, use the applicable regulations from Phase 0
   - If no scope file, ask user which regulations to include or use common combinations (SOC 2 + ISO 27001 + GDPR)

3. **Create cross-regulation matrix:**
   - For each control in the unified framework: list which regulation requirements it satisfies
   - Map control to specific clause/criterion per regulation (e.g., SOC 2 CC6.1, ISO 27001 A.9.1.1, GDPR Art. 32)
   - Show coverage visually — which controls satisfy the most regulations

4. **Coverage analysis:**
   - Identify controls with highest cross-regulation coverage (implement once, satisfy many)
   - Identify regulation-unique requirements — controls only required by one regulation
   - Calculate coverage percentage — what percentage of each regulation's requirements are met by shared controls
   - Identify the minimum set of controls needed to achieve baseline compliance across all regulations

5. **Implementation priority:**
   - Rank controls by coverage efficiency — regulations satisfied per implementation effort
   - Recommend implementation sequence starting with highest-coverage controls
   - Identify foundation controls that enable compliance across all regulations
   - Flag regulation-unique controls that must still be implemented for specific certifications

6. **Write the artifact** to `.singularskills/compliance/<project>/cross-regulation-map.md` with sections:
   - **Cross-Regulation Matrix** — controls vs. regulations mapping
   - **High-Coverage Controls** — controls satisfying the most regulations
   - **Regulation-Unique Requirements** — requirements specific to individual regulations
   - **Coverage Analysis** — percentage of shared vs. unique requirements per regulation
   - **Implementation Priority** — recommended sequence by coverage efficiency
   - **Minimum Viable Compliance** — smallest control set for baseline compliance across all regulations

## Output

The cross-regulation map written to `.singularskills/compliance/<project>/cross-regulation-map.md`. Present a summary to the user highlighting:
- Number of controls mapped across regulations
- Top 5 highest-coverage controls
- Percentage of requirements shared vs. unique per regulation
- Recommended implementation starting point

End the artifact with this paragraph, verbatim:

> **Not legal or audit advice.** This artifact supports preparation for compliance work; certification, attestation and regulatory conclusions require a qualified auditor or counsel.