compliance-readiness

原文涵盖的主题

• /compliance-os:compliance-readiness — Compliance Officer Forcing Questions
• When to Run
• The Six Compliance Officer Questions
• 1. Have you named every applicable framework?
• 2. Where do the frameworks overlap, and what's the reuse leverage?
• 3. Who owns each artefact, and what's the reuse-leverage score?
• 4. What's the audit calendar, and is auditor independence respected?
• 5. What does a mock audit produce, and is the severity distribution healthy?

Command: /compliance-os:compliance-readiness The multi-framework compliance officer pressure-tests any compliance program. Six questions before any new-framework commitment, audit cycle planning, or certification readiness sign-off. Before adopting a new compliance framework Before annual audit calendar finalization Before certification stage 1 readiness sign-off Before management review (Clause 9.3 across frameworks) When evidence-collection effort has grown 50%+ year-over-year (a smell) When an audit produced > 15% critical findings No framework selector run, no defensible scope. Run frameworkselector.py with company profile Forgetting a framework means rebuilding the audit program later Pay attention to industry-specific overlays (financial: NYDFS, FINMA; healthcare: HIPAA, ISO 13485; AI: ISO 42001 + EU AI Act) Single evidence -> N controls = the cornerstone of multi-framework efficiency. Run crossframeworkmapper.py with enabled frameworks HIGH-confidence mappings: same evidence; MEDIUM: existing + overlay; LOW: new artefact Without overlap analysis, you'll collect the same access-review records 3 times Joint ownership without accountability is the most common cause of stale evi

这里只展示节选，请以完整原文和当前要求为准。