# 🛡️ Pack Shield — GRC Compliance Agents

> **27 compliance agents across 6 categories, plus 11 GDPR & AI Act workflows** + 1 orchestrator covering Data Privacy, Cybersecurity, Industry Compliance, Defense & Export, AI Governance, and Accessibility & ESG.

> ⚠️ **Not legal advice.** Shield output is AI-generated, may be incomplete or out of date, and does not replace a lawyer, DPO or certified auditor. Human review by a qualified person is required before any compliance decision, filing or attestation.

## Overview

Pack Shield transforms BMAD+ into a comprehensive GRC (Governance, Risk & Compliance) assistant. Each agent is an expert system prompt for a specific regulatory framework, providing structured compliance guidance including gap analysis, policy drafting, control mapping, and audit support.

**Key Features:**
- 🧠 **Shield Orchestrator** — Intelligent routing to the right compliance agent
- 🔄 **Cross-Framework Mapping** — Identify control overlaps between frameworks
- 📊 **Standardized Templates** — Gap analysis and audit reports
- 🌍 **Multi-LLM Compatible** — Standard `.md` format works with any LLM
- 📦 **Modular Installation** — Install by category or individual agent
- 📁 **79 Reference Files** — Deep regulatory knowledge from upstream sources

## Categories

### 🔐 Data Privacy (5 agents)
| Agent | Framework | Jurisdiction |
|-------|-----------|-------------|
| `gdpr-agent` | GDPR (EU) 2016/679 | EU/EEA/UK |
| `ccpa-agent` | CCPA / CPRA | California |
| `lgpd-agent` | LGPD | Brazil |
| `dpdpa-agent` | DPDPA 2023 | India |
| `iso27701-agent` | ISO 27701 PIMS | International |

### 🛡️ Cybersecurity (6 agents)
| Agent | Framework | Jurisdiction |
|-------|-----------|-------------|
| `iso27001-agent` | ISO 27001:2022 | International |
| `nist-csf-agent` | NIST CSF 2.0 | US/Global |
| `nist-800-53-agent` | NIST 800-53 Rev. 5 | US Federal |
| `cis-controls-agent` | CIS Controls v8 | International |
| `nis2-agent` | NIS2 Directive | EU |
| `ism-agent` | ISM | Australia |

### 🏢 Industry Compliance (6 agents)
| Agent | Framework | Jurisdiction |
|-------|-----------|-------------|
| `soc2-agent` | SOC 2 Type I/II | US/Global |
| `pci-dss-agent` | PCI DSS v4.0 | International |
| `hipaa-agent` | HIPAA | US Healthcare |
| `swift-csp-agent` | SWIFT CSP | Intl. Banking |
| `dora-agent` | DORA | EU Financial |
| `fedramp-agent` | FedRAMP | US Federal |

### 🔒 Defense & Export (4 agents)
| Agent | Framework | Jurisdiction |
|-------|-----------|-------------|
| `cmmc-agent` | CMMC 2.0 | US Defense |
| `itar-agent` | ITAR | US Arms Export |
| `ear-agent` | EAR | US Commerce |
| `tsa-agent` | TSA Directives | US Transport |

### 🤖 AI Governance (3 agents)
| Agent | Framework | Jurisdiction |
|-------|-----------|-------------|
| `eu-ai-act-agent` | EU AI Act 2024/1689 | EU |
| `iso42001-agent` | ISO 42001:2023 | International |
| `nist-ai-rmf-agent` | NIST AI RMF 1.0 | US/Global |

### ♿ Accessibility & ESG (3 agents)
| Agent | Framework | Jurisdiction |
|-------|-----------|-------------|
| `wcag-agent` | WCAG 2.2 | International |
| `section508-agent` | Section 508 | US Federal |
| `csrd-agent` | CSRD | EU |

### 📋 GDPR & AI Act Workflows (11 workflows)
| Workflow | Purpose | Focus |
|----------|---------|-------|
| `dpia-sentinel` | DPIA Impact Assessment | Art. 35 GDPR — AI-specific considerations |
| `breach-sentinel` | Breach 72h Response | Art. 33/34 — Severity classification, notifications |
| `legitimate-interest` | LIA Three-Part Test | Art. 6(1)(f) — Purpose, necessity, balancing |
| `privacy-advisor` | Program Assessment | Overall GDPR posture evaluation |
| `privacy-notice-gen` | Privacy Notice Generator | Art. 13/14 mandatory elements |
| `privacy-policy-gen` | Privacy Policy Generator | Full site/app policies |
| `cookie-policy-gen` | Cookie Policy Generator | ePrivacy + GDPR, CNIL guidance |
| `ai-act-classifier` | AI System Classifier | Risk classification (forbidden/high/limited/minimal) |
| `ai-act-roles` | Role Determination | Provider/deployer/importer obligations mapping |
| `ai-act-fria` | FRIA Assessment | Art. 27 — Fundamental Rights Impact |
| `ai-act-incidents` | Incident Reporting | Art. 73 — Serious incident workflow |

## Shared Resources
- `shared/cross-framework-mapper.md` — Control mapping between frameworks
- `shared/gap-analysis-template.md` — Standardized gap analysis format
- `shared/audit-report-template.md` — Compliance audit report format
- `shared/assurance-case.md` + `shared/assurance-case-template.yaml` — Security assurance case bound to executed checks
- `shared/ai-processing-register.md` + `shared/ai-processing-register-template.yaml` — Register of the AI tools a project uses

## Evidence & AI Tooling

These capabilities are backed by BMAD+ CLI commands, so their results are verified by code:

| Capability | Command | Behaviour |
|------------|---------|-----------|
| Security assurance case | `bmad-plus assurance init <case>`, `run <case>`, then `verify <case> --ledger-head <head>` | Claims → arguments → evidence; evidence is only a check that ran, recorded in a hash-chained ledger with its exit code, output digest and the digests of the artifacts it wrote. Missing, failed or stale evidence (other commit, uncommitted changes or untracked files, changed command or artifact, too old) leaves the claim unsupported. `BMAD_PLUS_ASSURANCE_KEY` authenticates every record and `--ledger-head` catches removed runs; without them the ledger shows accidental edits only. `--emit-check` writes a CI check result. |
| AI processing register | `bmad-plus ai-register init`, `bmad-plus ai-register check` | Compares `_bmad/ai-processing-register.yaml` with the AI integrations found in the project (BMAD+ adapters, tool folders, MCP servers) and warns about any not registered. Soft gate: warnings never fail; `bmad-plus doctor` reports the same. |
| Compliance review rules | `bmad-plus review scope`, `bmad-plus review rules <path>` | `review-rules/` adds path-scoped checklists (access control, personal data, cryptography, logging, AI integrations, change and supply chain) in the `compliance` group, each tagged with the controls it examines, e.g. `ISO27001:A.8.5`, `SOC2:CC8.1`, `GDPR:Art.32`. The review checklist opens with the controls the change touches, `scope.json` records them per file, and a finding may name the ones it breaks in `controls`. A project replaces or disables them in `_bmad/review-rules.yaml`. |

## Reference Files
- `references/` — 79 regulatory reference files extracted from upstream skills
- Organized by framework (gdpr-compliance, iso27001, soc2, etc.)
- Contains templates, control mappings, article references, and compliance programs

## Attribution

Based on [Claude Skills for GRC](https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance) by Hemant Naik — MIT License.

GDPR and EU AI Act workflow agents enriched with architectural insights from [Lawve.ai](https://lawve.ai) professional skills catalog.

Adapted for BMAD+ by [Laurent Rochetta](https://github.com/lrochetta/BMAD-PLUS).

## Upstream Sync

See `upstream-sync.yaml` for the complete skill-to-agent mapping and sync configuration.

```bash
# Future: check for upstream updates
npx bmad-plus shield:sync
```