Sushegaad/Claude-Skills-Governance-Risk-and-Compliance v1.5.0

on GitHub

[1.5.0] — 2026-07-03

Accuracy-and-integrity release: four skills corrected against primary regulatory sources, the benchmark re-run with independently authored assertions, and all published statistics reconciled. All 30 plugins, the marketplace catalog, and all per-skill READMEs are now versioned 1.5.0.

Fixed — skill content (verified against primary sources)

FedRAMP

• Corrected the CR26 Certification Class mapping to the official FedRAMP notice NTC-0004: Class A = new pilot/transitional baseline (external-framework entry, e.g. SOC 2 Type II, via Program Certification with a 2-year window to full certification), Class B = LI-SaaS + Low, Class C = Moderate, Class D = High. The previous mapping (A→Low, B→Moderate, C→High, D→"specialized") was off by one tier across the board.
• "CR26" expanded correctly as FedRAMP Consolidated Rules for 2026 (valid through Dec 31, 2028), not "Certification Reform 2026".
• POA&M remediation SLAs corrected to the FedRAMP ConMon Performance Management Guide values: High = 30 days, Moderate = 90 days, Low = 180 days from identification (Critical, where distinguished, ≤ 30 days). SKILL.md previously said Critical=15d/Low=365d and the POA&M reference guide had the entire table shifted one tier (Critical=30/High=90/Moderate=180/Low=365). Surfaced by the eval re-run.

SWIFT CSP

• Framework composition corrected to 32 controls — 25 mandatory + 7 advisory in CSCF v2026 (was stated as 31 / 24+7 in the skill, plugin manifest, marketplace entry, site, and README).
• The control reference file was still titled v2025 and still marked Control 2.4 (Back-Office Data Flow Security) as Advisory, contradicting the skill's own v2026 headline change. Retitled to v2026; 2.4 now marked Mandatory across architecture types, with phased-scope notes (legacy direct connections / bridging-server first hops expected mandatory in v2028).

NIS2

• Coordinated EU-level supply chain risk assessments re-cited to Article 22 (Cooperation Group / Commission / ENISA). The skill, both affected reference files, and the README previously cited Art. 26, which actually governs jurisdiction and territoriality.

LGPD

• GDPR fine comparison corrected: up to €20M or 4% of global turnover, whichever is higher (Art. 83(5) GDPR) — previously stated as "max €20M".
• Children's consent scoped correctly: specific parental/guardian consent applies to crianças (<12) under Art. 14 §1º; adolescents (12–17) are processed under the best-interest standard (Art. 14 caput; ANPD Enunciado 1/2023). Previously stated as "<18 → parental consent".
• DPO guidance now reflects ANPD Resolution CD/ANPD 2/2022: small-scale processing agents are exempt from formal Encarregado appointment (a contact channel is still required). Previously "always required, no SME exemption".
• Removed the outdated claim that ANPD had "not yet" published standard contractual clauses: Resolution CD/ANPD 19/2024 (International Data Transfer Regulation) established the ANPD SCCs, which must be adopted without modification. Surfaced by the eval re-run.

Changed — benchmark re-run with primary-source assertions

FedRAMP, SWIFT CSP, NIS2, and LGPD were re-evaluated (5 test cases each, with-skill vs baseline, same model both configs, independent grader agents). Assertions were authored from primary sources — FedRAMP NTC-0004/M-24-15/ConMon guides, SWIFT CSCF v2026, Directive (EU) 2022/2555 text, LGPD statute + ANPD Resolutions 2/2022, 15/2024, 19/2024, 32/2026 — not from skill content, closing the circularity that previously let FedRAMP score 100% on an incorrect class mapping.

• Suite headline updated in all three stat locations: 95% with skills vs 83% baseline (718 vs 626 of 752 assertions; +12 points / +92 assertions), previously 97% / 83% / +14 / +105.
• Raw grading artifacts (prompts, assertions, responses, per-assertion grades with evidence) committed under grc-workspace/rerun-2026-07/, plus benchmark.json and a standalone eval viewer (eval-review.html).
• Note: the re-run graded the skills before the two re-run-surfaced fixes above landed, so the published numbers are conservative for FedRAMP and LGPD.

Fixed — published statistics

• README summary delta corrected to +14 points / +105 assertions (was +16/+107) — subsequently recomputed to +12 / +92 after the re-run.
• Methodology text now states "at least 5 assertions per test case" (752 total; WCAG carried 27), resolving the 150×5=750 vs 752 discrepancy.
• Canonical baseline is 83% (626/752). The GitHub "About" description previously said 84% — update it in repo Settings (manual step).

Infrastructure

• All 30 plugin.json manifests, all marketplace.json entries, CANONICAL_VERSION, both release badges, and all per-skill README version footers unified at 1.5.0.
• tests/test_eval_consistency.py grading-file validation repointed to grc-workspace/rerun-2026-07/ for the four re-run skills — published percentages are now machine-checked against the committed grading artifacts.
• Rebuilt .skill ZIPs (plugin + standalone copies) for the four corrected skills; content diff-verified against source.
• Full test suite: 1108 passed.

Known items for the next release

• NIS2 skill (82 lines) is the thinnest in the collection and lacks the essential-vs-important size-cap reasoning the re-run exposed — expansion planned (see IMPLEMENTATION-PLAN.md Phase 3.4).
• One re-run assertion (NIS2 eval-82: B2B SaaS as "cloud computing service") tests a genuinely contestable legal conclusion; consider rewarding the analysis rather than the conclusion in the next iteration.
• Manual steps: push, create GitHub release/tag v1.5.0, update the repo About description to "95% vs a baseline of 83%".