compliance-tracking

Anthropic ｜ 商業與營運 ｜ 原文 ｜ Apache-2.0

追蹤合規要求與稽核準備度，產出差距分析與稽核檢查清單

---
name: compliance-tracking
description: 追蹤合規要求與稽核準備度。當使用者提到「compliance」「audit prep」「SOC 2」「ISO 27001」「GDPR」「regulatory requirement」，或需要協助追蹤、準備、記錄合規活動時觸發。
---

# 合規追蹤（Compliance Tracking）

協助追蹤合規要求、準備稽核，並維持法規準備度。

## 常見框架

| 框架 | 重點 | 主要要求 |
|-----------|-------|-----------------|
| SOC 2 | 服務型組織 | 安全性、可用性、處理完整性、機密性、隱私 |
| ISO 27001 | 資訊安全 | 風險評估、安全控制措施、持續改善 |
| GDPR | 資料隱私（歐盟） | 同意、資料權利、外洩通報、DPO |
| HIPAA | 醫療資料（美國） | PHI 保護、存取控制、稽核軌跡 |
| PCI DSS | 支付卡資料 | 加密、存取控制、弱點管理 |

## 合規追蹤的組成

### 控制措施清單
- 把控制措施對應到框架的要求
- 記錄控制措施的負責人和證據
- 追蹤控制措施的有效性

### 稽核行事曆
- 即將到來的稽核日期和期限
- 證據蒐集的時程
- 補救期限

### 證據管理
- 每項控制措施需要什麼證據
- 證據存放在哪裡
- 證據上次蒐集的時間

### 差距分析
- 要求 vs. 目前狀態
- 排好優先順序的補救計畫
- 達成合規的時程

## 輸出

產出合規狀態儀表板、差距分析、稽核準備檢查清單，以及證據蒐集計畫。

---
name: compliance-tracking
description: Track compliance requirements and audit readiness. Trigger with "compliance", "audit prep", "SOC 2", "ISO 27001", "GDPR", "regulatory requirement", or when the user needs help tracking, preparing for, or documenting compliance activities.
---

# Compliance Tracking

Help track compliance requirements, prepare for audits, and maintain regulatory readiness.

## Common Frameworks

| Framework | Focus | Key Requirements |
|-----------|-------|-----------------|
| SOC 2 | Service organizations | Security, availability, processing integrity, confidentiality, privacy |
| ISO 27001 | Information security | Risk assessment, security controls, continuous improvement |
| GDPR | Data privacy (EU) | Consent, data rights, breach notification, DPO |
| HIPAA | Healthcare data (US) | PHI protection, access controls, audit trails |
| PCI DSS | Payment card data | Encryption, access control, vulnerability management |

## Compliance Tracking Components

### Control Inventory
- Map controls to framework requirements
- Document control owners and evidence
- Track control effectiveness

### Audit Calendar
- Upcoming audit dates and deadlines
- Evidence collection timelines
- Remediation deadlines

### Evidence Management
- What evidence is needed for each control
- Where evidence is stored
- When evidence was last collected

### Gap Analysis
- Requirements vs. current state
- Prioritized remediation plan
- Timeline to compliance

## Output

Produce compliance status dashboards, gap analyses, audit prep checklists, and evidence collection plans.