orca-compliance-gap

Orca Compliance Gap Skill

Answers the question: "Where are we failing, what's the fastest path to improve, and who owns the worst gaps?"

Given a compliance framework (or all frameworks), analyzes failing controls ranked by blast radius, identifies quick wins (single-fix controls), breaks down gaps by account/business unit, and generates a prioritized remediation plan.

Usage

/orca-compliance-gap
/orca-compliance-gap PCI DSS
/orca-compliance-gap CIS AWS
/orca-compliance-gap SOC 2

Or natural language:

• "how's our PCI compliance?"
• "what's failing in CIS AWS?"
• "compliance gap analysis"
• "show me our worst compliance gaps"
• "which framework needs the most work?"
• "quick wins for SOC 2"

Processing Logic

Step 1: Determine Scope

Parse user input to determine:

• Specific framework: "PCI DSS" → filter to that framework
• All frameworks: no argument → show overview of all, then drill into worst
• Account-specific: "compliance in account 123456789012" → filter by account

Step 2: Gather Data (run ALL in parallel)

Query 1: All enabled frameworks with current scores

get_enabled_compliance_frameworks:
  (no filters)

Query 2: Compliance trend over time

get_compliance_trend_over_time:
  filters:
    datetime_filter: 30

Query 3: Compliance by account

get_compliance_analysis_by_account_or_business_unit:
  group_by: "accounts"

Query 4: Compliance by business unit

get_compliance_analysis_by_account_or_business_unit:
  group_by: "business_units"

Step 3: Deep-Dive into Target Framework(s)

For the target framework (or the worst-scoring one if user said "all"), run Queries 5-8 in parallel. Query 6 depends on Query 5 (it needs the rule_ids), so run it after Query 5 returns.

Query 5: Failing control tests

get_compliance_framework_control_tests:
  framework_id: <id>
  filters:
    status: "fail"

Query 6: Compliant + non-compliant assets per failing control (runs after Query 5) Scope to the top N failing controls (default N=5) to keep response sizes manageable. The rule_id comes from Query 5's tests[].rule_id.

get_control_test_assets:
  framework_id: <id>
  rule_id: <tests[].rule_id from Query 5>   # one call per top-N failing control

Returns { non_compliant_assets: [...], compliant_assets: [...] } — both arrays, so true pass/fail ratios are computable per control, not just a failure count.