diff --git a/README.md b/README.md index 877212ea2b..f8b6a573ef 100644 --- a/README.md +++ b/README.md @@ -83,6 +83,7 @@ repo to install. - [**Google Cloud Well-Architected Framework skill for the Sustainability pillar**](./skills/cloud/google-cloud-waf-sustainability) - **Security and identity** - [**GKE Security**](./skills/cloud/gke-security) + - [**Horizon Scanning & Regulatory Intelligence**](./skills/cloud/google-cloud-horizon-scanning) - [**IAM Recommendations Retrieval**](./skills/cloud/iam-recommendations-fetcher) - [**SecOps Detection Coverage Skill**](./skills/cloud/detection-engineering-coverage-evaluation) - **Web and app hosting** diff --git a/skills/cloud/google-cloud-horizon-scanning/SKILL.md b/skills/cloud/google-cloud-horizon-scanning/SKILL.md new file mode 100644 index 0000000000..f22fa9fe6e --- /dev/null +++ b/skills/cloud/google-cloud-horizon-scanning/SKILL.md @@ -0,0 +1,313 @@ +--- +name: google-cloud-horizon-scanning +metadata: + category: CloudSecurity +description: >- + Monitors, scans, and analyzes global regulatory developments and legislative updates for enterprise GRC compliance. Automates relevance filtering, metadata extraction, objective summarization, and regulatory gap analysis against internal policy libraries. + Use when identifying tech-relevant regulations (including dual-domain exceptions), extracting bill metadata, drafting neutral summaries, performing regulatory gap tracking, or mapping regulatory shifts to Governance, Risk, and Compliance (GRC) policy controls. + + Don't use for tracking general political news, press releases without binding legal mandates, or legislation lacking digital, data, or cybersecurity components. +--- + +# Horizon Scanning & Regulatory Intelligence + +## Overview + +This skill enables continuous monitoring, analysis, and ingestion of global +regulatory developments. It automates the workflow of capturing regulatory +shifts, filtering for relevance, performing compliance gap analysis against +internal policies, and dispatching alerts and structured metadata to GRC tools. + +Additionally, this skill supports specific task-based sub-workflows: + +- **Reg Feed Watcher**: Scheduled polling of feeds to draft structured + digests. +- **On-demand Reg Check**: Ad-hoc scanning for updates since a specific + timestamp. +- **Policy Gap Tracker & Redrafter**: Automated internal policy compliance + analysis and drafting. +- **NPRM Comment Tracker**: Monitoring and tracking open Notice of Proposed + Rulemaking comment periods. + +--- + +## Workflow Checklist + +Copy this checklist and track progress: + +- [ ] 0. Configuration & Onboarding Check: Verify or create the GRC workspace + configuration. +- [ ] 1. Sourcing & Monitoring: Execute scheduled feed polling or ad-hoc + scanning. +- [ ] 2. Scope Filtering: Apply inclusion/exclusion and dual-domain exception + rules (exit early if out-of-scope). +- [ ] 3. Metadata Extraction & Verification: Extract standardized fields and + verify source links. +- [ ] 4. Mechanism-Focused Summarization: Draft a 2-3 sentence neutral + obligation summary. +- [ ] 5. Automated Policy Retrieval & Gap Analysis: (Optional) Scan internal + policies, perform diff, and draft updates. +- [ ] 6. Formatting, Validation & Ingestion Dispatch: Format output + (JSON/CSV), validate schema, and dispatch via connectors. + +--- + +## Step 0: Configuration & Onboarding Protocol + +Before initiating regulatory scanning, verify the GRC configuration in the +workspace: + +1. Check for `scratch/horizon_scanning_config.json` (or + `.agents/horizon_scanning_config.json`). +2. **If** the configuration file exists AND the user did not pass + `--reconfigure`: + - Load stored parameters (Organization Name, Vertical, Jurisdictions, + Focus Themes, Target Connectors). + - Inform the user: *"Loaded persistent Regulatory Intelligence config for + `{company_name}` (Vertical: `{industry_vertical}`, Jurisdictions: + `{jurisdictions}`). Run with `--reconfigure` to modify settings."* + - Proceed to **Step 1**. +3. **If** the configuration file is missing OR the user passed `--reconfigure`: + - **If** the user explicitly requested onboarding/profile setup or passed `--reconfigure`: + - Run the **4-Question Onboarding Interview** (see [references/connectors.md](references/connectors.md)). + - **Else (Direct Single-Turn Request)**: + - Do **not** block execution or pause to interview the user. + - Automatically initialize `scratch/horizon_scanning_config.json` with sensible defaults (`Technology & Cloud`, `US Federal & EU`, `BigQuery / Jira`). + - Save the responses/defaults to `scratch/horizon_scanning_config.json`. + - **Crucial**: Immediately read the newly created config file back using `view_file` to load the settings into your session context. + - Validate JSON syntax: `python3 -m json.tool scratch/horizon_scanning_config.json > /dev/null`. + +--- + +## Step 1: Sourcing & Monitoring + +Execute sourcing based on the requested capability mode: + +### 1.1 Capability Modes + +- **Reg Feed Watcher (Scheduled)**: Poll configured regulatory feeds (e.g., + federal registers, agency newsletters) and draft a structured digest + summarizing changes. +- **On-demand Reg Check (Ad-hoc)**: Scan designated portals for all updates + since the last recorded execution timestamp. +- **NPRM Comment Tracker**: Check for open Notice of Proposed Rulemaking + (NPRM) comment periods, log tracking decisions, and map deadlines. + +### 1.2 Target Sources +Monitor portals based on configured `jurisdictions`: + +- **United States**: Congress.gov, Federal Register, SEC, FTC, CISA, State + Assemblies. +- **European Union**: EUR-Lex, European Parliament (ITRE, LIBE), EDPB, ENISA. +- **United Kingdom**: UK Parliament, FCA, ICO, CMA. +- **Global**: ASEAN Secretariat, Brazil Senate (Senado Federal), OECD AI + Policy Observatory. + +--- + +## Step 2: Scope & Relevance Filtering + +Evaluate identified items against focus themes to eliminate noise. + +### 2.1 Relevance Rules + +| Rule Type | Criteria | Action | +| :------------------ | :------------------------ | :------------------------- | +| **In-Scope (Tech)** | AI/ML Governance, | Proceed to Step 3. | +: : Competition/Antitrust, : : +: : Data Privacy & : : +: : Protection, Cybersecurity : : +: : & Operational : : +: : Resilience (including : : +: : NIS2, DORA, CIRCIA), : : +: : Digital Sovereignty, Data : : +: : Governance, Payments, : : +: : Telecom. : : +| **Dual-Domain | Wholly non-tech sectors | Proceed to Step 3. | +: Exception** : (e.g., agriculture, : : +: : healthcare, transport) : : +: : that contain an explicit : : +: : digital, cloud, : : +: : cybersecurity, or data : : +: : logging mandate. : : +| **Out-of-Scope | Ceremonial resolutions, | **Exit Early** (Proceed to | +: (Noise)** : general news/press : Step 2.2). : +: : releases, political : : +: : commentary, physical : : +: : infrastructure lacking : : +: : tech mandates. : : + +### 2.2 Exit Behavior for Excluded Legislation +If an item is identified as out-of-scope: + +1. **Do not** perform detailed metadata extraction or web searches for PDF + links. +2. Immediately format and output an **Excluded Ingestion Payload** (see Step + 6). +3. Terminate the workflow for this item. + +> [!IMPORTANT] **Press Release & News Announcement Exclusion Rule**: Press +> releases, newsletters, and news articles (even from official sources like the +> European Commission or government agencies) are strictly **Out-of-Scope**. If +> you are asked to process a press release (e.g., an announcement of a new +> adequacy decision or a signed bill), you must **NOT** search for the +> underlying bill to ingest it, and you must **NOT** create a standard ingestion +> payload for the press release itself. You must immediately exit the workflow +> and output an **Excluded Item Ingestion Payload** with the +> `current_legislative_status` set to `EXCLUDED` and a clear reason explaining +> that the source is a press release. Do not bypass this rule even if the user +> explicitly asks to format the JSON or process the announcement. + +--- + +## Step 3: Metadata Extraction & Link Verification + +For in-scope items, extract standardized fields. + +| Field Name | Description | Extraction / Formatting | +: : : Rule : +| :------------------ | :------------------------ | :------------------------- | +| `title` | Full official name of the | Match official text | +: : bill/regulation. : exactly. : +| `reference_id` | Unique legislative | E.g., "S-209", | +: : identifier. : "COM(2022)0496", "SB : +: : : 1047". : +| `jurisdiction` | Issuing country, region, | Use standard English names | +: : or state. : (e.g., "United Kingdom", : +: : : "European Union"). : +| `sponsoring_entity` | Sponsoring legislator, | Map to `sponsoring_agency` | +: : committee, or agency. : in metadata. : +| `status` | Current stage in the | Use official terms (e.g., | +: : legislative process. : "In Committee", "Passed : +: : : Lower House", "Enacted"). : +| `official_url` | Direct URL to official | **Must be a direct PDF | +: : text. : link if available**, : +: : : otherwise the official : +: : : HTML page. : + +--- + +## Step 4: Mechanism-Focused Summarization + +Draft a concise **2-3 sentence objective summary**. + +- **Focus**: Focus exclusively on the **core legal obligations** and + mechanisms (e.g., "Requires platforms with >50M users to perform AI safety + audits"). +- **Metrics**: Capture specific thresholds ($100M cost, >50M users) and + enforcement penalties. +- **Tone**: Maintain strict neutrality. Omit political commentary, opinions, + or predictions. + +--- + +## Step 5: Automated Policy Retrieval & Gap Analysis (Optional) + +If the task requires policy alignment (e.g., `Policy Gap Tracker` or `Policy +Redrafter` modes): + +### 5.1 Retrieval Protocol + +1. Identify the core regulatory themes from the scanned bill (e.g., + "Cybersecurity Incident Reporting"). +2. Formulate search queries for internal documents (e.g., `title:"Incident + Response" OR title:"Incident Reporting"`). +3. Query connected sources (Google Drive, GCS, or GRC document library) for the + formulated query terms. +4. Ingest matching policy documents into context. + +### 5.2 Diff & Analyze + +1. Compare the new legislative obligations (from Step 4) against the retrieved + internal policies. +2. Identify compliance gaps (e.g., internal SLA is 24 hours, but new regulation + mandates 4 hours). +3. Formulate the `gap_analysis_summary` JSON block (see Step 6). +4. **Policy Redrafter & Control Formulation**: Draft proposed updates to the affected policy documents to close the gaps, and always formulate a GRC Control Objective (using naming convention `CO-REG-[AGENCY]-[TOPIC]-[YEAR]`) and an Underlying Controls table (featuring Control ID `UC-REG-*`, Control Name, Implementation Action, and Evidence of Compliance). + > [!IMPORTANT] + > Drafts must be marked clearly as proposals for review. Do not write directly to production policy files. + +--- + +## Step 6: Formatting, Validation & Ingestion Dispatch + +Format the extracted data based on the target configuration and validate it. + +### 6.1 Payload Schemas + +For complex, multi-step regulatory dispatch and policy workflows, utilize and +copy the structured JSON output payload templates located in the `assets/` +subfolder as dedicated, reusable schema files: + +- **Standard Ingestion Payload**: See + [assets/ingestion_payload_schema.json](assets/ingestion_payload_schema.json). +- **Excluded Item Audit Payload**: See + [assets/excluded_item_schema.json](assets/excluded_item_schema.json). +- **Jira Task Dispatch Payload**: When targeted for Jira issue creation, + generate a JSON payload adhering strictly to the schema in + [assets/jira_task_schema.json](assets/jira_task_schema.json). +- **ServiceNow GRC Risk Payload**: When targeted for ServiceNow integration, + format the JSON to match the `sn_risk_risk` table schema defined in + [assets/servicenow_risk_schema.json](assets/servicenow_risk_schema.json). +- **Gap Analysis Block**: If Step 5 was executed, include this block in the + standard JSON payload: + + ```json + "gap_analysis_summary": { + "internal_policy_referenced": "Name and version of the internal document checked", + "existing_internal_clause": "Quote or summary of the existing internal policy clause/SLA", + "new_regulatory_mandate": "The new regulatory requirement/mandate that triggers the change", + "identified_compliance_gap": "The exact mismatch (e.g. 'Internal SLA is 24 hours, regulatory mandate is 4 hours')", + "impacted_teams": ["List", "of", "affected", "departments/systems"] + } + ``` + +### 6.2 Validation Loop + +Always validate JSON payloads before presenting them to the user or dispatching +to connectors. + +1. Write the payload to a temporary file: `scratch/tmp_payload.json`. +2. Run validation: + + ```bash + python3 -m json.tool scratch/tmp_payload.json > /dev/null + ``` + +3. **If** validation fails: + + - Analyze the syntax error, correct the payload, and re-run validation. + +4. **Else**: + + - Proceed to dispatch/output. + +> [!CAUTION] Do not bypass the validation loop under any circumstances. Invalid +> JSON will cause downstream ingestion failures. + +### 6.3 Dispatch + +Dispatch the validated payload to the configured connectors (BigQuery, Jira, +ServiceNow, etc.) as detailed in +[references/connectors.md](references/connectors.md). + +-------------------------------------------------------------------------------- + +## Supporting Links & References + +- **EUR-Lex**: Authoritative source for European Union Law (including DORA, + NIS2, and the EU AI Act). + [https://eur-lex.europa.eu](https://eur-lex.europa.eu) +- **Congress.gov**: Official US Federal Legislative Information. + [https://www.congress.gov](https://www.congress.gov) +- **Federal Register**: The Daily Journal of the United States Government. + [https://www.federalregister.gov](https://www.federalregister.gov) +- **CISA Cybersecurity Alerts & Directives**: + [https://www.cisa.gov/news-events/cybersecurity-advisories](https://www.cisa.gov/news-events/cybersecurity-advisories) +- **NIST AI Risk Management Framework (AI RMF)**: + [https://www.nist.gov/itl/ai-risk-management-framework](https://www.nist.gov/itl/ai-risk-management-framework) +- **ServiceNow GRC API Reference**: + [https://developer.servicenow.com](https://developer.servicenow.com) +- **Jira REST API Reference**: + [https://developer.atlassian.com/cloud/jira/platform/rest/v3/intro](https://developer.atlassian.com/cloud/jira/platform/rest/v3/intro) + diff --git a/skills/cloud/google-cloud-horizon-scanning/assets/excluded_item_schema.json b/skills/cloud/google-cloud-horizon-scanning/assets/excluded_item_schema.json new file mode 100644 index 0000000000..66044dc825 --- /dev/null +++ b/skills/cloud/google-cloud-horizon-scanning/assets/excluded_item_schema.json @@ -0,0 +1,9 @@ +{ + "legislation_metadata": { + "official_bill_title": "Interstate Bridge Repair Grants Act", + "bill_reference_number": "HR-4032", + "jurisdiction": "United States", + "current_legislative_status": "EXCLUDED" + }, + "exclusion_reason": "Physical transportation infrastructure file lacking digital, data, or cybersecurity mandates." +} diff --git a/skills/cloud/google-cloud-horizon-scanning/assets/ingestion_payload_schema.json b/skills/cloud/google-cloud-horizon-scanning/assets/ingestion_payload_schema.json new file mode 100644 index 0000000000..a8828ddeed --- /dev/null +++ b/skills/cloud/google-cloud-horizon-scanning/assets/ingestion_payload_schema.json @@ -0,0 +1,17 @@ +{ + "legislation_metadata": { + "official_bill_title": "Digital Operational Resilience Act Amendment", + "bill_reference_number": "EU-DORA-2026-04", + "jurisdiction": "European Union", + "sponsoring_agency": "European Banking Authority (EBA)", + "current_legislative_status": "In Committee", + "direct_pdf_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32022R2554" + }, + "summary": "Mandates 4-hour major ICT incident reporting timelines for cloud-based financial services providers. Requires financial entities to conduct threat-led penetration testing and maintain continuous third-party risk audit trails.", + "taxonomy": { + "industry_vertical": "Financial Services", + "category": "Regulatory", + "data_classification": "Restricted", + "owner_team": "Corporate Legal & GRC Team" + } +} diff --git a/skills/cloud/google-cloud-horizon-scanning/assets/jira_task_schema.json b/skills/cloud/google-cloud-horizon-scanning/assets/jira_task_schema.json new file mode 100644 index 0000000000..46d5fcb578 --- /dev/null +++ b/skills/cloud/google-cloud-horizon-scanning/assets/jira_task_schema.json @@ -0,0 +1,16 @@ +{ + "fields": { + "project": { + "key": "GRC" + }, + "summary": "EU NIS2 Directive Supply Chain Audit Requirement", + "description": "Mandates mandatory technical documentation, human oversight, and continuous logging for third-party supply chain vendors. \n\nControl Objective: CO-REG-EU-NIS2-SUPPLYCHAIN-2022", + "issuetype": { + "name": "Task" + }, + "priority": { + "name": "High" + }, + "labels": ["Regulatory", "Cybersecurity", "DORA", "NIS2"] + } +} diff --git a/skills/cloud/google-cloud-horizon-scanning/assets/servicenow_risk_schema.json b/skills/cloud/google-cloud-horizon-scanning/assets/servicenow_risk_schema.json new file mode 100644 index 0000000000..0ac9930753 --- /dev/null +++ b/skills/cloud/google-cloud-horizon-scanning/assets/servicenow_risk_schema.json @@ -0,0 +1,13 @@ +{ + "sn_risk_risk": { + "name": "EU NIS2 Directive Supply Chain Cybersecurity Risk", + "description": "Risk of third-party supply chain vendor cybersecurity audit failures under EU NIS2 mandate.", + "u_inherent_probability": "High", + "u_inherent_impact": "Critical", + "category": "Cybersecurity & Operational Resilience", + "control_objective": { + "id": "CO-REG-EU-NIS2-SUPPLYCHAIN-2022", + "name": "Supply Chain Vendor Cybersecurity Audit Management" + } + } +} diff --git a/skills/cloud/google-cloud-horizon-scanning/references/connectors.md b/skills/cloud/google-cloud-horizon-scanning/references/connectors.md new file mode 100644 index 0000000000..c80599563d --- /dev/null +++ b/skills/cloud/google-cloud-horizon-scanning/references/connectors.md @@ -0,0 +1,111 @@ +# Connectors & Workflows Reference + +This reference document contains the detailed schemas, onboarding questions, and +integration details for the Horizon Scanning skill. + +## Table of Contents + +- [1. Onboarding Interview Details (L15-L54)](#L15-L54) +- [2. Ingestion Payload Schemas (L57-L70)](#L57-L70) +- [3. Integration Connectors Details (L74-L94)](#L74-L94) +- [4. Enterprise Control Mapping & GRC Policy Drafting (L97-L111)](#L97-L111) + + +-------------------------------------------------------------------------------- + +## 1. Onboarding Interview Details + +When configuration is missing or `--reconfigure` is passed, prompt the user with +these questions: + +### Question 1: Enterprise Organization & Vertical Context + +> *"What is your enterprise organization name, industry vertical, and core +> business operations?"* - **Industry Verticals**: `Legal / Law Firm`, +> `Financial Services & Banking`, `Healthcare & Life Sciences`, `Technology & +> Cloud`, `Retail & E-Commerce`, `Energy & Utilities`, `Public Sector / +> Government`. + +### Question 2: Target Jurisdictions & Regional Scope + +> *"Which global jurisdictions or regulatory bodies need to be monitored?"* - +> **Regions**: `US Federal & State`, `European Union (EU/EEA)`, `United +> Kingdom`, `LATAM (Brazil, Mexico)`, `APAC / ASEAN`, `Global / Multilateral +> (OECD, G7)`. + +### Question 3: Regulatory Focus Themes & Risk Appetite + +> *"What specific regulatory topics or compliance frameworks should be flagged +> vs. ignored?"* - **Focus Themes**: AI/ML Governance (EU AI Act, NIST), Data +> Privacy & Protection (GDPR, CCPA), Cybersecurity & Operational Resilience +> (NIS2, DORA, CISA), Children's Online Safety, Competition / Digital Markets, +> Financial Regulation, ESG & Energy Transparency. - **Exclusion Rules**: +> Ceremonial resolutions, general political news, press releases, non-tech files +> lacking digital/data components. + +### Question 4: Enterprise Connectors & Output Targets + +> *"Where should extracted regulatory intelligence and alerts be delivered?"* - +> **Options**: - `1. BigQuery / Database Ingestion`: SQL / JSON insertion schema +> for enterprise data warehouse. - `2. Jira / ServiceNow Ticket Dispatch`: +> Automated issue creation for legal/compliance review. - `3. Google Workspace / +> Drive Sync`: Report generation in Google Docs / Drive repository. - `4. +> Webhook / Messaging Alerts`: Event payload for Slack, Microsoft Teams, or +> custom REST Webhook. + +-------------------------------------------------------------------------------- + +## 2. Ingestion Payload Schemas + +For complex, multi-step regulatory dispatch and policy workflows, utilize and +copy the structured JSON output payload templates located in the `assets/` +subfolder as dedicated, reusable schema files: + +- **Standard Ingestion Payload**: See + [assets/ingestion_payload_schema.json](../assets/ingestion_payload_schema.json). +- **Excluded Item Audit Payload**: See + [assets/excluded_item_schema.json](../assets/excluded_item_schema.json). +- **Jira Task Dispatch Payload**: See + [assets/jira_task_schema.json](../assets/jira_task_schema.json). +- **ServiceNow GRC Risk Payload**: See + [assets/servicenow_risk_schema.json](../assets/servicenow_risk_schema.json). + +-------------------------------------------------------------------------------- + +## 3. Integration Connectors Details + +Enterprise customers can integrate this skill with the following targets: + +| Connector Category | Target Enterprise | Purpose | +: : Integration : : +| :------------------ | :------------------------ | :------------------------- | +| **Data Warehouses** | Google Cloud BigQuery, | Store & query historical | +: : Snowflake, PostgreSQL : regulatory ingestion : +: : : datasets. : +| **Issue Trackers** | Jira Software, ServiceNow | Auto-create regulatory | +: : GRC, GitHub Issues : risk review tickets & : +: : : legal action items. : +| **Cloud Storage** | Google Cloud Storage | Store raw PDF bill texts & | +: : (GCS), Google Drive, Box : generated legal summary : +: : : reports. : +| **Event Webhooks** | Slack, Microsoft Teams, | Trigger real-time alert | +: : REST Webhooks : notifications for : +: : : high-priority legal : +: : : updates. : + +-------------------------------------------------------------------------------- + +## 4. Enterprise Control Mapping & GRC Policy Drafting + +Translate regulatory shifts into internal Governance, Risk & Compliance (GRC) +controls: + +1. **Control Objective Formulation**: Use the naming convention + `CO-REG-[AGENCY]-[TOPIC]-[YEAR]`. +2. **Underlying Controls Table**: | Control ID | Control Name | Implementation + Action | Evidence of Compliance | Target Systems | | :--- | :--- | :--- + | :--- | :--- | | `UC-REG-01.1` | Incident Escalation | Implement 4-hour + automated ICT incident notification workflow. | SIEM event logs, API audit + trails. | Cloud SIEM, Identity | | `UC-REG-01.2` | Vendor Risk Audit | + Maintain continuous third-party cloud audit registry. | Vendor PIA + assessments, SOC2 reports. | GRC System, Procurement |