<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-regulatory-change-management
description: >-
  Track, assess, and implement regulatory changes affecting cybersecurity
  and data protection compliance. Automate monitoring of regulatory feeds,
  impact analysis against current controls, gap identification, and
  remediation planning for multi-jurisdiction compliance programs.
domain: cybersecurity
subdomain: compliance-audit
tags:
  - regulatory-change
  - compliance-management
  - regulatory-tracking
  - impact-analysis
  - multi-jurisdiction
  - compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Regulatory Change Management

## Overview

Regulatory landscapes evolve continuously — new laws, amended standards, and
updated guidance require organizations to assess impact and adapt controls.
This skill automates regulatory change monitoring, impact analysis against
existing compliance programs, gap identification, and remediation tracking
across multiple jurisdictions and frameworks (GDPR, CCPA/CPRA, HIPAA, PCI DSS,
NIS2, DORA, SEC Cyber Rules).

Mode: `[MODE: ARCHITECT]` — Regulatory change governance and compliance adaptation.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | For agent tooling |
| jq | `apt install jq` |
| curl | For regulatory feed monitoring |

## Key Concepts

### Regulatory Change Lifecycle

```
Regulatory Change Management:
├── 1. Monitoring & Detection
│   ├── Regulatory body RSS/API feeds
│   ├── Legal counsel advisories
│   ├── Industry association updates
│   └── Framework version releases
├── 2. Impact Assessment
│   ├── Applicability determination
│   ├── Current control mapping
│   ├── Gap identification
│   └── Business impact analysis
├── 3. Planning & Prioritization
│   ├── Compliance deadline tracking
│   ├── Resource and budget estimation
│   ├── Remediation roadmap creation
│   └── Stakeholder communication plan
├── 4. Implementation
│   ├── Policy and procedure updates
│   ├── Technical control changes
│   ├── Training and awareness updates
│   └── Evidence collection updates
└── 5. Validation & Closure
    ├── Implementation verification
    ├── Audit trail documentation
    ├── Regulatory filing confirmation
    └── Lessons learned capture
```

### Active Regulatory Tracker

```yaml
regulatory_changes:
  - id: REG-2026-001
    regulation: "EU AI Act"
    effective_date: "2026-08-01"
    status: "implementation_required"
    impact: high
    affected_frameworks:
      - GDPR
      - ISO 27001
    actions_required:
      - "Classify AI systems by risk level"
      - "Implement conformity assessments for high-risk AI"
      - "Deploy AI transparency requirements"

  - id: REG-2026-002
    regulation: "NIS2 Directive"
    effective_date: "2025-10-17"
    status: "effective"
    impact: critical
    affected_frameworks:
      - ISO 27001
      - NIST CSF
    actions_required:
      - "Update incident reporting to 24-hour initial notification"
      - "Implement supply chain security requirements"
      - "Board-level cybersecurity oversight"

  - id: REG-2026-003
    regulation: "SEC Cybersecurity Rules"
    effective_date: "2024-12-18"
    status: "effective"
    impact: high
    affected_frameworks:
      - SOX
      - NIST CSF
    actions_required:
      - "File Form 8-K within 4 business days of material incident"
      - "Annual Form 10-K cybersecurity governance disclosure"

  - id: REG-2026-004
    regulation: "PCI DSS v4.0.1"
    effective_date: "2025-03-31"
    status: "effective"
    impact: high
    affected_frameworks:
      - PCI DSS
    actions_required:
      - "Implement targeted risk analysis per requirement"
      - "Deploy authenticated vulnerability scanning"
      - "Enforce MFA for all CDE access"
```

### Impact Assessment Matrix

| Change | Policies | Technical Controls | Training | Evidence | Timeline |
|---|---|---|---|---|---|
| New regulation | Full review | Gap analysis | Required | New artifacts | 6–18 months |
| Framework update | Section update | Targeted changes | Targeted | Updated artifacts | 3–6 months |
| Guidance change | Minor update | Review existing | Optional | Review existing | 1–3 months |
| Enforcement action | Lessons learned | Verify controls | Awareness | Retain existing | Immediate |

## Workflow

### Step 1: Monitor Regulatory Changes

```bash
node scripts/agent.js --action monitor \
  --jurisdictions us,eu,uk --output /tmp/reg-changes.json
```

### Step 2: Assess Impact on Current Program

```bash
node scripts/agent.js --action assess --change REG-2026-001 \
  --frameworks gdpr,iso27001 --output /tmp/reg-impact.json
```

### Step 3: Generate Remediation Plan

```bash
node scripts/agent.js --action plan --input /tmp/reg-impact.json \
  --output /tmp/reg-plan.json
```

## Verification

- [ ] Regulatory monitoring sources configured and active
- [ ] All applicable regulations tracked with effective dates
- [ ] Impact assessments completed for each regulatory change
- [ ] Remediation plans created with deadlines and owners
- [ ] Policy updates drafted and in review pipeline
- [ ] Technical control changes scheduled or implemented
- [ ] Board/management briefing on material regulatory changes

## References

- [EU Regulatory Updates](https://eur-lex.europa.eu/)
- [NIST Cybersecurity Updates](https://csrc.nist.gov/)
- [SEC Cybersecurity Rules](https://www.sec.gov/rules/)
- [PCI SSC Document Library](https://www.pcisecuritystandards.org/)
