All authors
Claude Skills by better-isms
github.com/better-isms61 skills0 installs0 views
- Submit SkillUse this skill when someone wants to contribute, submit or publish a GRC skill to the grcskills library (github.com/better-isms/grcskills, grcskills.com), or update a skill or author profile they already published there. Interviews the contributor for practitioner judgment, drafts the files in the library format, runs the validator and opens one pull request.Votes: 0GitHub stars: 6
- Acceptable Use Policy DraftingUse this skill when a company needs rules for how staff use company systems, data, devices and AI tools, or asks "write our acceptable use policy", "AUP for employees", "can staff use ChatGPT at work", "AI usage policy", "BYOD rules", "remote work security rules" or "a policy people will actually read". Finds how people really work (devices, apps, AI tools, travel), puts the choices to the reader as decisions, drafts a short plain-language policy with concrete do and do not examples, and adds...Votes: 0GitHub stars: 6
- Access Review Campaign PrepUse this skill when a periodic user access review is due, an auditor asked for access review evidence, or someone says "prepare the access review", "run the quarterly user recertification", "who still has admin", "check leavers still have access", "build the access review sheets for managers" or "our last review was a rubber stamp". Picks the systems in scope, builds account populations reconciled against HR, pre-flags leavers, orphans, shared and dormant accounts, assigns independent reviewe...Votes: 0GitHub stars: 6
- Ai Acceptable Use RulesUse this skill when staff already use AI assistants, coding tools or AI features and the company needs rules people will follow, and asks "write our AI usage policy", "can staff use ChatGPT", "generative AI policy", "what data can we put into AI tools", "approved AI tools list", "rules for AI agents and connectors" or "AI literacy for staff". Finds out what people actually use, sets a short list of approved tools with a data traffic light, rules for checking outputs and for agents that act, a...Votes: 0GitHub stars: 6
- Ai Act Risk ClassificationUse this skill when a company must work out where each of its AI systems sits under the EU AI Act, and asks "is this high-risk", "classify our AI systems", "AI Act risk tier", "are we a provider or a deployer", "does Annex III apply to us", "is this a prohibited practice", "what does the AI Act mean for our chatbot" or "which AI Act obligations do we have". Tests each system, one at a time, for scope, role, prohibited practices, the two high-risk routes, the narrow exemption, transparency dut...Votes: 0GitHub stars: 6
- Ai Impact AssessmentUse this skill when one AI system needs its impact on people and on the company assessed before launch, after a significant change, or because a customer, auditor or regulator asks for it, and the team says "AI impact assessment", "assess the impact of this model", "fundamental rights impact assessment", "who could this AI harm", "bias assessment before launch" or "sign-off for the AI feature". Describes the system in its context, works through impacts on the people it affects with evidence, ...Votes: 0GitHub stars: 6
- Ai Management System ScopeUse this skill when a company that already runs a security management system wants to add an AI management system, or is preparing for an AI governance certification, and asks "scope our AI management system", "what should the AIMS cover", "AI governance roles", "who owns AI governance", "extend our ISMS to AI" or "write the AI management system scope statement". Decides which AI systems, roles, teams and lifecycle stages are in, maps interfaces and dependencies, reuses the processes the secu...Votes: 0GitHub stars: 6
- Ai System InventoryUse this skill when a company needs to know what AI it builds, buys or uses, before an AI governance programme, an AI regulation review or a customer questionnaire, and asks "list our AI systems", "build an AI register", "AI inventory", "where are we using AI", "find shadow AI", "which of our vendors use AI" or "what AI do we have before the AI Act". Discovers AI systems from procurement, single sign-on, code and teams, records one entry per use case with owner, purpose, data, affected people...Votes: 0GitHub stars: 6
- Ai Vendor Due DiligenceUse this skill when the company is about to buy, renew or switch on an AI product or an AI feature inside an existing product, and asks "assess this AI vendor", "do they train on our data", "AI supplier questionnaire", "review the AI terms", "can we use this model provider with customer data", "who are the subprocessors behind this AI tool" or "AI vendor risk assessment". Sizes the review to the use, reads the terms, data processing agreement and documentation before asking questions, checks ...Votes: 0GitHub stars: 6
- Auditor Interview PrepUse this skill when process owners, engineers or executives will be interviewed in an external or internal audit and need to be ready, or when someone asks "prepare the team for the auditor interviews", "what will the auditor ask our CTO", "interview briefing for the audit", "how should people answer the auditor", "mock audit interviews" or "our engineers are nervous about the audit". Builds a one-page brief per role: what the auditor is likely to ask, the records that person should be able t...Votes: 0GitHub stars: 6
- Auditor Sample PreparationUse this skill when an external audit, attestation examination or assessment is coming and the team wants populations and evidence ready for the samples the auditor will pull, or asks "prepare for audit sampling", "what samples will the auditor ask for", "get our populations ready", "the auditor wants a list of all changes in the period", "evidence for the leavers sample", "Type II sample prep" or "how do we prove completeness of the population". Lists the populations an auditor is likely to ...Votes: 0GitHub stars: 6
- Backup Restore Test EvidenceUse this skill when a restore test is due, an auditor or customer asks for proof that backups can be recovered, or someone says "plan a restore test", "prove we can recover in time", "our backups succeed but we never restored", "test our RTO and RPO", "write up the disaster recovery test" or "document the backup restore for the audit". Picks what to restore, writes a test plan with success criteria set before the test, records timings against the recovery objectives, and produces a signed-off...Votes: 0GitHub stars: 6
- Bcp Tabletop DesignUse this skill when a company must test its incident response or continuity plan without breaking anything, because an audit, a customer, a regulator or the plan itself calls for an exercise, and someone asks "design a tabletop", "run a ransomware tabletop", "BCP exercise", "crisis simulation", "test our incident response plan", "write the injects" or "we need exercise evidence". Picks two or three objectives, builds a realistic company-specific scenario with timed injects that force decision...Votes: 0GitHub stars: 6
- Business Impact AnalysisUse this skill when a company needs recovery objectives it can defend, before a continuity plan, a disaster recovery design, an audit or a resilience review, and asks "do a BIA", "business impact analysis", "set our RTO and RPO", "what is our maximum tolerable downtime", "which services are critical", "impact tolerance" or "can our backups meet our recovery targets". Lists services from the customer's view, prices an outage over time in the company's own money and obligations, sets recovery t...Votes: 0GitHub stars: 6
- Change Management Evidence SamplingUse this skill when an auditor will test change management, or the team wants to know before they do, and asks "sample our production changes", "check our PR approvals", "do we have segregation of duties on deploys", "test change management before the audit", "were emergency changes approved" or "can a developer push to production alone". Builds the change population from what actually reached production, reconciles it with tickets and pull requests, draws a recorded sample, tests approval, t...Votes: 0GitHub stars: 6
- Control Owner RaciUse this skill when controls have no clear owner, or "security" owns everything, and the team asks "who owns each control", "build a RACI for our controls", "assign control owners", "nobody knows who runs the access review", "set a review cadence per control" or "the auditor asked who is accountable". Assigns one accountable role and the operators to every applicable control, checks workload and segregation of duties, sets a review cadence from how each control runs, and writes a RACI table p...Votes: 0GitHub stars: 6
- Customer Security Questionnaire AnswersUse this skill when a customer or prospect has sent a security questionnaire, due diligence form or vendor assessment and someone asks "answer this security questionnaire", "fill in the customer's vendor assessment", "draft answers from our policies", "we have 300 questions due Friday", "reuse our previous questionnaire answers" or "which answers can we not back up". Drafts every answer from the company's own documents with a source and a confidence level, flags answers without evidence and a...Votes: 0GitHub stars: 6
- Data Subject Request ProcedureUse this skill when a company needs a working process for privacy requests, or just received one and has none, and asks "DSAR procedure", "how do we handle a subject access request", "someone asked us to delete their data", "right to erasure process", "data subject rights workflow", "GDPR request handling" or "we missed the one-month deadline". Designs intake from any channel, a proportionate identity check, the system search map, review and redaction, response templates per right, deadline t...Votes: 0GitHub stars: 6
- Document Consistency CheckUse this skill when a set of policies, procedures, plans and registers has grown in pieces and someone asks "check our documents for contradictions", "are our policies consistent", "the retention periods don't match", "which severity scale is right", "harmonise our ISMS documents", "cross-check the incident plan against the policy" or "clean up our documentation before the audit". Extracts the checkable facts from every document (periods, deadlines, scales, roles, labels, references), finds c...Votes: 0GitHub stars: 6
- Dpa Security Annex ReviewUse this skill when a data processing agreement is being negotiated or renewed and someone asks "review the TOMs annex", "check the security measures in this DPA", "can we sign this annex", "the customer sent their DPA with a security schedule", "is our standard annex still true" or "does this vendor's annex promise enough". Breaks the technical and organisational measures annex into single commitments, compares each one with what the company actually runs or with what the use case needs, and...Votes: 0GitHub stars: 6
- Dpia ScreeningUse this skill when a new product feature, vendor, AI use, monitoring tool or change in processing raises the question "do we need a DPIA", or someone asks "DPIA screening", "is this high risk processing", "data protection impact assessment threshold", "privacy impact screening for this feature", "does our AI feature need a DPIA" or "document why we did not do a DPIA". Describes the processing with numbers, tests it against the GDPR cases, the supervisory authority's list and the EDPB-endorse...Votes: 0GitHub stars: 6
- Evidence Freshness CheckUse this skill when an audit, attestation period or customer review is coming and someone asks "is our evidence up to date", "check the evidence folder before the auditor sees it", "which screenshots are stale", "do we have evidence for the whole period", "find undated evidence" or "what will the auditor reject". Indexes every evidence artefact with the date inside it, its owner and the period it covers, flags what is stale, undated, unowned, outside the audit period or missing for a recurrin...Votes: 0GitHub stars: 6
- Evidence Request List BuilderUse this skill when an auditor, assessor or regulator has sent a request list and the team asks "turn the auditor's request list into tasks", "who needs to provide what", "build the evidence tracker", "split the PBC list by owner", "what exactly do they want for this request" or "we have two weeks to send everything". Normalises each request into owned, dated tasks naming the exact artefact, period and source system, separates population requests from sample requests, batches the clarificatio...Votes: 0GitHub stars: 6
- First Gap AssessmentUse this skill when a company starts a compliance programme and needs to know how far it is from a framework, and asks "run a gap analysis", "how ready are we for the audit", "baseline us against the framework", "what do we have and what is missing", "readiness assessment before we hire an auditor" or "how long until we can certify". Baselines what exists against the chosen framework from documents and records, rates each item by evidence rather than opinion, sizes every gap by effort and aud...Votes: 0GitHub stars: 6
- Grc Setup ReviewUse this skill when someone wants to know where to start with the grcskills library, or asks "review my GRC setup", "what should I fix before the audit", "which compliance skills do I need", "audit my ISMS folder", "give me a 30-day compliance plan" or "rank the skills for my company". Reads the frontmatter of every skill in the library, inspects the compliance material the agent can reach (repo, policy folder, registers, platform exports), ranks the 10 skills that would help most with impact...Votes: 0GitHub stars: 6
- Ict Risk Framework CheckUse this skill when a bank, payment or e-money institution, investment firm, insurer, crypto-asset service provider or other financial entity in scope of DORA needs to know whether its ICT risk management setup holds up, or when someone asks "DORA gap analysis", "are we DORA compliant on ICT risk", "check our ICT risk management framework", "prepare for the supervisor's DORA review", "does our ISO 27001 ISMS cover DORA" or "audit our Article 6 framework". Confirms the entity type and whether ...Votes: 0GitHub stars: 6
- Ict Third Party RegisterUse this skill when a financial entity in scope of DORA needs to build or refresh its register of ICT third-party arrangements, and someone asks "build our register of information", "list our ICT providers for the regulator", "which providers support critical or important functions", "refresh the DORA register", "map our ICT contracts to functions" or "where is our provider concentration". Builds the population of ICT arrangements including intra-group ones, maps each to the functions it supp...Votes: 0GitHub stars: 6
- Incident Response Plan DraftingUse this skill when a company has no incident response plan, has one copied from a template that names teams it does not have, or an auditor, customer or insurer asks for it, and the team says "write our incident response plan", "IR plan", "security incident procedure", "who does what in an incident", "incident playbooks", "contact tree for incidents" or "our plan failed in the last incident". Drafts a plan sized to the company with roles and deputies, a severity scale, a contact tree with an...Votes: 0GitHub stars: 6
- Incident Severity TriageUse this skill when something is happening now: an alert, a suspicious login, a ransomware note, data sent to the wrong customer, an outage that might be an attack, and someone asks "how bad is this", "classify this incident", "is this a SEV1", "who do we wake up", "is this a breach", "do we need to notify anyone" or "start the incident log". Classifies the incident on the company's own scale in minutes, decides who is called and how fast, flags any regulatory or contractual clock, lists the ...Votes: 0GitHub stars: 6
- Internal Audit Checklist From ScopeUse this skill when an internal auditor has one process or area to audit and needs a working checklist built from the company's own documents, or asks "build an internal audit checklist", "audit questions for access management", "what do I test in the supplier process", "audit plan for this area", "how many samples should I take", "internal audit of our data protection process" or "test our incident process against what the policy says". Turns each commitment in the company's policies and pro...Votes: 0GitHub stars: 6
- Internal Audit Programme PlanningUse this skill when a company needs its internal audit programme for the certification or examination cycle, or asks "plan our internal audits", "internal audit schedule for the year", "audit programme for the three-year cycle", "who can do our internal audit", "we are too small for an independent auditor", "readiness audit before the examination" or "which areas do we audit first". Ranks audit areas by risk, change and past findings, sets how often each is audited across the cycle, assigns a...Votes: 0GitHub stars: 6
- Logging And Monitoring Evidence PackUse this skill when an auditor, customer or regulator will ask how security events are logged and watched, and someone says "prepare logging evidence", "show we monitor alerts", "what do we log and for how long", "who looks at the SIEM", "prove an alert was handled" or "our monitoring evidence is just dashboard screenshots". Maps log coverage and retention per system, lists the alert rules that matter and where they go, traces real alerts end to end with timestamps, and writes an evidence pac...Votes: 0GitHub stars: 6
- Management Review PackUse this skill when leadership is due to review the security, privacy or AI management system, or when someone asks "prepare the management review", "management review agenda", "board pack for the ISMS", "write the management review minutes", "what metrics do we show leadership", "the auditor wants evidence of management review" or "our management review is a slide nobody reads". Assembles the facts leadership needs from the registers, audits, incidents and metrics, frames each agenda item as...Votes: 0GitHub stars: 6
- Multi Framework Overlap MapUse this skill when a company answers to two or more frameworks and is collecting the same evidence twice, and asks "map our controls across frameworks", "crosswalk between our certification and our attestation", "can our ISMS cover NIS 2", "unified control framework", "collect evidence once, use it everywhere" or "what is unique to each framework". Builds one internal control set in the company's own words, maps each control to the framework references by bare identifier with an honest match...Votes: 0GitHub stars: 6
- Nis2 Entity Applicability CheckUse this skill when a company needs to know whether the NIS 2 Directive applies to it, and asks "are we in scope of NIS 2", "are we an essential or important entity", "which country supervises us", "do we have to register", "a customer says we fall under NIS 2" or "does DORA replace NIS 2 for us". Works through sector, size, the size-independent cases, entity type, jurisdiction and sector-specific law, entity by entity and member state by member state, and writes a reasoned applicability memo...Votes: 0GitHub stars: 6
- Nonconformity Root Cause And Corrective ActionUse this skill when an internal or external audit raised a nonconformity, finding, exception or observation and the team must answer it, or asks "write the corrective action plan", "root cause for this audit finding", "respond to the major nonconformity", "CAPA for the auditor", "how do we close this finding" or "the auditor rejected our corrective action". Separates correction from corrective action, runs a root cause analysis that stops at a cause the company controls, checks for the same p...Votes: 0GitHub stars: 6
- Phi Flow MappingUse this skill when a covered entity or business associate needs to know where protected health information lives and moves, or asks "map our PHI", "ePHI inventory", "HIPAA data flow diagram", "where does patient data go", "PHI flow map for the risk analysis", "which vendors need a BAA" or "do our logs contain PHI". Traces health data from where it enters, through systems, integrations, logs, backups and vendors, to where it leaves and is disposed of, records the safeguards that cover each fl...Votes: 0GitHub stars: 6
- Policy Gap Review Against PracticeUse this skill when a team suspects its policies describe a company that does not exist, before an audit or customer review, or asks "do our policies match what we actually do", "check the policy against reality", "paper versus practice", "will the auditor find gaps in our policies", "our policy says quarterly but we never do it" or "align policies with how we work". Turns each policy into testable statements, samples the systems and records that show the practice, classifies every gap and pr...Votes: 0GitHub stars: 6
- Policy Review Cycle RefreshUse this skill when the periodic policy review is due or overdue, or someone asks "run the annual policy review", "our policies are out of date", "re-approve the policies before the audit", "what changed since the last review", "policy version history" or "who needs to sign off which policy". Collects what changed since each policy was last approved (incidents, findings, exceptions, new systems, law), proposes the edits per policy, separates editorial from substantive changes, drafts the vers...Votes: 0GitHub stars: 6
- Post Incident ReviewUse this skill when an incident or a serious near miss is closed and the team must learn from it, or an auditor asks for lessons learned, and someone says "run the post-mortem", "post-incident review", "lessons learned", "retro on the outage", "blameless review", "root cause of the incident" or "what do we change after this breach". Builds the timeline from records before the meeting, runs a blameless discussion, finds the contributing factors, and turns them into a few owned, dated actions l...Votes: 0GitHub stars: 6
- Privacy And Ai Control ApplicabilityUse this skill when a company with a security applicability statement extends its management system to privacy or to AI, and asks "extend our SoA for privacy", "which privacy controls apply to a processor", "AI controls applicability", "SoA for our AI management system", "are we controller or processor for this" or "do the AI development controls apply if we only use a model". Settles the company's role per processing activity and per AI system, decides applicability of the additional control...Votes: 0GitHub stars: 6
- Privacy Notice Gap CheckUse this skill when a published privacy notice may no longer match what the company does, or someone asks "is our privacy policy accurate", "check our privacy notice against the RoPA", "privacy notice review", "Article 13 and 14 check", "does our website privacy policy cover our vendors and cookies" or "update the privacy notice for the new product". Maps every collection point, compares each notice with the processing record, the vendor list and what the site and product actually collect, cl...Votes: 0GitHub stars: 6
- Regulatory Incident Reporting ClockUse this skill when an incident may have to be reported to an authority, customers or affected people, and the team asks "do we have to notify", "72 hours", "24 hour early warning", "is this a notifiable breach", "major incident report", "who do we tell and by when", "draft the breach notification" or "do we tell the customers". Fixes the facts and the awareness time, tests each regime and contract that may apply, builds one table of recipients and deadlines with the earliest first, drafts ea...Votes: 0GitHub stars: 6
- Risk Acceptance MemoUse this skill when a risk owner wants to accept a residual risk instead of treating it further, or when someone asks "write a risk acceptance", "we want to accept this risk", "risk exception form", "document the risk acceptance for the auditor", "security exception for this system", "can we sign off this risk" or "management accepted the risk, how do we record it". Drafts a one-page decision record per risk: the risk and its score, the options considered with cost, why acceptance is reasonab...Votes: 0GitHub stars: 6
- Risk Method DraftingUse this skill when a company needs a written risk assessment method before it builds or rescores a register, or when the current method produces registers where everything scores 3. Triggers: "write our risk methodology", "define likelihood and impact scales", "what is our risk appetite", "risk acceptance criteria", "who can accept a risk", "our auditor says the method is not repeatable", "risk matrix for our ISMS". Drafts a short method with likelihood and impact anchors in the company's ow...Votes: 0GitHub stars: 6
- Risk Register First PassUse this skill when a team needs its first information security risk register, or has one that is a copied catalogue nobody owns, and asks "build our risk register", "draft a risk assessment", "what are our top risks", "risk register from scratch", "our auditor wants a risk assessment" or "turn our incidents and findings into risks". Drafts 20 to 40 company-specific risk scenarios from the material the agent can reach, scores them against an agreed method, proposes owners and treatments, and ...Votes: 0GitHub stars: 6
- Risk Register Hygiene ReviewUse this skill when an existing risk register needs a check before an audit, a management review or a new owner takes it over, or when someone asks "clean up our risk register", "is our risk register any good", "review the risk register before the audit", "our risks have not been updated", "find duplicate risks", "who owns these risks" or "the scores look wrong". Reads the register read-only and finds stale, duplicated, unowned, orphaned and mis-scored entries, risks missing given the company...Votes: 0GitHub stars: 6
- Risk To Control Traceability CheckUse this skill when the risk register and the statement of applicability were written separately and may not agree, and the team asks "do our risks link to our controls", "traceability between risk treatment and the SoA", "why is this control applicable", "the auditor could not trace a risk to a control", "check our risk treatment plan against the SoA" or "orphan controls". Checks in both directions that every treated risk points to controls and actions, and every applicable control traces ba...Votes: 0GitHub stars: 6
- Risk Treatment Plan DraftingUse this skill when a risk register has treatment decisions but no plan anyone can execute, or when someone asks "write the risk treatment plan", "turn the risk register into actions", "what do we do about our high risks", "treatment plan for the auditor", "budget the security roadmap from the risks" or "our treatment plan is just a list of controls". Turns each reduce, avoid or transfer decision into dated actions with an owner, budget, dependency and the record that will prove it was done, ...Votes: 0GitHub stars: 6
- Ropa First DraftUse this skill when a company needs its record of processing activities for the first time, or has one that is really a list of tools, and asks "build our RoPA", "records of processing", "data map for GDPR", "Article 30 record", "what personal data do we process and why", "data inventory for privacy" or "our DPO needs a processing register". Drafts the record by processing activity from systems, vendors and team interviews, with purposes, data and subject categories, proposed legal bases, rec...Votes: 0GitHub stars: 6