All authors
Claude Skills by grcmana
github.com/grcmana22 skills0 installs0 views
- Ai Impact AssessmentInventory AI systems and run AI risk and AI system impact assessments aligned to ISO/IEC 42001 (6.1.2, 6.1.4, Annex A.5) with GDPR DPIA triggers — covering AI in your product and staff use of AI tools. Use for "AI risk assessment", "AI impact assessment", "ISO 42001", "AI governance", "is our AI feature risky", "AI inventory", or before launching an AI feature.Votes: 0GitHub stars: 2
- Audit ReadinessRun a readiness / gap assessment against ISO 27001, SOC 2, Cyber Essentials, GDPR or ISO 42001 — scoring each requirement, identifying gaps, estimating effort, and producing a prioritised remediation roadmap to Stage 1/Stage 2, Type I/Type II, or CE submission. Use for "are we ready for our audit", "gap assessment", "readiness assessment", "how far are we from ISO 27001 / SOC 2", or "what do we need before the auditor arrives".Votes: 0GitHub stars: 2
- Company ContextBuild or refresh the company GRC profile that every other GRC skill depends on — business model, data handled, tech stack, people, customer and regulatory drivers, scope, and recommended frameworks (ISO 27001, SOC 2, Cyber Essentials, GDPR, ISO 42001). Use when starting a compliance programme, onboarding to GRC, when a customer asks for a certification, or when the user says "set up my company context", "which framework do we need", or "scope our ISMS".Votes: 0GitHub stars: 2
- Cyber Essentials ScopingScope and pre-assess a UK Cyber Essentials / Cyber Essentials Plus certification (Requirements v3.3, Danzell question set) — building the device, cloud service and network inventory, checking the five technical controls (firewalls, secure configuration, security update management, user access control incl. mandatory MFA, malware protection), and listing fail risks before submission. Use for "Cyber Essentials", "CE+", "get CE certified", "CE scope", or "will we pass Cyber Essentials".Votes: 0GitHub stars: 2
- DpiaScreen for and draft a GDPR Data Protection Impact Assessment (Art. 35, UK & EU) — describing processing, assessing necessity and proportionality, identifying risks to individuals' rights and freedoms, and recording mitigations and residual risk for DPO/legal review. Use for "DPIA", "do we need a DPIA", "privacy impact assessment", "PIA", "new feature processes personal data", or before launching processing involving new tech, profiling, monitoring or special category data.Votes: 0GitHub stars: 2
- Evidence Request ListGenerate a deduplicated, control-mapped evidence request list and evidence tracker (CSV) for ISO 27001, SOC 2, Cyber Essentials Plus, GDPR and ISO 42001 — with owners, source systems, frequency and due dates, so one artefact satisfies multiple frameworks. Use for "evidence list", "PBC list", "what evidence do we need", "prepare for the auditor", "evidence collection plan", or "set up evidence tracking".Votes: 0GitHub stars: 2
- Evidence ReviewReview collected audit evidence (exports, screenshots, tickets, documents) for relevance, completeness, dating, attribution and authenticity before the auditor sees it — rating quality, flagging gaps and sensitive data, and updating the evidence tracker. Use for "review this evidence", "is this good enough for the auditor", "check our evidence", "pre-audit evidence QA", or "will this screenshot pass".Votes: 0GitHub stars: 2
- Grc StatusRoll up the GRC workspace (risk register, policies, evidence tracker, readiness assessments, run logs) into a one-page programme status for leadership or the board — progress per framework, top risks, overdue actions, decisions needed, and next 30 days. Use for "GRC status", "compliance update", "board report", "where are we with ISO/SOC 2", "weekly compliance summary", or management review inputs (ISO 9.3).Votes: 0GitHub stars: 2
- Policy Gap ReviewReview existing policies against ISO 27001, SOC 2, Cyber Essentials, GDPR and ISO 42001 requirements and auditor expectations — flagging missing coverage, untestable statements, unkeepable commitments, missing document control, and contradictions with actual practice. Use for "review our policies", "gap check this policy", "are our policies audit-ready", "policy review", or annual policy review cycles.Votes: 0GitHub stars: 2
- Policy WriterRecommend the minimum viable policy set for your selected frameworks and draft tailored, testable, auditor-ready information security, privacy and AI policies (ISO 27001, SOC 2, Cyber Essentials, GDPR, ISO 42001) from company context. Use for "write a policy", "draft our information security policy", "what policies do we need", "acceptable use policy", "AI policy", "access control policy", or "policy pack".Votes: 0GitHub stars: 2
- Risk RegisterIdentify, assess, treat and review information security, privacy, third-party and AI risks using a documented 5x5 methodology, producing an audit-ready risk register (CSV) and treatment plan mapped to ISO 27001, SOC 2, GDPR and ISO 42001 controls. Use for "build a risk register", "risk assessment", "update our risks", "risk review", "what are our top risks", or ISO 27001 6.1.2/6.1.3 and SOC 2 CC3 work.Votes: 0GitHub stars: 2
- Ai Impact AssessmentInventory AI systems and run AI risk and AI system impact assessments aligned to ISO/IEC 42001 (6.1.2, 6.1.4, Annex A.5) with GDPR DPIA triggers — covering AI in your product and staff use of AI tools. Use for "AI risk assessment", "AI impact assessment", "ISO 42001", "AI governance", "is our AI feature risky", "AI inventory", or before launching an AI feature.Votes: 0GitHub stars: 2
- Audit ReadinessRun a readiness / gap assessment against ISO 27001, SOC 2, Cyber Essentials, GDPR or ISO 42001 — scoring each requirement, identifying gaps, estimating effort, and producing a prioritised remediation roadmap to Stage 1/Stage 2, Type I/Type II, or CE submission. Use for "are we ready for our audit", "gap assessment", "readiness assessment", "how far are we from ISO 27001 / SOC 2", or "what do we need before the auditor arrives".Votes: 0GitHub stars: 2
- Company ContextBuild or refresh the company GRC profile that every other GRC skill depends on — business model, data handled, tech stack, people, customer and regulatory drivers, scope, and recommended frameworks (ISO 27001, SOC 2, Cyber Essentials, GDPR, ISO 42001). Use when starting a compliance programme, onboarding to GRC, when a customer asks for a certification, or when the user says "set up my company context", "which framework do we need", or "scope our ISMS".Votes: 0GitHub stars: 2
- Cyber Essentials ScopingScope and pre-assess a UK Cyber Essentials / Cyber Essentials Plus certification (Requirements v3.3, Danzell question set) — building the device, cloud service and network inventory, checking the five technical controls (firewalls, secure configuration, security update management, user access control incl. mandatory MFA, malware protection), and listing fail risks before submission. Use for "Cyber Essentials", "CE+", "get CE certified", "CE scope", or "will we pass Cyber Essentials".Votes: 0GitHub stars: 2
- DpiaScreen for and draft a GDPR Data Protection Impact Assessment (Art. 35, UK & EU) — describing processing, assessing necessity and proportionality, identifying risks to individuals' rights and freedoms, and recording mitigations and residual risk for DPO/legal review. Use for "DPIA", "do we need a DPIA", "privacy impact assessment", "PIA", "new feature processes personal data", or before launching processing involving new tech, profiling, monitoring or special category data.Votes: 0GitHub stars: 2
- Evidence Request ListGenerate a deduplicated, control-mapped evidence request list and evidence tracker (CSV) for ISO 27001, SOC 2, Cyber Essentials Plus, GDPR and ISO 42001 — with owners, source systems, frequency and due dates, so one artefact satisfies multiple frameworks. Use for "evidence list", "PBC list", "what evidence do we need", "prepare for the auditor", "evidence collection plan", or "set up evidence tracking".Votes: 0GitHub stars: 2
- Evidence ReviewReview collected audit evidence (exports, screenshots, tickets, documents) for relevance, completeness, dating, attribution and authenticity before the auditor sees it — rating quality, flagging gaps and sensitive data, and updating the evidence tracker. Use for "review this evidence", "is this good enough for the auditor", "check our evidence", "pre-audit evidence QA", or "will this screenshot pass".Votes: 0GitHub stars: 2
- Grc StatusRoll up the GRC workspace (risk register, policies, evidence tracker, readiness assessments, run logs) into a one-page programme status for leadership or the board — progress per framework, top risks, overdue actions, decisions needed, and next 30 days. Use for "GRC status", "compliance update", "board report", "where are we with ISO/SOC 2", "weekly compliance summary", or management review inputs (ISO 9.3).Votes: 0GitHub stars: 2
- Policy Gap ReviewReview existing policies against ISO 27001, SOC 2, Cyber Essentials, GDPR and ISO 42001 requirements and auditor expectations — flagging missing coverage, untestable statements, unkeepable commitments, missing document control, and contradictions with actual practice. Use for "review our policies", "gap check this policy", "are our policies audit-ready", "policy review", or annual policy review cycles.Votes: 0GitHub stars: 2
- Policy WriterRecommend the minimum viable policy set for your selected frameworks and draft tailored, testable, auditor-ready information security, privacy and AI policies (ISO 27001, SOC 2, Cyber Essentials, GDPR, ISO 42001) from company context. Use for "write a policy", "draft our information security policy", "what policies do we need", "acceptable use policy", "AI policy", "access control policy", or "policy pack".Votes: 0GitHub stars: 2
- Risk RegisterIdentify, assess, treat and review information security, privacy, third-party and AI risks using a documented 5x5 methodology, producing an audit-ready risk register (CSV) and treatment plan mapped to ISO 27001, SOC 2, GDPR and ISO 42001 controls. Use for "build a risk register", "risk assessment", "update our risks", "risk review", "what are our top risks", or ISO 27001 6.1.2/6.1.3 and SOC 2 CC3 work.Votes: 0GitHub stars: 2