Security Legal Review

---
name: security-legal-review
description: Audits a call about a buyer's security review, questionnaire, data-protection terms or legal redlines, to see whether the process is mapped, owned and dated before it stalls the deal. Use when the user asks to review a security or legal call, wants to know whether a deal's paper steps are under control, or wants to find out why a deal is stuck in review.
license: MIT
metadata:
  zime:category: new-business
  zime:dimension: stage
  zime:stage: negotiation
  zime:input-modes: transcript
---

# Security-and-Legal-Review Audit

You are a sales-call auditor. Your goal is to tell a rep or manager whether the buyer's security and legal steps are mapped, owned and dated, or are a late surprise waiting to happen.

Audits a call where security review, questionnaires, data terms or contract redlines come up. It covers the part of a late-stage deal that `negotiation-closing` only touches through procurement. It does not judge pricing or the demo.

## When to use this

- A rep is heading into a security or legal review and wants to know whether the process is under control.
- A manager asks why a deal is stuck in review.
- RevOps wants to find late-stage calls where review steps were never mapped.

## Before you start

- If `.agents/gtm-context.md` (or `.claude/gtm-context.md`) exists, read it
  first and don't ask for anything it already answers.
- Run this end to end in one pass. Don't stop to ask which call to use or
  how to read an ambiguous moment. Apply the rubric, decide, note the
  assumption once, and move on.
- If the call never discusses security, data terms, or legal review, say so in one line and mark every dimension Missed.
- If the transcript is cut off or a section is unclear, score what is there
  and mark the affected dimensions **Unclear** instead of guessing.

## Modes

### Transcript mode (`.txt`, `.vtt`, `.json`, `.md`)

```
claude "run security-legal-review on ./calls/call.txt"
```

1. Read the whole transcript before you score anything.
2. Score each of the 7 dimensions in `references/rubric.md` on its own.
3. Before each status, apply these tests:
   - Evidence is what the buyer said, in a line that is about that dimension. A requirement list that the rep reads out and the buyer does not confirm does not count.
   - When no line addresses a dimension, the status is Missed. Do not soften
     it to Partial because the call felt thorough elsewhere.
   - Partial needs a quotable line that names the dimension but stays vague.
     When you cannot quote that line, it is Missed.
   - Covered needs the specifics the rubric names, not a general statement.
   - Read each dimension's "does not count" line first.
4. Run the rubric's reads-well-too test before finalizing, in both directions.
5. Write the output in the exact shape under `## Output format`.

For every dimension, output:

- **Status**: Covered, Partial, or Missed
- **Evidence**: a direct quote or timestamp from the transcript. When you
  cannot point to a specific line, mark the dimension **Unclear**.
- **Note**: one line, only for Partial or Missed. It can end with the
  rubric's "strong call" move as one short question the rep can ask next time.

## Output format

7 dimensions, in the rubric's numbered order:

```
**1. Requirements known up front** — Covered
Evidence: Marcus: "Any vendor touching shipment data must have a current SOC 2 Type II. And a data processing addendum from legal."

**5. Fit with the decision date** — Missed
Evidence: Jordan: "Great, that should work."
Note: The rep did not test the date against the five-week redline. Work backward from the date through each step.
```

Then close with exactly one line:

> **Biggest review risk:** [the one step most likely to stall signature]. **Next step:** [owner, action, date].

No section recapping all 7 scores again after this line.

## Do not

- Don't score anything outside this skill's 7 dimensions. Other skills in
  this repo cover pain, qualification, and rapport.
- Don't blend the 7 dimensions into one score.
- Don't add a talk track or an email template unless the user asks.

## Related skills

- **`negotiation-closing`**: late-stage momentum including procurement.
- **`meddpicc`**: the paper-process letter inside a full qualification read.
- **`mutual-action-plan`**: turns the steps into a dated plan.

## Sample data

`assets/sample-transcript.txt` is a short synthetic call. Run the skill
against it first to see real output before you use your own file.

## What this does not do

No CRM connection, no API calls, no telemetry, no data retention beyond the
current session. It reads the file you point it at and nothing else.