better-isms/grcskills

better-isms/grcskills · AGENTS.md

better-isms/grcskills · CLAUDE.md

better-isms/grcskills · skills/.system/submit-skill/SKILL.md · Use this skill when someone wants to contribute, submit or publish a GRC skill to the grcskills library…

better-isms/grcskills · skills/tristan-roth/acceptable-use-policy-drafting/SKILL.md · Use this skill when a company needs rules for how staff use company systems, data, devices and AI tools, or asks "write…

better-isms/grcskills · skills/tristan-roth/access-review-campaign-prep/SKILL.md · Use this skill when a periodic user access review is due, an auditor asked for access review evidence, or someone says…

better-isms/grcskills · skills/tristan-roth/ai-acceptable-use-rules/SKILL.md · Use this skill when staff already use AI assistants, coding tools or AI features and the company needs rules people…

better-isms/grcskills · skills/tristan-roth/ai-act-risk-classification/SKILL.md · Use this skill when a company must work out where each of its AI systems sits under the EU AI Act, and asks "is this…

better-isms/grcskills · skills/tristan-roth/ai-draft-challenge-review/SKILL.md · Use this skill when someone is about to sign or approve a GRC artefact an AI agent drafted (a risk register…

better-isms/grcskills · skills/tristan-roth/ai-impact-assessment/SKILL.md · Use this skill when one AI system needs its impact on people and on the company assessed before launch, after a…

better-isms/grcskills · skills/tristan-roth/ai-management-system-scope/SKILL.md · Use this skill when a company that already runs a security management system wants to add an AI management system, or…

better-isms/grcskills · skills/tristan-roth/ai-system-inventory/SKILL.md · Use this skill when a company needs to know what AI it builds, buys or uses, before an AI governance programme, an AI…

better-isms/grcskills · skills/tristan-roth/ai-vendor-due-diligence/SKILL.md · Use this skill when the company is about to buy, renew or switch on an AI product or an AI feature inside an existing…

better-isms/grcskills · skills/tristan-roth/auditor-interview-prep/SKILL.md · Use this skill when process owners, engineers or executives will be interviewed in an external or internal audit and…

better-isms/grcskills · skills/tristan-roth/auditor-sample-preparation/SKILL.md · Use this skill when an external audit, attestation examination or assessment is coming and the team wants populations…

better-isms/grcskills · skills/tristan-roth/backup-restore-test-evidence/SKILL.md · Use this skill when a restore test is due, an auditor or customer asks for proof that backups can be recovered, or…

better-isms/grcskills · skills/tristan-roth/bcp-tabletop-design/SKILL.md · Use this skill when a company must test its incident response or continuity plan without breaking anything, because an…

better-isms/grcskills · skills/tristan-roth/business-impact-analysis/SKILL.md · Use this skill when a company needs recovery objectives it can defend, before a continuity plan, a disaster recovery…

better-isms/grcskills · skills/tristan-roth/change-management-evidence-sampling/SKILL.md · Use this skill when an auditor will test change management, or the team wants to know before they do, and asks "sample…

better-isms/grcskills · skills/tristan-roth/control-owner-raci/SKILL.md · Use this skill when controls have no clear owner, or "security" owns everything, and the team asks "who owns each…

better-isms/grcskills · skills/tristan-roth/customer-security-questionnaire-answers/SKILL.md · Use this skill when a customer or prospect has sent a security questionnaire, due diligence form or vendor assessment…

better-isms/grcskills · skills/tristan-roth/data-subject-request-procedure/SKILL.md · Use this skill when a company needs a working process for privacy requests, or just received one and has none, and asks…

better-isms/grcskills · skills/tristan-roth/document-consistency-check/SKILL.md · Use this skill when a set of policies, procedures, plans and registers has grown in pieces and someone asks "check our…

better-isms/grcskills · skills/tristan-roth/dpa-security-annex-review/SKILL.md · Use this skill when a data processing agreement is being negotiated or renewed and someone asks "review the TOMs…

better-isms/grcskills · skills/tristan-roth/dpia-screening/SKILL.md · Use this skill when a new product feature, vendor, AI use, monitoring tool or change in processing raises the question…

better-isms/grcskills · skills/tristan-roth/evidence-freshness-check/SKILL.md · Use this skill when an audit, attestation period or customer review is coming and someone asks "is our evidence up to…

better-isms/grcskills · skills/tristan-roth/evidence-request-list-builder/SKILL.md · Use this skill when an auditor, assessor or regulator has sent a request list and the team asks "turn the auditor's…

better-isms/grcskills · skills/tristan-roth/first-gap-assessment/SKILL.md · Use this skill when a company starts a compliance programme and needs to know how far it is from a framework, and asks…

better-isms/grcskills · skills/tristan-roth/grc-setup-review/SKILL.md · Use this skill when someone wants to know where to start with the grcskills library, or asks "review my GRC setup"…

better-isms/grcskills · skills/tristan-roth/ict-risk-framework-check/SKILL.md · Use this skill when a bank, payment or e-money institution, investment firm, insurer, crypto-asset service provider or…

better-isms/grcskills · skills/tristan-roth/ict-third-party-register/SKILL.md · Use this skill when a financial entity in scope of DORA needs to build or refresh its register of ICT third-party…

better-isms/grcskills · skills/tristan-roth/incident-response-plan-drafting/SKILL.md · Use this skill when a company has no incident response plan, has one copied from a template that names teams it does…

better-isms/grcskills · skills/tristan-roth/incident-severity-triage/SKILL.md · Use this skill when something is happening now: an alert, a suspicious login, a ransomware note, data sent to the wrong…

better-isms/grcskills · skills/tristan-roth/internal-audit-checklist-from-scope/SKILL.md · Use this skill when an internal auditor has one process or area to audit and needs a working checklist built from the…

better-isms/grcskills · skills/tristan-roth/internal-audit-programme-planning/SKILL.md · Use this skill when a company needs its internal audit programme for the certification or examination cycle, or asks…

better-isms/grcskills · skills/tristan-roth/isms-document-cleanup/SKILL.md · Use this skill when an ISMS document (policy, procedure, statement of applicability or register) reads badly and…

better-isms/grcskills · skills/tristan-roth/logging-and-monitoring-evidence-pack/SKILL.md · Use this skill when an auditor, customer or regulator will ask how security events are logged and watched, and someone…

better-isms/grcskills · skills/tristan-roth/management-review-pack/SKILL.md · Use this skill when leadership is due to review the security, privacy or AI management system, or when someone asks…

better-isms/grcskills · skills/tristan-roth/multi-framework-overlap-map/SKILL.md · Use this skill when a company answers to two or more frameworks and is collecting the same evidence twice, and asks…

better-isms/grcskills · skills/tristan-roth/nis2-entity-applicability-check/SKILL.md · Use this skill when a company needs to know whether the NIS 2 Directive applies to it, and asks "are we in scope of NIS…

better-isms/grcskills · skills/tristan-roth/nonconformity-root-cause-and-corrective-action/SKILL.md · Use this skill when an internal or external audit raised a nonconformity, finding, exception or observation and the…

better-isms/grcskills · skills/tristan-roth/phi-flow-mapping/SKILL.md · Use this skill when a covered entity or business associate needs to know where protected health information lives and…

better-isms/grcskills · skills/tristan-roth/poam-first-draft/SKILL.md · Use this skill when assessment findings, scan results or self-assessment gaps have to become a plan of action and…

better-isms/grcskills · skills/tristan-roth/policy-gap-review-against-practice/SKILL.md · Use this skill when a team suspects its policies describe a company that does not exist, before an audit or customer…

better-isms/grcskills · skills/tristan-roth/policy-review-cycle-refresh/SKILL.md · Use this skill when the periodic policy review is due or overdue, or someone asks "run the annual policy review", "our…

better-isms/grcskills · skills/tristan-roth/post-incident-review/SKILL.md · Use this skill when an incident or a serious near miss is closed and the team must learn from it, or an auditor asks…

better-isms/grcskills · skills/tristan-roth/privacy-and-ai-control-applicability/SKILL.md · Use this skill when a company with a security applicability statement extends its management system to privacy or to…

better-isms/grcskills · skills/tristan-roth/privacy-notice-gap-check/SKILL.md · Use this skill when a published privacy notice may no longer match what the company does, or someone asks "is our…

better-isms/grcskills · skills/tristan-roth/regulatory-incident-reporting-clock/SKILL.md · Use this skill when an incident may have to be reported to an authority, customers or affected people, and the team…

better-isms/grcskills · skills/tristan-roth/risk-acceptance-memo/SKILL.md · Use this skill when a risk owner wants to accept a residual risk instead of treating it further, or when someone asks…

better-isms/grcskills · skills/tristan-roth/risk-method-drafting/SKILL.md · Use this skill when a company needs a written risk assessment method before it builds or rescores a register, or when…

better-isms/grcskills · skills/tristan-roth/risk-register-first-pass/SKILL.md · Use this skill when a team needs its first information security risk register, or has one that is a copied catalogue…

better-isms/grcskills · skills/tristan-roth/risk-register-hygiene-review/SKILL.md · Use this skill when an existing risk register needs a check before an audit, a management review or a new owner takes…

better-isms/grcskills · skills/tristan-roth/risk-to-control-traceability-check/SKILL.md · Use this skill when the risk register and the statement of applicability were written separately and may not agree, and…

better-isms/grcskills · skills/tristan-roth/risk-treatment-plan-drafting/SKILL.md · Use this skill when a risk register has treatment decisions but no plan anyone can execute, or when someone asks "write…

better-isms/grcskills · skills/tristan-roth/ropa-first-draft/SKILL.md · Use this skill when a company needs its record of processing activities for the first time, or has one that is really a…

better-isms/grcskills · skills/tristan-roth/scope-statement-drafting/SKILL.md · Use this skill when a team must define what its management system covers before a certification project, or its current…

better-isms/grcskills · skills/tristan-roth/secure-development-policy-from-pipeline/SKILL.md · Use this skill when an engineering team needs a secure development policy, or has one that does not match how code…

better-isms/grcskills · skills/tristan-roth/security-policy-drafting/SKILL.md · Use this skill when a company needs its information security policy set written or rebuilt, or asks "write our security…

better-isms/grcskills · skills/tristan-roth/soa-exclusion-justification-review/SKILL.md · Use this skill when a statement of applicability already exists and the team wants its exclusions to survive the audit…

better-isms/grcskills · skills/tristan-roth/soa-first-draft/SKILL.md · Use this skill when a company has a risk assessment and treatment plan and now needs its first statement of…

better-isms/grcskills · skills/tristan-roth/soa-status-reconciliation/SKILL.md · Use this skill when the implementation status column of a statement of applicability may not match reality, and the…

better-isms/grcskills · skills/tristan-roth/ssp-control-implementation-statements/SKILL.md · Use this skill when a system security plan has to be written, rebuilt or brought up to date before an assessment, and…

better-isms/grcskills · skills/tristan-roth/stage-1-readiness-walk/SKILL.md · Use this skill when a certification audit is booked and the team wants to know whether the first stage will go through…

better-isms/grcskills · skills/tristan-roth/subprocessor-register-update/SKILL.md · Use this skill when the company acts as a processor for its customers and someone asks "update our subprocessor list"…

better-isms/grcskills · skills/tristan-roth/system-categorization-first-pass/SKILL.md · Use this skill when a system enters the Risk Management Framework, or its categorization is missing, inherited from…

better-isms/grcskills · skills/tristan-roth/transfer-impact-assessment/SKILL.md · Use this skill when personal data goes, or will go, to a recipient outside the EEA, or someone asks "do we need a TIA"…

better-isms/grcskills · skills/tristan-roth/vendor-security-questionnaire-triage/SKILL.md · Use this skill when a supplier has returned a security questionnaire, assurance report, certificate or trust pack and…

better-isms/grcskills · skills/tristan-roth/vendor-tiering/SKILL.md · Use this skill when a company needs to decide how much assessment each supplier deserves, or asks "tier our vendors"…