# CISO Security Skills Claude skills for CISO-level security governance, privacy program management, compliance framework mapping, FAIR risk quantification, and executive reporting — with optional MCP server integrations for NIST CSF, SOC 2, ISO 27001, GDPR, CCPA, and 250+ frameworks. ## What's Included This repo contains three companion skills that work together to cover the full scope of enterprise security and privacy program management. ### CISO Skill (`ciso/`) A seasoned CISO advisor covering nine interconnected security governance domains: - **Policy & Procedure Authoring** — Information security policies, acceptable use, access control, data classification, encryption, and more. Structured templates with framework-aligned policy statements. - **Compliance Framework Mapping** — Cross-framework mapping and audit readiness for NIST CSF 2.0, ISO 27001, SOC 2, HIPAA, PCI-DSS v4.0, GDPR, CMMC 2.0, FedRAMP, CIS Controls v8, and NIST 800-53. - **Cloud Security Architecture** — AWS, Azure, and GCP security architecture guidance covering IAM, network security, data protection, container/serverless security, IaC scanning, and CSPM. - **Application Security Governance** — SSDLC integration, SAST/DAST/SCA tooling strategy, developer security champions programs, threat modeling governance, and API security standards. - **Risk Assessment & Management** — Qualitative and quantitative risk methodologies (FAIR, NIST 800-30, ISO 27005) with risk registers, treatment tracking, and executive risk reporting. - **Vendor & Third-Party Risk** — Vendor tiering, SIG/CAIQ questionnaires, SOC 2 report review, continuous monitoring, contract security requirements, and fourth-party risk. - **Incident Response Planning** — IR plans, severity classification, playbooks for 8 incident types (ransomware, data breach, BEC, insider threat, DDoS, supply chain, cloud compromise, phishing), tabletop exercises, and regulatory notification matrices. - **Security Awareness Programs** — Role-based training, phishing simulation design, security culture measurement, and compliance-required training programs. - **Board & Executive Reporting** — Security metrics, KPIs/KRIs, maturity scorecards, investment justification, peer benchmarking, and translating technical risk into business language. ### Risk Assessment Skill (`risk-assessment/`) A deep-dive companion skill with two user-selectable modes: - **Mode 1: FAIR Quantitative Analysis** — Factor Analysis of Information Risk with Monte Carlo simulations, loss event frequency/magnitude decomposition, sensitivity analysis, control effectiveness in dollar terms, and cyber insurance sizing. Results expressed as probability distributions (10th/50th/90th percentile). - **Mode 2: GRC Enterprise Risk Management** — Risk registers, calibrated 5×5 likelihood × impact matrices, risk heat maps, ERM program design, three lines of defense, NIST 800-30/ISO 27005/ISO 31000 processes, and KRI dashboards. Also covers specialized risk domains: third-party/supply chain risk, cloud risk, OT/ICS risk, AI/ML risk, privacy risk (FAIR Privacy methodology), and M&A cyber due diligence. ### Data Privacy Skill (`data-privacy/`) A full DPO/CPO companion skill covering privacy program governance and regulatory compliance: - **Privacy Policy & Notice Authoring** — External privacy policies, cookie/consent notices, layered notices, just-in-time notices, app store disclosures. - **Data Processing Agreements** — DPA drafting and review, SCCs as annexes, sub-processor management, controller-processor vs. controller-controller relationships. - **Regulatory Compliance Mapping** — GDPR, CCPA/CPRA, and LGPD cross-mapped so one control satisfies multiple regulations. - **Data Protection Impact Assessments** — DPIA/PIA methodology, threshold analysis, risk scoring, DPA consultation triggers. - **Data Mapping & Records of Processing** — ROPA (Art. 30), data inventory, data flow diagrams, lawful basis mapping, retention schedules. - **Data Subject Rights** — Request intake workflows, identity verification, response templates, timelines by regulation, exemptions. - **Privacy by Design & Default** — Privacy engineering patterns, data minimization, pseudonymization, anonymization, consent architecture. - **International Data Transfers** — SCCs, adequacy decisions, BCRs, transfer impact assessments, EU-US Data Privacy Framework. - **Breach Notification** — Notification timelines by regulation, risk-of-harm thresholds, DPA vs. data subject notification, templates. - **Privacy Program Governance** — DPO role and independence, privacy committee structure, training, metrics, and integration with the CISO skill. ## MCP Server Integrations (Optional) Both skills work standalone using built-in reference files. For live framework data and programmatic assessments, they integrate with three optional MCP servers: | MCP Server | What It Adds | Install | |---|---|---| | [Security Controls MCP](https://github.com/AnsvarSystems/security-controls-mcp) | Cross-maps 1,451 controls across 261 frameworks (SOC 2, ISO 27001, HIPAA, PCI-DSS, GDPR, NIST, CMMC, AI governance, and more) | `pipx install security-controls-mcp` | | [NIST CSF 2.0 Assessment Platform](https://github.com/rocklambros/nist-csf-2-mcp-server) | 740-question structured assessments, maturity scoring, gap analysis, and executive reporting with industry benchmarking | Docker — see repo | | [NIST MCP Server](https://github.com/tnicholson/nist-mcp-server) | 1,196 SP 800-53 controls with implementation guidance, plus CMMC, FedRAMP, and SP 800-171 assessments | `pip install nist-mcp-server` | When MCP servers aren't connected, the skills gracefully degrade to the built-in reference files and include a visible recommendation in deliverables telling you which servers would enhance the output. ## Installation ### Quick Start (Recommended) ```bash git clone https://github.com/RiskResponse/ciso-security-skills.git cd ciso-security-skills ./setup.sh ``` The setup script handles environment detection, skill installation (personal or project-level), optional MCP server setup, verification, and getting-started guidance. Every step is skippable and transparent. ``` Usage: ./setup.sh [OPTIONS] --non-interactive Skip all prompts, use defaults --skip-mcp Skip MCP server installation --project Install to .claude/skills/ in current directory (team install) --uninstall Remove installed skill symlinks ``` ### Manual Installation #### Claude.ai / Cowork Download this repo as a ZIP and upload all three skill folders (`ciso/`, `risk-assessment/`, `data-privacy/`) as custom skills. #### Claude Code ```bash # Personal installation (available in all projects) git clone https://github.com/RiskResponse/ciso-security-skills.git ~/.claude/skills/ciso-security-skills # Project installation (available to the team) git clone https://github.com/RiskResponse/ciso-security-skills.git .claude/skills/ciso-security-skills ``` ### With MCP Servers (recommended for compliance work) Add to your Claude Desktop or Cowork config (`claude_desktop_config.json`): ```json { "mcpServers": { "security-controls": { "command": "scf-mcp" } } } ``` See `ciso/references/mcp-integrations.md` for full setup instructions for all three servers. ## Repo Structure ``` ciso-security-skills/ ├── README.md ├── setup.sh # One-command installer ├── ciso/ │ ├── SKILL.md # Core skill (304 lines) │ ├── evals/ │ │ └── evals.json # 3 test scenarios with 21 assertions │ └── references/ │ ├── appsec-governance.md # Application security program guidance │ ├── cloud-security.md # AWS/Azure/GCP security architecture │ ├── compliance-frameworks.md # 10 framework deep-dives + cross-mapping │ ├── executive-reporting.md # Board metrics, KPIs, maturity scorecards │ ├── incident-response.md # IR plans, 8 playbooks, tabletop exercises │ ├── mcp-integrations.md # MCP server setup + workflow guide │ ├── policy-authoring.md # Policy templates + framework alignment │ ├── risk-management.md # FAIR, NIST 800-30, ISO 27005 methods │ ├── security-awareness.md # Training programs + culture measurement │ └── vendor-risk.md # TPRM program design + questionnaires ├── data-privacy/ │ ├── SKILL.md # Core skill (321 lines) — 10 domains │ ├── evals/ │ │ └── evals.json # 3 test scenarios (policy, DPA, breach) │ └── references/ │ ├── breach-notification.md # GDPR 72h, CCPA, LGPD, US state laws │ ├── data-mapping.md # ROPA, data inventory, flow diagrams │ ├── data-processing-agreements.md # DPA templates, Art. 28, SCCs │ ├── data-subject-rights.md # Rights by regulation, workflows, templates │ ├── dpia-methodology.md # DPIA/PIA methodology, threshold analysis │ ├── international-transfers.md # SCCs, adequacy, BCRs, TIAs │ ├── mcp-integrations.md # MCP workflows for privacy compliance │ ├── privacy-by-design.md # PbD principles, PETs, anonymization │ ├── privacy-policies.md # Policy templates, layered notices, cookies │ └── regulatory-compliance.md # GDPR, CCPA/CPRA, LGPD cross-mapping └── risk-assessment/ ├── SKILL.md # Core skill (219 lines) — 2 modes └── references/ ├── fair-methodology.md # Complete FAIR ontology + Monte Carlo ├── grc-risk-management.md # Qualitative matrices, ERM, KRIs ├── mcp-integrations.md # MCP integration for risk workflows ├── risk-register-templates.md # Register structure + treatment tracking └── specialized-risk.md # Cloud, OT, AI/ML, privacy, M&A risk ``` ## How the Skills Work Together The three skills form a natural hierarchy: The **CISO skill** is the primary skill for security governance work. It covers the breadth of a CISO's responsibilities and cross-references the other skills when deeper analysis is needed — risk assessment for quantitative risk work, data privacy for GDPR/CCPA/LGPD compliance. The **Risk Assessment skill** goes deep on risk methodology. Use it alongside the CISO skill when you need FAIR quantitative analysis, risk register population, or enterprise risk program design. Its FAIR Privacy methodology complements the data-privacy skill's qualitative privacy risk guidance. The **Data Privacy skill** covers DPO/CPO responsibilities — privacy policies, DPAs, DPIAs, data subject rights, international transfers, and breach notification. It cross-references the CISO skill for security controls that support privacy and the risk assessment skill for quantifying privacy risk in financial terms. Each skill works standalone. They're companions, not dependencies. Install all three for comprehensive coverage, or install only the ones relevant to your role. ## Frameworks Covered NIST CSF 2.0, NIST 800-53 Rev 5, NIST 800-30, ISO 27001:2022, ISO 27002, ISO 27005, ISO 27701, ISO 31000, SOC 2 Type II, HIPAA Security Rule, PCI-DSS v4.0, GDPR, CCPA/CPRA, LGPD, NIST Privacy Framework, CMMC 2.0, FedRAMP, CIS Controls v8, FAIR (Factor Analysis of Information Risk), and 250+ additional frameworks when the Security Controls MCP server is connected. ## Differentiation from Cybersecurity Analyst Skills These skills operate at the **governance and program-management level** — writing policies, mapping compliance frameworks, building risk programs, managing privacy programs, preparing board reports, and designing security architecture. They complement (rather than replace) technical cybersecurity analyst skills that focus on STRIDE threat modeling, MITRE ATT&CK mapping, code-level vulnerability analysis, and penetration testing execution. ## Eval Results The CISO skill includes 3 structured test scenarios covering healthcare policy authoring, vendor breach incident response, and board presentation design (21 assertions, 100% pass rate). The data-privacy skill includes 3 scenarios covering GDPR privacy policy authoring, cross-border DPA drafting, and multi-jurisdiction breach notification. ## License MIT ## Author [Risk & Response](https://github.com/RiskResponse)