Testing & Security skills

Use this skill when the implementation status column of a statement of applicability may not match reality, and the team asks "is our SoA accurate", "check the implemented column", "do we have evidence for every implemented control", "reconcile the SoA with our evidence", "pre-audit evidence check" or "the auditor found a control marked implemented with no records". Samples the records behind every control marked implemented, grades the evidence, proposes a corrected status for each row and writes a reconciliation table plus an evidence gap list with owners.

The English summary is being prepared. Showing the original description.

Use this skill when an engineering team needs a secure development policy, or has one that does not match how code really ships, and asks "write our secure SDLC policy", "secure development policy from our CI", "document our code review and scanning for the audit", "what does our pipeline already enforce", "change management for engineers" or "secure coding policy for SOC 2 or CRA". Reads the repositories and pipeline definitions, inventories what is actually enforced (reviews, checks, scanners, deploy gates, dependency and secret controls), and writes a policy whose every "must" points to the place it is enforced, with gaps listed as decisions.

The English summary is being prepared. Showing the original description.

Use this skill when a company needs its internal audit programme for the certification or examination cycle, or asks "plan our internal audits", "internal audit schedule for the year", "audit programme for the three-year cycle", "who can do our internal audit", "we are too small for an independent auditor", "readiness audit before the examination" or "which areas do we audit first". Ranks audit areas by risk, change and past findings, sets how often each is audited across the cycle, assigns auditors who are independent of what they audit, sizes the effort, and writes a programme, a coverage matrix and a calendar for leadership to approve.

The English summary is being prepared. Showing the original description.

Use this skill when an internal auditor has one process or area to audit and needs a working checklist built from the company's own documents, or asks "build an internal audit checklist", "audit questions for access management", "what do I test in the supplier process", "audit plan for this area", "how many samples should I take", "internal audit of our data protection process" or "test our incident process against what the policy says". Turns each commitment in the company's policies and procedures into a test with a question, a record to inspect, a sample and a pass criterion, adds framework-specific checks through a lookup, and writes a checklist file the auditor fills in during fieldwork.

The English summary is being prepared. Showing the original description.

Use this skill when an existing risk register needs a check before an audit, a management review or a new owner takes it over, or when someone asks "clean up our risk register", "is our risk register any good", "review the risk register before the audit", "our risks have not been updated", "find duplicate risks", "who owns these risks" or "the scores look wrong". Reads the register read-only and finds stale, duplicated, unowned, orphaned and mis-scored entries, risks missing given the company's own incidents and findings, and expired acceptances, then writes a findings file with a proposed fix per line for the owners to decide.

The English summary is being prepared. Showing the original description.

Use this skill when a company has no incident response plan, has one copied from a template that names teams it does not have, or an auditor, customer or insurer asks for it, and the team says "write our incident response plan", "IR plan", "security incident procedure", "who does what in an incident", "incident playbooks", "contact tree for incidents" or "our plan failed in the last incident". Drafts a plan sized to the company with roles and deputies, a severity scale, a contact tree with an out-of-band channel, one-page playbooks for the likely scenarios, evidence handling and a notification decision step, plus a one-page quick reference card.

The English summary is being prepared. Showing the original description.

Use this skill when a team suspects its policies describe a company that does not exist, before an audit or customer review, or asks "do our policies match what we actually do", "check the policy against reality", "paper versus practice", "will the auditor find gaps in our policies", "our policy says quarterly but we never do it" or "align policies with how we work". Turns each policy into testable statements, samples the systems and records that show the practice, classifies every gap and proposes whether to fix the policy or the practice, with owners and priorities.

The English summary is being prepared. Showing the original description.

Use this skill when a bank, payment or e-money institution, investment firm, insurer, crypto-asset service provider or other financial entity in scope of DORA needs to know whether its ICT risk management setup holds up, or when someone asks "DORA gap analysis", "are we DORA compliant on ICT risk", "check our ICT risk management framework", "prepare for the supervisor's DORA review", "does our ISO 27001 ISMS cover DORA" or "audit our Article 6 framework". Confirms the entity type and whether the simplified regime applies, maps the entity's own documents and records against the ICT risk management articles, and writes a gap list with owners, evidence and priorities.

The English summary is being prepared. Showing the original description.

Use this skill when a data processing agreement is being negotiated or renewed and someone asks "review the TOMs annex", "check the security measures in this DPA", "can we sign this annex", "the customer sent their DPA with a security schedule", "is our standard annex still true" or "does this vendor's annex promise enough". Breaks the technical and organisational measures annex into single commitments, compares each one with what the company actually runs or with what the use case needs, and writes a line-by-line review, proposed redlines and a list of practice gaps for owners.

The English summary is being prepared. Showing the original description.

Use this skill when a team needs its first information security risk register, or has one that is a copied catalogue nobody owns, and asks "build our risk register", "draft a risk assessment", "what are our top risks", "risk register from scratch", "our auditor wants a risk assessment" or "turn our incidents and findings into risks". Drafts 20 to 40 company-specific risk scenarios from the material the agent can reach, scores them against an agreed method, proposes owners and treatments, and writes a CSV register plus a notes file of assumptions and questions for owners.

The English summary is being prepared. Showing the original description.

Use this skill when an incident or a serious near miss is closed and the team must learn from it, or an auditor asks for lessons learned, and someone says "run the post-mortem", "post-incident review", "lessons learned", "retro on the outage", "blameless review", "root cause of the incident" or "what do we change after this breach". Builds the timeline from records before the meeting, runs a blameless discussion, finds the contributing factors, and turns them into a few owned, dated actions linked to updates of the risk register, controls, playbooks and supplier records, then writes the review and an action tracker.

The English summary is being prepared. Showing the original description.

Use this skill when a company with a security applicability statement extends its management system to privacy or to AI, and asks "extend our SoA for privacy", "which privacy controls apply to a processor", "AI controls applicability", "SoA for our AI management system", "are we controller or processor for this" or "do the AI development controls apply if we only use a model". Settles the company's role per processing activity and per AI system, decides applicability of the additional controls from those roles and the risk or impact assessments, and writes an extension to the applicability statement plus role and scope notes.

The English summary is being prepared. Showing the original description.

Use this skill when an incident may have to be reported to an authority, customers or affected people, and the team asks "do we have to notify", "72 hours", "24 hour early warning", "is this a notifiable breach", "major incident report", "who do we tell and by when", "draft the breach notification" or "do we tell the customers". Fixes the facts and the awareness time, tests each regime and contract that may apply, builds one table of recipients and deadlines with the earliest first, drafts each notification for review, and records the reasoning for every decision not to notify.

The English summary is being prepared. Showing the original description.

Use this skill when one AI system needs its impact on people and on the company assessed before launch, after a significant change, or because a customer, auditor or regulator asks for it, and the team says "AI impact assessment", "assess the impact of this model", "fundamental rights impact assessment", "who could this AI harm", "bias assessment before launch" or "sign-off for the AI feature". Describes the system in its context, works through impacts on the people it affects with evidence, sizes them, proposes mitigations with measurable triggers, and writes one assessment ready for the system owner and an accountable executive to sign.

The English summary is being prepared. Showing the original description.

Use this skill when a risk owner wants to accept a residual risk instead of treating it further, or when someone asks "write a risk acceptance", "we want to accept this risk", "risk exception form", "document the risk acceptance for the auditor", "security exception for this system", "can we sign off this risk" or "management accepted the risk, how do we record it". Drafts a one-page decision record per risk: the risk and its score, the options considered with cost, why acceptance is reasonable, compensating measures with evidence, conditions, expiry and the triggers that reopen it, with a signature block for the person who holds the authority.

The English summary is being prepared. Showing the original description.

Use this skill when the company is about to buy, renew or switch on an AI product or an AI feature inside an existing product, and asks "assess this AI vendor", "do they train on our data", "AI supplier questionnaire", "review the AI terms", "can we use this model provider with customer data", "who are the subprocessors behind this AI tool" or "AI vendor risk assessment". Sizes the review to the use, reads the terms, data processing agreement and documentation before asking questions, checks training use, retention, model changes, subprocessors, transfers, security and exit, and writes an assessment with a recommendation plus the follow-up questions for the vendor.

The English summary is being prepared. Showing the original description.

Use this skill when a company that already runs a security management system wants to add an AI management system, or is preparing for an AI governance certification, and asks "scope our AI management system", "what should the AIMS cover", "AI governance roles", "who owns AI governance", "extend our ISMS to AI" or "write the AI management system scope statement". Decides which AI systems, roles, teams and lifecycle stages are in, maps interfaces and dependencies, reuses the processes the security system already runs, assigns roles with a RACI, and writes the scope statement, the roles file and the open questions for leadership.

The English summary is being prepared. Showing the original description.

Use this skill when someone wants to know where to start with the grcskills library, or asks "review my GRC setup", "what should I fix before the audit", "which compliance skills do I need", "audit my ISMS folder", "give me a 30-day compliance plan" or "rank the skills for my company". Reads the frontmatter of every skill in the library, inspects the compliance material the agent can reach (repo, policy folder, registers, platform exports), ranks the 10 skills that would help most with impact, effort and evidence for each, audits what is broken, duplicated or missing, and writes a 30-day plan to files in a grc-setup-review folder. Read-only on everything else.

The English summary is being prepared. Showing the original description.

Use this skill when a periodic user access review is due, an auditor asked for access review evidence, or someone says "prepare the access review", "run the quarterly user recertification", "who still has admin", "check leavers still have access", "build the access review sheets for managers" or "our last review was a rubber stamp". Picks the systems in scope, builds account populations reconciled against HR, pre-flags leavers, orphans, shared and dormant accounts, assigns independent reviewers, defines the decisions to record, and plans the removal follow-up.

The English summary is being prepared. Showing the original description.

Use this skill when leadership is due to review the security, privacy or AI management system, or when someone asks "prepare the management review", "management review agenda", "board pack for the ISMS", "write the management review minutes", "what metrics do we show leadership", "the auditor wants evidence of management review" or "our management review is a slide nobody reads". Assembles the facts leadership needs from the registers, audits, incidents and metrics, frames each agenda item as a decision with options, checks coverage against the framework with a lookup, and drafts the pre-read, the agenda and minutes with a decision and action log.

The English summary is being prepared. Showing the original description.

Use this skill when a company needs rules for how staff use company systems, data, devices and AI tools, or asks "write our acceptable use policy", "AUP for employees", "can staff use ChatGPT at work", "AI usage policy", "BYOD rules", "remote work security rules" or "a policy people will actually read". Finds how people really work (devices, apps, AI tools, travel), puts the choices to the reader as decisions, drafts a short plain-language policy with concrete do and do not examples, and adds a comprehension check and an acknowledgement text for onboarding.

The English summary is being prepared. Showing the original description.

Use this skill when a company starts a compliance programme and needs to know how far it is from a framework, and asks "run a gap analysis", "how ready are we for the audit", "baseline us against the framework", "what do we have and what is missing", "readiness assessment before we hire an auditor" or "how long until we can certify". Baselines what exists against the chosen framework from documents and records, rates each item by evidence rather than opinion, sizes every gap by effort and audit risk, and writes a gap register plus a prioritised summary with the long-lead items first.

The English summary is being prepared. Showing the original description.

Use this skill when a restore test is due, an auditor or customer asks for proof that backups can be recovered, or someone says "plan a restore test", "prove we can recover in time", "our backups succeed but we never restored", "test our RTO and RPO", "write up the disaster recovery test" or "document the backup restore for the audit". Picks what to restore, writes a test plan with success criteria set before the test, records timings against the recovery objectives, and produces a signed-off test record with the issues found and their owners.

The English summary is being prepared. Showing the original description.

Use this skill when a company must work out where each of its AI systems sits under the EU AI Act, and asks "is this high-risk", "classify our AI systems", "AI Act risk tier", "are we a provider or a deployer", "does Annex III apply to us", "is this a prohibited practice", "what does the AI Act mean for our chatbot" or "which AI Act obligations do we have". Tests each system, one at a time, for scope, role, prohibited practices, the two high-risk routes, the narrow exemption, transparency duties and general-purpose models, and writes a reasoned classification record per system plus a summary table of resulting obligations to confirm with whoever owns legal interpretation.

The English summary is being prepared. Showing the original description.