「risk management」の検索結果

Conduct a defensible cybersecurity risk assessment using the NIST SP 800-30 Rev 1 methodology: prepare scope and a risk model, identify threat sources and threat events, identify vulnerabilities and predisposing conditions, determine likelihood and impact, compute risk, and communicate results as a prioritized risk register. Use when an organization needs an actual risk *assessment* (not a maturity score), when a control framework (CSF, ISO 27001, RMF, SOC 2, PCI) requires a documented risk analysis as input, when leadership asks "what are our top risks and how bad are they", when assessing risk for a new system or major change, or when building a risk register from scratch. This is the methodology that feeds framework selection, ATO packages, and treatment decisions. Keywords: risk assessment, NIST 800-30, threat modeling, likelihood and impact, risk register, risk analysis, threat sources, vulnerabilities, risk determination, qualitative risk, risk matrix, residual risk, risk treatment.

日本語の概要は準備中です。原文の説明を表示しています。

Conduct a defensible cybersecurity risk assessment using the NIST SP 800-30 Rev 1 methodology: prepare scope and a risk model, identify threat sources and threat events, identify vulnerabilities and predisposing conditions, determine likelihood and impact, compute risk, and communicate results as a prioritized risk register. Use when an organization needs an actual risk *assessment* (not a maturity score), when a control framework (CSF, ISO 27001, RMF, SOC 2, PCI) requires a documented risk analysis as input, when leadership asks "what are our top risks and how bad are they", when assessing risk for a new system or major change, or when building a risk register from scratch. This is the methodology that feeds framework selection, ATO packages, and treatment decisions. Keywords: risk assessment, NIST 800-30, threat modeling, likelihood and impact, risk register, risk analysis, threat sources, vulnerabilities, risk determination, qualitative risk, risk matrix, residual risk, risk treatment.

日本語の概要は準備中です。原文の説明を表示しています。

World-Class Risk Management Playbook. Use for: business continuity planning (BCP), disaster recovery (DR), scenario planning, fraud prevention & detection, reputational risk management, geopolitical risk assessment, insurance & risk transfer, crisis communication, enterprise risk management (ERM), risk registers, BIA, RTO/RPO, ISO 22301, ISO 31000, COSO ERM, NIST CSF, DORA, operational resilience, three lines of defence, risk appetite, internal controls, segregation of duties, synthetic identity fraud, deepfake fraud, AML/CFT, KYC, sanctions screening, social listening, vendor risk, geopolitical exposure mapping, parametric insurance, cyber insurance, D&O, KRIs, risk dashboards. Trigger when discussing ANY risk management, business continuity, disaster recovery, fraud prevention, reputational risk, geopolitical risk, insurance strategy, crisis management, operational resilience, or enterprise risk topic. If in doubt, use this skill.

日本語の概要は準備中です。原文の説明を表示しています。

Medical device risk management specialist implementing ISO 14971 throughout product lifecycle. Provides risk analysis, risk evaluation, risk control, and post-production information analysis. Use when user mentions risk management, ISO 14971, risk analysis, FMEA, fault tree analysis, hazard identification, risk control, risk matrix, benefit-risk analysis, residual risk, risk acceptability, or post-market risk.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from the DoD Risk, Issue, and Opportunity (RIO) Management Guide for Defense Acquisition Programs (OUSD R&E, Sep 2023 incl. Change 2.2). Use for the defense-acquisition mechanics of program risk management: the RIO definitions (risk/issue/opportunity), the five-step risk process (plan-identify-analyze-mitigate-monitor), 1-5 likelihood/consequence scoring and the 5x5 risk matrix, the four mitigation options (accept/avoid/transfer/control), burn-down plans, issue management (probability=1), opportunity management toward should-cost, cross-program/interface risk, tailoring RIO to the six AAF acquisition pathways (UCA/MTA/MCA/Software/DBS/Services), specialized methods (RMF, MBCRA/Cyber Table Top, Agile metrics, FMECA, ITRA/DTRAM), and institutionalizing RIO via the PRMP, boards (RMB/JRMB/ROMB/RWG), tools, tiered roles, and WBS/IMP/IMS/EVM/TPM integration. This is the DoD-acquisition complement to nasa-risk (general CRM/RIDM theory) and dau-se-guidebook (the SE process frame). Does NOT teach general risk theory from scratch, and defers specialized risk regimes (system safety/ESOH, HSI, detailed cyber/RMF, spectrum) to their own DoD instructions and the relevant packs.

日本語の概要は準備中です。原文の説明を表示しています。

"Enterprise risk management (ERM) framework layer — integrates COSO ERM 2017 (five components, 20 principles), ISO 31000, three-lines model, risk appetite, risk heatmap, and key risk indicators (KRI) into a complete governance playbook covering structure through culture. Use for ERM implementation, risk-system build, risk mapping, risk-appetite statement drafting, three-lines setup, CRO role design, or Taiwan FSC corporate-governance evaluation response. Triggers: 『ERM 導入』『風險管理框架』『COSO』『風險地圖』『風險胃納』『KRI』『CRO 職責』『三道防線』『風險委員會』『ISO 31000』『風險熱圖』『風險治理』. For 師大／政大／陽交 EMBA risk-management/governance/audit cases. Complements Asgard `algo-risk-*` (Altman Z, Benford, credit, VaR) with the framework/governance layer. 獨董挑選/董事會組成/IPO 治理: use `biz-corporate-governance`.".

日本語の概要は準備中です。原文の説明を表示しています。

Act as a project-management copilot (PM/PMO) for the delivery loop: charters, plans and schedules, estimates, risk registers, status reports, scope changes, stakeholder communication, meeting actions, lessons learned, and portfolio roll-ups, in a per-project `_project/` workspace. Use whenever the user wants to start, plan, track, rescue, or report on a project: "kick off this project", "make a project plan / timeline / WBS", "what date can I commit to", "build a risk register", "run a pre-mortem", "write the weekly status report", "the deadline slipped, what now", "turn this meeting into action items", "review my project portfolio", in any language ("quản lý dự án", "gestion de projet", "プロジェクト管理", "项目管理"), even when they never say "project management". Also use whenever a `_project/` directory exists and the user asks about schedule, deadline, risk, status, scope, budget, or stakeholders. Not for what to build (product-manager) or company-level bets (strategy-board).

Use when a practitioner needs to classify the risk level of an upcoming Salesforce deployment, define rollback trigger conditions, or assign decision authority before the release window opens. Triggers: 'how risky is this release', 'what needs rollback planning', 'classify deployment risk', 'pre-deployment risk checklist', 'rollback decision authority', 'high risk metadata types'. NOT for executing the deployment itself, writing CI/CD pipeline code, or troubleshooting failures after a deployment has already run — use admin/change-management-and-deployment for execution planning and devops/deployment-error-troubleshooting for post-failure diagnosis.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from NASA Risk Management Handbook (NASA/SP-2011-3422). Use for risk-informed decision making, continuous risk management, performance commitments, risk scenario diagrams, risk disposition types, risk burn-down schedules, objectives hierarchies, deliberation and alternative selection, risk driver identification, and RM planning for space and safety-critical programmes. Does not cover domain-specific PRA methods (fault trees, event trees) in procedural depth — see NASA PRA Procedures Guide for those.

日本語の概要は準備中です。原文の説明を表示しています。

Defensive threat modeling and risk management for your own estate — map where sensitive data lives across your asset graph, run compromise scenarios (what a hacked asset exposes, its blast radius, how you'd respond), and maintain a persistent risk register with likelihood×impact scoring, owners, mitigations, and review cadence via a deterministic CLI. All real data stays in your private USER tree; this skill is code only. USE WHEN threat model, threat modeling, risk register, risk assessment, what if X got hacked, compromise scenario, blast radius, sensitive data map, where is our sensitive data, data classification, risk review, add a risk, accept a risk, security risk posture. NOT FOR active pentesting or exploitation (use an offensive-security skill), world-scale futures stress-testing of ideas (use WorldThreatModel), or executing incident response (use your incident-response runbooks — this skill plans them).

日本語の概要は準備中です。原文の説明を表示しています。

Expert NIST AI Risk Management Framework (AI RMF 1.0) advisor covering all four functions: GOVERN, MAP, MEASURE, MANAGE. Use this skill whenever a user asks about NIST AI RMF, AI risk management, AI trustworthiness, GOVERN function, MAP function, MEASURE function, MANAGE function, AI RMF Playbook, AI risk profiles, responsible AI, AI bias management, AI transparency, AI explainability, AI reliability, AI safety, NIST AI 100-1, AI risk assessment, AI incident response, or alignment to EU AI Act, ISO 42001, or NIST CSF via AI RMF. Trigger even if the user doesn't say "skill" — any NIST AI RMF or AI governance risk question should use this skill.

日本語の概要は準備中です。原文の説明を表示しています。

Medical device risk management specialist implementing ISO 14971 throughout product lifecycle. Provides risk analysis, risk evaluation, risk control, and post-production information analysis.

日本語の概要は準備中です。原文の説明を表示しています。

Conducts HIPAA risk analysis per 45 CFR §164.308(a)(1) following OCR guidance methodology. Covers threat identification, vulnerability assessment, likelihood and impact determination, risk scoring, and mitigation planning for electronic protected health information. Keywords: HIPAA risk analysis, OCR guidance, threat assessment, vulnerability, risk management, ePHI.

日本語の概要は準備中です。原文の説明を表示しています。

Identify, score, and mitigate delivery risks for a program or release. Use when the user says "risk review", "what could go wrong", "risk register", "delivery risks for this release", "program risk assessment", "identify blockers before they hit", or wants to pressure-test a plan before committing - even if they don't say "risk review". Based on "The Phoenix Project" by Kim, Behr & Spafford (unplanned work, fragile systems, single points of failure) and "The Art of Project Management" by Scott Berkun (scoping risk, milestone pressure, hidden assumptions).

日本語の概要は準備中です。原文の説明を表示しています。

Expert ISO 42001 AI Management System (AIMS) compliance advisor. Use this skill whenever a user asks about ISO/IEC 42001:2023, AI governance, AI management systems, AI risk assessment, AI system impact assessment, Annex A controls for AI, Statement of Applicability for AI systems, AI policy, responsible AI, AI lifecycle management, AI incident management, AI transparency, AI bias, AI certification readiness, or any topic related to implementing or auditing an AI Management System. Also trigger for questions like "how do I become ISO 42001 certified?", "what controls does ISO 42001 require?", "how do I assess AI risk under 42001?", "what is an AIMS?", or any request involving organisational governance of AI systems, responsible AI frameworks, or AI regulatory compliance aligned to an ISO standard.

日本語の概要は準備中です。原文の説明を表示しています。

Expert NIST AI Risk Management Framework (AI RMF 1.0) advisor covering all four functions: GOVERN, MAP, MEASURE, MANAGE. Use this skill whenever a user asks about NIST AI RMF, AI risk management, AI trustworthiness, GOVERN function, MAP function, MEASURE function, MANAGE function, AI RMF Playbook, AI risk profiles, responsible AI, AI bias management, AI transparency, AI explainability, AI reliability, AI safety, NIST AI 100-1, AI risk assessment, AI incident response, or alignment to EU AI Act, ISO 42001, or NIST CSF via AI RMF. Trigger even if the user doesn't say "skill" — any NIST AI RMF or AI governance risk question should use this skill.

日本語の概要は準備中です。原文の説明を表示しています。

Apply the NIST AI Risk Management Framework (AI RMF 1.0) and adjacent guidance to AI / ML systems — model lifecycle governance, fairness and bias evaluation, robustness, transparency, accountability, third-party model risk, monitoring for drift, and AI incident response. Broader than prompt-injection (which is the security slice). Use when the user mentions 'AI risk,' 'AI governance,' 'NIST AI RMF,' 'AI compliance,' 'ML governance,' 'model risk management,' 'AI fairness,' 'AI bias,' 'algorithmic accountability,' 'AI Bill of Rights,' 'EU AI Act,' 'AI transparency,' 'model card,' 'AI red team,' 'AI safety,' 'responsible AI,' 'model drift,' 'concept drift,' 'AI monitoring,' 'AI incident,' or needs to assess or govern an AI / ML system.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from NIST SP 800-37 Revision 2, the Risk Management Framework (RMF) for information systems and organizations. Use for the seven RMF steps (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor) and their tasks; the three-tier organization-wide risk model; authorization boundaries; the requirements-to-controls relationship; security categorization (FIPS 199/200 high-water mark) and control selection/tailoring (SP 800-53/53B baselines); assessment, the authorization decision and risk acceptance, continuous monitoring and ongoing authorization; the security/privacy distinction; and supply chain risk management. This is the security-and-privacy-risk-governance edge of systems engineering — it governs how much protection and whether to accept residual risk, complementing the disciplines that decide how protection is built. Does NOT reproduce the SP 800-53 control catalog or its baselines, the FIPS impact tables, or the ISO/IEC/IEEE 15288 process text; it names and routes to them rather than restating them.

日本語の概要は準備中です。原文の説明を表示しています。

Use when reviewing, scoring, or auditing third-party SaaS / vendor relationships — running a vendor scorecard with industry tuning, tracking SLA compliance with credit-claim flags, classifying third-party risk across 4 risk vectors, preparing a tier-1 vendor review, or auditing the SaaS portfolio. Forks context so large vendor catalogs (50-500 line items) and SLA logs don't pollute the parent thread. Triggers on "vendor SLA", "vendor scorecard", "third-party risk", "TPRM", "vendor review", "supplier performance", "vendor health check", "renewal review".

日本語の概要は準備中です。原文の説明を表示しています。

Expert DORA (Regulation (EU) 2022/2554 — Digital Operational Resilience Act) compliance advisor for EU financial entities. Use this skill whenever a user asks about DORA compliance, ICT risk management frameworks, ICT incident classification or reporting, threat-led penetration testing (TLPT), ICT third-party risk management, Register of Information, contractual provisions with ICT providers, ICT concentration risk, oversight of critical ICT third-party service providers (CTPPs), or any DORA RTS/ITS obligation. Also trigger for: "DORA gap analysis", "DORA readiness", "Art. 6 ICT risk framework", "Art. 17 incident reporting", "Art. 26 TLPT", "Art. 28 third-party policy", "Art. 30 contractual provisions", "Register of Information CIR 2024/2956", "critical TPSP designation", "DORA vs NIS2", "DORA simplified framework", or EBA/ESMA/EIOPA digital resilience guidance.

日本語の概要は準備中です。原文の説明を表示しています。

Expert ISO 42001 AI Management System (AIMS) compliance advisor. Use this skill whenever a user asks about ISO/IEC 42001:2023, AI governance, AI management systems, AI risk assessment, AI system impact assessment, Annex A controls for AI, Statement of Applicability for AI systems, AI policy, responsible AI, AI lifecycle management, AI incident management, AI transparency, AI bias, AI certification readiness, or any topic related to implementing or auditing an AI Management System. Also trigger for questions like "how do I become ISO 42001 certified?", "what controls does ISO 42001 require?", "how do I assess AI risk under 42001?", "what is an AIMS?", or any request involving organisational governance of AI systems, responsible AI frameworks, or AI regulatory compliance aligned to an ISO standard.

日本語の概要は準備中です。原文の説明を表示しています。

Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.

日本語の概要は準備中です。原文の説明を表示しています。

You launched an ambassador program. 3 applications. One ghosted after week 2. Should you lower the bar? Offer more perks? Spam influencers? This gives you the complete community & ambassador operations SOP — from pre-launch checklist to recruitment to tiered management to retention to governance. Built from Notion (20M users, real ambassador interviews), AFFiNE (60K stars), Asana, and ClickUp programs. By @WeiYipei. What's inside: • Pre-launch readiness checklist (6 conditions that must be true before starting) • 6-step community setup SOP (platform selection → rules → admin standards → monitoring → wiki → metrics) • Ambassador recruitment system (A+B qualification, application form design, scoring rubric) • 4-tier progression system (Bronze → Silver → Gold → Platinum with point thresholds) • 5-pillar incentive framework (Product quality → Beta access → Founder access → KOL path → Full engagement) • Churn early-warning system + retention playbook • Event operations SOP (6 event types × full lifecycle) • Health metrics dashboard (6 core KPIs + 5 ambassador-specific indicators) • Governance & risk control (behavior code, escalation matrix) • Real templates: recruitment post, welcome email, annual calendar 🇨🇳 你搞了个大使计划。来了3个申请。一个第二周就消失了。该降门槛？加福利？群发KOL？这份SOP给你从启动前置条件到招募到留存到治理的完整社区/大使运营方法论。基于 Notion（2000万用户，大使真实访谈）、AFFiNE（60K stars）、Asana、ClickUp 实战案例。 🇯🇵 アンバサダープログラムを立ち上げた。応募3件。1人は2週間で消えた。基準を下げる？特典を増やす？このSOPは、事前チェックリストから採用、段階管理、リテンション、ガバナンスまでの完全なコミュニティ＆アンバサダー運営フレームワークを提供します。Notion（2000万ユーザー）、AFFiNE（60K stars）の実例から構築。 🇰🇷 앰배서더 프로그램을 시작했습니다. 지원 3건. 하나는 2주 만에 사라졌습니다. 기준을 낮출까요? 이 SOP는 사전 체크리스트부터 모집, 단계별 관리, 리텐션, 거버넌스까지 완전한 커뮤니티 & 앰배서더 운영 프레임워크를 제공합니다. Notion(2000만 사용자), AFFiNE(60K stars) 실전 사례에서 구축. Triggers: "ambassador program" | "community building" | "community management" | "DevRel" | "developer relations" | "community growth" | "大使计划" | "社区运营" | "社区搭建" | "コミュニティ運営" | "アンバサダー" | "커뮤니티 운영" | "앰배서더" | "open source community" | "user retention"

Knowledge base from the FAA Systems Engineering Manual (SEM) v1.0.1. Use for civil-agency systems engineering as the FAA practices it inside the Acquisition Management System (AMS) and the National Airspace System (NAS): the five-phase AMS lifecycle and its decision points; operational concept development and implementation-free functional analysis (ConOps, FFBD/N², CMLs); requirements analysis and architectural design synthesis (PRS→MRS, the PRD ratchet pPRD→iPRD→fPRD, RAM, ISEF/DoDAF views, CPRs); the seven technical management disciplines (Integrated Technical Management/SEMP, Interface Management/IRD-ICD, Risk-Issue-Opportunity, Configuration Management, SE Information Management, Decision Analysis, Verification & Validation); and the specialty disciplines (RMA via Service Threads/STLSC, Life Cycle Engineering, E3/Spectrum, Human Factors, Information Security via the NIST RMF, System Safety via the SMS, and Hazardous Materials/Environmental/EOSH). Scope limits: this is FAA-specific guidance, not policy — it is a tailorable menu that points outward to companion handbooks (FAA-HDBK-006A for RMA, the SMS Manual, the NIST 800-series) rather than restating generic SE theory; it is thin on detailed cost estimating, contracting/FAR law, software-development methodology, named anti-pattern catalogues, and any non-FAA or non-civil-aviation lifecycle. Source has no page numbers in the extracted text (~360 pp.).

日本語の概要は準備中です。原文の説明を表示しています。