「risk register」の検索結果

Conduct a defensible cybersecurity risk assessment using the NIST SP 800-30 Rev 1 methodology: prepare scope and a risk model, identify threat sources and threat events, identify vulnerabilities and predisposing conditions, determine likelihood and impact, compute risk, and communicate results as a prioritized risk register. Use when an organization needs an actual risk *assessment* (not a maturity score), when a control framework (CSF, ISO 27001, RMF, SOC 2, PCI) requires a documented risk analysis as input, when leadership asks "what are our top risks and how bad are they", when assessing risk for a new system or major change, or when building a risk register from scratch. This is the methodology that feeds framework selection, ATO packages, and treatment decisions. Keywords: risk assessment, NIST 800-30, threat modeling, likelihood and impact, risk register, risk analysis, threat sources, vulnerabilities, risk determination, qualitative risk, risk matrix, residual risk, risk treatment.

日本語の概要は準備中です。原文の説明を表示しています。

Conduct a defensible cybersecurity risk assessment using the NIST SP 800-30 Rev 1 methodology: prepare scope and a risk model, identify threat sources and threat events, identify vulnerabilities and predisposing conditions, determine likelihood and impact, compute risk, and communicate results as a prioritized risk register. Use when an organization needs an actual risk *assessment* (not a maturity score), when a control framework (CSF, ISO 27001, RMF, SOC 2, PCI) requires a documented risk analysis as input, when leadership asks "what are our top risks and how bad are they", when assessing risk for a new system or major change, or when building a risk register from scratch. This is the methodology that feeds framework selection, ATO packages, and treatment decisions. Keywords: risk assessment, NIST 800-30, threat modeling, likelihood and impact, risk register, risk analysis, threat sources, vulnerabilities, risk determination, qualitative risk, risk matrix, residual risk, risk treatment.

日本語の概要は準備中です。原文の説明を表示しています。

World-Class Risk Management Playbook. Use for: business continuity planning (BCP), disaster recovery (DR), scenario planning, fraud prevention & detection, reputational risk management, geopolitical risk assessment, insurance & risk transfer, crisis communication, enterprise risk management (ERM), risk registers, BIA, RTO/RPO, ISO 22301, ISO 31000, COSO ERM, NIST CSF, DORA, operational resilience, three lines of defence, risk appetite, internal controls, segregation of duties, synthetic identity fraud, deepfake fraud, AML/CFT, KYC, sanctions screening, social listening, vendor risk, geopolitical exposure mapping, parametric insurance, cyber insurance, D&O, KRIs, risk dashboards. Trigger when discussing ANY risk management, business continuity, disaster recovery, fraud prevention, reputational risk, geopolitical risk, insurance strategy, crisis management, operational resilience, or enterprise risk topic. If in doubt, use this skill.

日本語の概要は準備中です。原文の説明を表示しています。

Reads a risk register together with meeting notes and incident reports and returns a draft update pack: existing risks whose exposure, controls, ownership or status the sources say have changed, new risk candidates, closure candidates, and the one owner decision each item needs. Never assigns or changes a likelihood, impact, score or colour and never edits the register; owners decide. Use when the user asks to "update the risk register from these minutes", "refresh the register with the incidents since the last review", "reconcile the register against the notes" or "what changed on our risks". Do not use for writing up an incident itself, use incident-postmortem-drafter or data-incident-impact-brief instead; to track actions from minutes, use corrective-action-tracker. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Defensive threat modeling and risk management for your own estate — map where sensitive data lives across your asset graph, run compromise scenarios (what a hacked asset exposes, its blast radius, how you'd respond), and maintain a persistent risk register with likelihood×impact scoring, owners, mitigations, and review cadence via a deterministic CLI. All real data stays in your private USER tree; this skill is code only. USE WHEN threat model, threat modeling, risk register, risk assessment, what if X got hacked, compromise scenario, blast radius, sensitive data map, where is our sensitive data, data classification, risk review, add a risk, accept a risk, security risk posture. NOT FOR active pentesting or exploitation (use an offensive-security skill), world-scale futures stress-testing of ideas (use WorldThreatModel), or executing incident response (use your incident-response runbooks — this skill plans them).

日本語の概要は準備中です。原文の説明を表示しています。

Structured legal risk assessment with 5x5 Severity x Likelihood matrix. Use for risk scoring, risk registers, escalation decisions, and risk memos.

日本語の概要は準備中です。原文の説明を表示しています。

Act as a project-management copilot (PM/PMO) for the delivery loop: charters, plans and schedules, estimates, risk registers, status reports, scope changes, stakeholder communication, meeting actions, lessons learned, and portfolio roll-ups, in a per-project `_project/` workspace. Use whenever the user wants to start, plan, track, rescue, or report on a project: "kick off this project", "make a project plan / timeline / WBS", "what date can I commit to", "build a risk register", "run a pre-mortem", "write the weekly status report", "the deadline slipped, what now", "turn this meeting into action items", "review my project portfolio", in any language ("quản lý dự án", "gestion de projet", "プロジェクト管理", "项目管理"), even when they never say "project management". Also use whenever a `_project/` directory exists and the user asks about schedule, deadline, risk, status, scope, budget, or stakeholders. Not for what to build (product-manager) or company-level bets (strategy-board).

Maintain a centralized living risk register across projects. Use this skill when: - You need to create or update a risk register for a project or feature - You want to consolidate risks from individual specs into one register - You need to review and update risk status, mitigations, and owners - You want a cross-project risk view

日本語の概要は準備中です。原文の説明を表示しています。

Identify, score, and mitigate delivery risks for a program or release. Use when the user says "risk review", "what could go wrong", "risk register", "delivery risks for this release", "program risk assessment", "identify blockers before they hit", or wants to pressure-test a plan before committing - even if they don't say "risk review". Based on "The Phoenix Project" by Kim, Behr & Spafford (unplanned work, fragile systems, single points of failure) and "The Art of Project Management" by Scott Berkun (scoping risk, milestone pressure, hidden assumptions).

日本語の概要は準備中です。原文の説明を表示しています。

Identifies, assesses, and tracks organizational risk — building and maintaining a risk register, scoring exposure, assigning owners and treatments, and preparing for audit. Use this to stand up a risk program, assess the risk in a decision or initiative, prepare for a certification or audit, decide whether a risk should be accepted, mitigated, transferred, or avoided, or report risk posture to leadership.

日本語の概要は準備中です。原文の説明を表示しています。

Medical device risk management specialist implementing ISO 14971 throughout product lifecycle. Provides risk analysis, risk evaluation, risk control, and post-production information analysis.

日本語の概要は準備中です。原文の説明を表示しています。

RAID log methodology with decision extraction from emails and meeting notes. Use when asked to identify risks, log assumptions, track issues, extract decisions from correspondence, create or update a RAID log, escalate a risk to an issue, assess project risks, validate or challenge assumptions, or capture scope-relevant decisions. Also triggers when the user pastes email chains and asks what decisions were made, or needs to find buried decisions and untested assumptions in correspondence. Trigger on: 'risk report', 'RAID log', 'what are the risks', 'what decisions were made', 'update the risk register', 'what assumptions are we making', 'what could go wrong', 'flag any issues', 'extract decisions from these emails'.

日本語の概要は準備中です。原文の説明を表示しています。

Manages the organisational DPIA register tracking all Data Protection Impact Assessments across the enterprise. Covers DPIA lifecycle management, status tracking, review scheduling, Art. 35(11) periodic reassessment, and supervisory authority reporting. Implements a centralised register linking DPIAs to RoPA entries, risk registers, and mitigation plans. Keywords: DPIA register, DPIA tracking, Art. 35(11), review schedule, DPIA lifecycle, centralised register, DPIA portfolio management.

日本語の概要は準備中です。原文の説明を表示しています。

Quantify cyber risk using FAIR methodology with Monte Carlo simulation, assess control effectiveness against NIST CSF/CIS/ISO 27001 frameworks, evaluate risk appetite alignment, and analyze cyber insurance coverage adequacy. Covers threat landscape mapping, asset valuation, loss event frequency and magnitude estimation, annualized loss expectancy calculation, control gap analysis with ROI ranking, residual risk assessment, and insurance policy gap modeling at 90th/95th/99th percentile loss scenarios. Use when building risk registers, preparing board-level risk dashboards, evaluating security investment priorities, assessing cyber insurance coverage, or auditing any organization's risk quantification maturity per NIST RMF, ISO 27005, or FAIR standards.

日本語の概要は準備中です。原文の説明を表示しています。

Identify, assess, and mitigate operational risks. Trigger with "what are the risks", "risk assessment", "risk register", "what could go wrong", or when the user is evaluating risks associated with a project, vendor, process, or decision.

日本語の概要は準備中です。原文の説明を表示しています。

Expert DORA (Regulation (EU) 2022/2554 — Digital Operational Resilience Act) compliance advisor for EU financial entities. Use this skill whenever a user asks about DORA compliance, ICT risk management frameworks, ICT incident classification or reporting, threat-led penetration testing (TLPT), ICT third-party risk management, Register of Information, contractual provisions with ICT providers, ICT concentration risk, oversight of critical ICT third-party service providers (CTPPs), or any DORA RTS/ITS obligation. Also trigger for: "DORA gap analysis", "DORA readiness", "Art. 6 ICT risk framework", "Art. 17 incident reporting", "Art. 26 TLPT", "Art. 28 third-party policy", "Art. 30 contractual provisions", "Register of Information CIR 2024/2956", "critical TPSP designation", "DORA vs NIS2", "DORA simplified framework", or EBA/ESMA/EIOPA digital resilience guidance.

日本語の概要は準備中です。原文の説明を表示しています。

Identify, assess, and mitigate operational risks. Trigger with "what are the risks", "risk assessment", "risk register", "what could go wrong", or when the user is evaluating risks associated with a project, vendor, process, or decision.

日本語の概要は準備中です。原文の説明を表示しています。

Build and maintain a project Risk Register per PMBOK 8 Risk Performance Domain. Identify risks, assess probability and impact, define response strategies, and track residual risk. Use throughout the project lifecycle — not just at planning. Do not use for operational incident response or security vulnerability scanning.

日本語の概要は準備中です。原文の説明を表示しています。

Expert DORA (Regulation (EU) 2022/2554 — Digital Operational Resilience Act) compliance advisor for EU financial entities. Use this skill whenever a user asks about DORA compliance, ICT risk management frameworks, ICT incident classification or reporting, threat-led penetration testing (TLPT), ICT third-party risk management, Register of Information, contractual provisions with ICT providers, ICT concentration risk, oversight of critical ICT third-party service providers (CTPPs), or any DORA RTS/ITS obligation. Also trigger for: "DORA gap analysis", "DORA readiness", "Art. 6 ICT risk framework", "Art. 17 incident reporting", "Art. 26 TLPT", "Art. 28 third-party policy", "Art. 30 contractual provisions", "Register of Information CIR 2024/2956", "critical TPSP designation", "DORA vs NIS2", "DORA simplified framework", or EBA/ESMA/EIOPA digital resilience guidance.

日本語の概要は準備中です。原文の説明を表示しています。

Analyzes and describes vulnerabilities for specific assets and threats within an insurance company risk register context. The output must be highly professional, eloquent, and grammatically impressive, utilizing labelled headings and subheadings.

日本語の概要は準備中です。原文の説明を表示しています。

Manages delivery risk and cross-team dependencies — identifying, sizing, mitigating and escalating what could stop the work. Use this to build a risk register that gets used, manage dependencies between teams, decide what to escalate and when, or work out why the same risks keep materializing unmanaged.

日本語の概要は準備中です。原文の説明を表示しています。

Create a qualitative risk register and mitigation plan using a Probability x Impact matrix. Use when a project needs structured risk identification, scoring, ownership, and response planning.

日本語の概要は準備中です。原文の説明を表示しています。

Map an organisation's risks against its insurance policy portfolio to find what's uncovered, underinsured, or double-covered. Use when asked to run a coverage gap analysis, review an insurance programme against a risk register, check what risks aren't insured, or audit a policy portfolio. Produces a risk-by-coverage matrix, flagged gaps and overlaps, a deductible stack review, and recommendations ranked by expected-loss severity.

日本語の概要は準備中です。原文の説明を表示しています。

Expert ISO 27001 compliance assistant for security and compliance teams. Use this skill whenever a user asks about ISO 27001 or ISO/IEC 27001, including any of the following: gap analysis, auditing, compliance assessments, control checklists, policy writing, document generation, Statement of Applicability (SoA), risk assessment, risk registers, risk treatment plans, Annex A controls, ISMS implementation, clause requirements, certification readiness, transitioning from 2013 to 2022, control implementation guidance, incident response policies, access control policies, supplier security, or any information security management system (ISMS) topic. Trigger even if the user doesn't say "skill" — any ISO 27001 or ISMS question should use this skill.

日本語の概要は準備中です。原文の説明を表示しています。