测试与安全技能

Use this skill when an internal or external audit raised a nonconformity, finding, exception or observation and the team must answer it, or asks "write the corrective action plan", "root cause for this audit finding", "respond to the major nonconformity", "CAPA for the auditor", "how do we close this finding" or "the auditor rejected our corrective action". Separates correction from corrective action, runs a root cause analysis that stops at a cause the company controls, checks for the same problem elsewhere, and drafts a response with actions, owners, dates and the evidence that will prove effectiveness at the next audit.

中文简介正在准备中。当前显示原文说明。

Use this skill when an external audit, attestation examination or assessment is coming and the team wants populations and evidence ready for the samples the auditor will pull, or asks "prepare for audit sampling", "what samples will the auditor ask for", "get our populations ready", "the auditor wants a list of all changes in the period", "evidence for the leavers sample", "Type II sample prep" or "how do we prove completeness of the population". Lists the populations an auditor is likely to sample, builds each from the system of record with the query that produced it, checks completeness and the evidence behind a dry-run sample, and writes a readiness file per population plus a list of gaps to fix before fieldwork.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company that already runs a security management system wants to add an AI management system, or is preparing for an AI governance certification, and asks "scope our AI management system", "what should the AIMS cover", "AI governance roles", "who owns AI governance", "extend our ISMS to AI" or "write the AI management system scope statement". Decides which AI systems, roles, teams and lifecycle stages are in, maps interfaces and dependencies, reuses the processes the security system already runs, assigns roles with a RACI, and writes the scope statement, the roles file and the open questions for leadership.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company starts a compliance programme and needs to know how far it is from a framework, and asks "run a gap analysis", "how ready are we for the audit", "baseline us against the framework", "what do we have and what is missing", "readiness assessment before we hire an auditor" or "how long until we can certify". Baselines what exists against the chosen framework from documents and records, rates each item by evidence rather than opinion, sizes every gap by effort and audit risk, and writes a gap register plus a prioritised summary with the long-lead items first.

中文简介正在准备中。当前显示原文说明。

Use this skill when an audit, attestation period or customer review is coming and someone asks "is our evidence up to date", "check the evidence folder before the auditor sees it", "which screenshots are stale", "do we have evidence for the whole period", "find undated evidence" or "what will the auditor reject". Indexes every evidence artefact with the date inside it, its owner and the period it covers, flags what is stale, undated, unowned, outside the audit period or missing for a recurring activity, and writes an index plus a refresh list per owner.

中文简介正在准备中。当前显示原文说明。

Use this skill when someone wants to know where to start with the grcskills library, or asks "review my GRC setup", "what should I fix before the audit", "which compliance skills do I need", "audit my ISMS folder", "give me a 30-day compliance plan" or "rank the skills for my company". Reads the frontmatter of every skill in the library, inspects the compliance material the agent can reach (repo, policy folder, registers, platform exports), ranks the 10 skills that would help most with impact, effort and evidence for each, audits what is broken, duplicated or missing, and writes a 30-day plan to files in a grc-setup-review folder. Read-only on everything else.

中文简介正在准备中。当前显示原文说明。

Use this skill when a bank, payment or e-money institution, investment firm, insurer, crypto-asset service provider or other financial entity in scope of DORA needs to know whether its ICT risk management setup holds up, or when someone asks "DORA gap analysis", "are we DORA compliant on ICT risk", "check our ICT risk management framework", "prepare for the supervisor's DORA review", "does our ISO 27001 ISMS cover DORA" or "audit our Article 6 framework". Confirms the entity type and whether the simplified regime applies, maps the entity's own documents and records against the ICT risk management articles, and writes a gap list with owners, evidence and priorities.

中文简介正在准备中。当前显示原文说明。

Use this skill when a new product feature, vendor, AI use, monitoring tool or change in processing raises the question "do we need a DPIA", or someone asks "DPIA screening", "is this high risk processing", "data protection impact assessment threshold", "privacy impact screening for this feature", "does our AI feature need a DPIA" or "document why we did not do a DPIA". Describes the processing with numbers, tests it against the GDPR cases, the supervisory authority's list and the EDPB-endorsed criteria, reaches a reasoned outcome (required, recommended, not required) with a re-screen trigger, and keeps a screening log for accountability.

中文简介正在准备中。当前显示原文说明。

Use this skill when an auditor will test change management, or the team wants to know before they do, and asks "sample our production changes", "check our PR approvals", "do we have segregation of duties on deploys", "test change management before the audit", "were emergency changes approved" or "can a developer push to production alone". Builds the change population from what actually reached production, reconciles it with tickets and pull requests, draws a recorded sample, tests approval, testing, segregation and emergency attributes, and writes the results and the exceptions as facts.

中文简介正在准备中。当前显示原文说明。

Use this skill when a periodic user access review is due, an auditor asked for access review evidence, or someone says "prepare the access review", "run the quarterly user recertification", "who still has admin", "check leavers still have access", "build the access review sheets for managers" or "our last review was a rubber stamp". Picks the systems in scope, builds account populations reconciled against HR, pre-flags leavers, orphans, shared and dormant accounts, assigns independent reviewers, defines the decisions to record, and plans the removal follow-up.

中文简介正在准备中。当前显示原文说明。

Use this skill when controls have no clear owner, or "security" owns everything, and the team asks "who owns each control", "build a RACI for our controls", "assign control owners", "nobody knows who runs the access review", "set a review cadence per control" or "the auditor asked who is accountable". Assigns one accountable role and the operators to every applicable control, checks workload and segregation of duties, sets a review cadence from how each control runs, and writes a RACI table plus a one-page brief per owner role.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company needs rules for how staff use company systems, data, devices and AI tools, or asks "write our acceptable use policy", "AUP for employees", "can staff use ChatGPT at work", "AI usage policy", "BYOD rules", "remote work security rules" or "a policy people will actually read". Finds how people really work (devices, apps, AI tools, travel), puts the choices to the reader as decisions, drafts a short plain-language policy with concrete do and do not examples, and adds a comprehension check and an acknowledgement text for onboarding.

中文简介正在准备中。当前显示原文说明。

Use this skill when a risk register has treatment decisions but no plan anyone can execute, or when someone asks "write the risk treatment plan", "turn the risk register into actions", "what do we do about our high risks", "treatment plan for the auditor", "budget the security roadmap from the risks" or "our treatment plan is just a list of controls". Turns each reduce, avoid or transfer decision into dated actions with an owner, budget, dependency and the record that will prove it was done, states the expected residual score and why, and adds interim measures for risks that stay high while the work runs. Writes a CSV plan and a short notes file.

中文简介正在准备中。当前显示原文说明。

Use this skill when a data processing agreement is being negotiated or renewed and someone asks "review the TOMs annex", "check the security measures in this DPA", "can we sign this annex", "the customer sent their DPA with a security schedule", "is our standard annex still true" or "does this vendor's annex promise enough". Breaks the technical and organisational measures annex into single commitments, compares each one with what the company actually runs or with what the use case needs, and writes a line-by-line review, proposed redlines and a list of practice gaps for owners.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company has no incident response plan, has one copied from a template that names teams it does not have, or an auditor, customer or insurer asks for it, and the team says "write our incident response plan", "IR plan", "security incident procedure", "who does what in an incident", "incident playbooks", "contact tree for incidents" or "our plan failed in the last incident". Drafts a plan sized to the company with roles and deputies, a severity scale, a contact tree with an out-of-band channel, one-page playbooks for the likely scenarios, evidence handling and a notification decision step, plus a one-page quick reference card.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company must work out where each of its AI systems sits under the EU AI Act, and asks "is this high-risk", "classify our AI systems", "AI Act risk tier", "are we a provider or a deployer", "does Annex III apply to us", "is this a prohibited practice", "what does the AI Act mean for our chatbot" or "which AI Act obligations do we have". Tests each system, one at a time, for scope, role, prohibited practices, the two high-risk routes, the narrow exemption, transparency duties and general-purpose models, and writes a reasoned classification record per system plus a summary table of resulting obligations to confirm with whoever owns legal interpretation.

中文简介正在准备中。当前显示原文说明。

Use this skill when process owners, engineers or executives will be interviewed in an external or internal audit and need to be ready, or when someone asks "prepare the team for the auditor interviews", "what will the auditor ask our CTO", "interview briefing for the audit", "how should people answer the auditor", "mock audit interviews" or "our engineers are nervous about the audit". Builds a one-page brief per role: what the auditor is likely to ask, the records that person should be able to open, the honest way to answer what they do not know, and a short mock interview, plus an interview schedule with the evidence each session needs.

中文简介正在准备中。当前显示原文说明。

Use this skill when the risk register and the statement of applicability were written separately and may not agree, and the team asks "do our risks link to our controls", "traceability between risk treatment and the SoA", "why is this control applicable", "the auditor could not trace a risk to a control", "check our risk treatment plan against the SoA" or "orphan controls". Checks in both directions that every treated risk points to controls and actions, and every applicable control traces back to a risk or obligation, then writes a traceability matrix and a list of orphans and contradictions with proposed fixes.

中文简介正在准备中。当前显示原文说明。

Use this skill when a covered entity or business associate needs to know where protected health information lives and moves, or asks "map our PHI", "ePHI inventory", "HIPAA data flow diagram", "where does patient data go", "PHI flow map for the risk analysis", "which vendors need a BAA" or "do our logs contain PHI". Traces health data from where it enters, through systems, integrations, logs, backups and vendors, to where it leaves and is disposed of, records the safeguards that cover each flow and the business associate agreement behind each external one, and lists the gaps as input to the security risk analysis.

中文简介正在准备中。当前显示原文说明。

Use this skill when a team suspects its policies describe a company that does not exist, before an audit or customer review, or asks "do our policies match what we actually do", "check the policy against reality", "paper versus practice", "will the auditor find gaps in our policies", "our policy says quarterly but we never do it" or "align policies with how we work". Turns each policy into testable statements, samples the systems and records that show the practice, classifies every gap and proposes whether to fix the policy or the practice, with owners and priorities.

中文简介正在准备中。当前显示原文说明。

Use this skill when a team needs its first information security risk register, or has one that is a copied catalogue nobody owns, and asks "build our risk register", "draft a risk assessment", "what are our top risks", "risk register from scratch", "our auditor wants a risk assessment" or "turn our incidents and findings into risks". Drafts 20 to 40 company-specific risk scenarios from the material the agent can reach, scores them against an agreed method, proposes owners and treatments, and writes a CSV register plus a notes file of assumptions and questions for owners.

中文简介正在准备中。当前显示原文说明。

Use this skill when an incident or a serious near miss is closed and the team must learn from it, or an auditor asks for lessons learned, and someone says "run the post-mortem", "post-incident review", "lessons learned", "retro on the outage", "blameless review", "root cause of the incident" or "what do we change after this breach". Builds the timeline from records before the meeting, runs a blameless discussion, finds the contributing factors, and turns them into a few owned, dated actions linked to updates of the risk register, controls, playbooks and supplier records, then writes the review and an action tracker.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company with a security applicability statement extends its management system to privacy or to AI, and asks "extend our SoA for privacy", "which privacy controls apply to a processor", "AI controls applicability", "SoA for our AI management system", "are we controller or processor for this" or "do the AI development controls apply if we only use a model". Settles the company's role per processing activity and per AI system, decides applicability of the additional controls from those roles and the risk or impact assessments, and writes an extension to the applicability statement plus role and scope notes.

中文简介正在准备中。当前显示原文说明。

Use this skill when an incident may have to be reported to an authority, customers or affected people, and the team asks "do we have to notify", "72 hours", "24 hour early warning", "is this a notifiable breach", "major incident report", "who do we tell and by when", "draft the breach notification" or "do we tell the customers". Fixes the facts and the awareness time, tests each regime and contract that may apply, builds one table of recipients and deadlines with the earliest first, drafts each notification for review, and records the reasoning for every decision not to notify.

中文简介正在准备中。当前显示原文说明。