better-isms

Use this skill when a team suspects its policies describe a company that does not exist, before an audit or customer review, or asks "do our policies match what we actually do", "check the policy against reality", "paper versus practice", "will the auditor find gaps in our policies", "our policy says quarterly but we never do it" or "align policies with how we work". Turns each policy into testable statements, samples the systems and records that show the practice, classifies every gap and proposes whether to fix the policy or the practice, with owners and priorities.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company needs its record of processing activities for the first time, or has one that is really a list of tools, and asks "build our RoPA", "records of processing", "data map for GDPR", "Article 30 record", "what personal data do we process and why", "data inventory for privacy" or "our DPO needs a processing register". Drafts the record by processing activity from systems, vendors and team interviews, with purposes, data and subject categories, proposed legal bases, recipients, transfers and concrete retention, plus a separate processor record when the company processes data for customers, and a notes file of open questions per owner.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company needs to know whether the NIS 2 Directive applies to it, and asks "are we in scope of NIS 2", "are we an essential or important entity", "which country supervises us", "do we have to register", "a customer says we fall under NIS 2" or "does DORA replace NIS 2 for us". Works through sector, size, the size-independent cases, entity type, jurisdiction and sector-specific law, entity by entity and member state by member state, and writes a reasoned applicability memo with the facts each conclusion rests on and what follows from it.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company must test its incident response or continuity plan without breaking anything, because an audit, a customer, a regulator or the plan itself calls for an exercise, and someone asks "design a tabletop", "run a ransomware tabletop", "BCP exercise", "crisis simulation", "test our incident response plan", "write the injects" or "we need exercise evidence". Picks two or three objectives, builds a realistic company-specific scenario with timed injects that force decisions, briefs the facilitator and observers, and writes the exercise plan, the injects, the observer sheet and a findings record that ends in owned actions.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company needs a working process for privacy requests, or just received one and has none, and asks "DSAR procedure", "how do we handle a subject access request", "someone asked us to delete their data", "right to erasure process", "data subject rights workflow", "GDPR request handling" or "we missed the one-month deadline". Designs intake from any channel, a proportionate identity check, the system search map, review and redaction, response templates per right, deadline tracking and a request log, written as a procedure the support and privacy teams can run.

中文简介正在准备中。当前显示原文说明。

Use this skill when an auditor, assessor or regulator has sent a request list and the team asks "turn the auditor's request list into tasks", "who needs to provide what", "build the evidence tracker", "split the PBC list by owner", "what exactly do they want for this request" or "we have two weeks to send everything". Normalises each request into owned, dated tasks naming the exact artefact, period and source system, separates population requests from sample requests, batches the clarification questions, and writes a tracker plus one brief per owner.

中文简介正在准备中。当前显示原文说明。

Use this skill when a bank, payment or e-money institution, investment firm, insurer, crypto-asset service provider or other financial entity in scope of DORA needs to know whether its ICT risk management setup holds up, or when someone asks "DORA gap analysis", "are we DORA compliant on ICT risk", "check our ICT risk management framework", "prepare for the supervisor's DORA review", "does our ISO 27001 ISMS cover DORA" or "audit our Article 6 framework". Confirms the entity type and whether the simplified regime applies, maps the entity's own documents and records against the ICT risk management articles, and writes a gap list with owners, evidence and priorities.

中文简介正在准备中。当前显示原文说明。

Use this skill when a financial entity in scope of DORA needs to build or refresh its register of ICT third-party arrangements, and someone asks "build our register of information", "list our ICT providers for the regulator", "which providers support critical or important functions", "refresh the DORA register", "map our ICT contracts to functions" or "where is our provider concentration". Builds the population of ICT arrangements including intra-group ones, maps each to the functions it supports, collects the fields a supervisor will ask about, flags concentration, missing exit plans and contract gaps, and writes a working register with open questions for function owners.

中文简介正在准备中。当前显示原文说明。

Use this skill when an internal or external audit raised a nonconformity, finding, exception or observation and the team must answer it, or asks "write the corrective action plan", "root cause for this audit finding", "respond to the major nonconformity", "CAPA for the auditor", "how do we close this finding" or "the auditor rejected our corrective action". Separates correction from corrective action, runs a root cause analysis that stops at a cause the company controls, checks for the same problem elsewhere, and drafts a response with actions, owners, dates and the evidence that will prove effectiveness at the next audit.

中文简介正在准备中。当前显示原文说明。

Use this skill when the periodic policy review is due or overdue, or someone asks "run the annual policy review", "our policies are out of date", "re-approve the policies before the audit", "what changed since the last review", "policy version history" or "who needs to sign off which policy". Collects what changed since each policy was last approved (incidents, findings, exceptions, new systems, law), proposes the edits per policy, separates editorial from substantive changes, drafts the version history and approval record, and plans the communication to staff.

中文简介正在准备中。当前显示原文说明。

Use this skill when an incident or a serious near miss is closed and the team must learn from it, or an auditor asks for lessons learned, and someone says "run the post-mortem", "post-incident review", "lessons learned", "retro on the outage", "blameless review", "root cause of the incident" or "what do we change after this breach". Builds the timeline from records before the meeting, runs a blameless discussion, finds the contributing factors, and turns them into a few owned, dated actions linked to updates of the risk register, controls, playbooks and supplier records, then writes the review and an action tracker.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company with a security applicability statement extends its management system to privacy or to AI, and asks "extend our SoA for privacy", "which privacy controls apply to a processor", "AI controls applicability", "SoA for our AI management system", "are we controller or processor for this" or "do the AI development controls apply if we only use a model". Settles the company's role per processing activity and per AI system, decides applicability of the additional controls from those roles and the risk or impact assessments, and writes an extension to the applicability statement plus role and scope notes.

中文简介正在准备中。当前显示原文说明。

Use this skill when a published privacy notice may no longer match what the company does, or someone asks "is our privacy policy accurate", "check our privacy notice against the RoPA", "privacy notice review", "Article 13 and 14 check", "does our website privacy policy cover our vendors and cookies" or "update the privacy notice for the new product". Maps every collection point, compares each notice with the processing record, the vendor list and what the site and product actually collect, classifies what is missing, wrong, vague or stale, and drafts a redline plus the practice fixes that a notice edit cannot solve.

中文简介正在准备中。当前显示原文说明。