“grc”的搜索结果

Guides continuous privacy compliance monitoring implementation including automated control testing, evidence collection automation, real-time compliance dashboards, alert-based remediation workflows, regulatory change integration, and deviation management. Covers GRC platform configuration, control framework mapping, and compliance-as-code approaches. Keywords: continuous compliance, automated monitoring, evidence collection, dashboard, regulatory change, compliance-as-code.

中文简介正在准备中。当前显示原文说明。

Think and work like an expert Bioinformatician. Use when a task calls for Bioinformatician judgment. Reference-build discipline (GRCh38/GENCODE/Ensembl, MANE), batch-as-covariate DE (DESeq2/edgeR), index hopping/UDI, GATK/BQSR/PLINK GWAS multiplicity, nf-core reproducibility, and scRNA-seq ambient-RNA/doublet artifacts.

中文简介正在准备中。当前显示原文说明。

Analyze compliance operations for regulatory change tracking, control mapping, policy management, audit readiness, and training compliance. Triggers: 'audit compliance program', 'assess GRC platform', 'review regulatory change management', 'check control framework'.

中文简介正在准备中。当前显示原文说明。

Use this skill when the company acts as a processor for its customers and someone asks "update our subprocessor list", "are we missing subprocessors", "we added a new tool, do we need to tell customers", "check the public subprocessor page", "where is customer data processed" or "draft the subprocessor change notice". Finds which suppliers actually receive customer personal data, compares them with the published list, records purpose, data, locations and transfer basis for each, works out the customer notice duties from the signed agreements, and writes an updated register, a change list and a draft notice for review.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company needs to decide how much assessment each supplier deserves, or asks "tier our vendors", "which suppliers are critical", "we have 200 vendors and cannot assess them all", "build a third-party risk tiering", "rank suppliers by risk" or "which vendors need a security review this year". Builds the complete supplier population from finance, single sign-on and contracts, scores each supplier on data, access and dependency, assigns a tier by the highest axis, sets the assessment depth and cycle per tier, and writes a tiered list with the reason for every score.

中文简介正在准备中。当前显示原文说明。

Use this skill when a supplier has returned a security questionnaire, assurance report, certificate or trust pack and someone asks "review this vendor's answers", "is this supplier safe to use", "read their SOC report for us", "what should we ask the vendor next", "triage the vendor security assessment" or "does their certificate cover the service we buy". Checks report and certificate scope against the service in use, sorts answers into evidenced, asserted, contradicted and evasive, lists the obligations the report puts back on the customer, and writes a triage note with follow-up questions and a proposed decision for the owner.

中文简介正在准备中。当前显示原文说明。

Use this skill when personal data goes, or will go, to a recipient outside the EEA, or someone asks "do we need a TIA", "transfer impact assessment", "SCCs for this vendor", "can we use this US vendor under GDPR", "international data transfer assessment", "Schrems II assessment" or "our customer asked for our transfer assessments". Confirms whether there is a transfer at all, maps the full chain including remote access and sub-processors, identifies the transfer mechanism, structures the destination law assessment from sourced material, proposes supplementary measures and drafts a documented assessment with a review trigger.

中文简介正在准备中。当前显示原文说明。

Use this skill when a certification audit is booked and the team wants to know whether the first stage will go through, and asks "are we ready for stage 1", "pre-audit readiness check", "what will the auditor read first", "documentation review before the certification audit", "mock stage 1" or "what would stop the audit". Walks the documentation set the way a certification auditor reads it, checks that documents agree with each other and with the records, and writes a list of stoppers, likely findings and polish items with an owner and a fix for each.

中文简介正在准备中。当前显示原文说明。

Use this skill when the implementation status column of a statement of applicability may not match reality, and the team asks "is our SoA accurate", "check the implemented column", "do we have evidence for every implemented control", "reconcile the SoA with our evidence", "pre-audit evidence check" or "the auditor found a control marked implemented with no records". Samples the records behind every control marked implemented, grades the evidence, proposes a corrected status for each row and writes a reconciliation table plus an evidence gap list with owners.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company has a risk assessment and treatment plan and now needs its first statement of applicability, and asks "build our SoA", "draft the statement of applicability", "which controls apply to us", "SoA from the risk treatment plan", "justify inclusions and exclusions" or "our SoA says implemented everywhere". Drafts one row per control of the reader's framework with the inclusion decision, the risk or obligation behind it, an implementation status taken from records, an evidence pointer and an owner role, and writes a CSV statement plus notes of open decisions.

中文简介正在准备中。当前显示原文说明。

Use this skill when a statement of applicability already exists and the team wants its exclusions to survive the audit, and asks "review our SoA exclusions", "is this a valid justification", "can we exclude physical security if we are fully remote", "the auditor challenged our not applicable controls", "rewrite our exclusion justifications" or "we outsource it, so it does not apply, right". Tests every excluded control against scope, assets, activities, suppliers, risks and commitments, gives each a keep, rewrite, reverse or ask verdict, and writes a review table plus rewritten justifications for the owner to approve.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company needs its information security policy set written or rebuilt, or asks "write our security policies", "draft the information security policy", "we need policies for the audit", "policy pack for a startup", "our template policies are 40 documents nobody reads" or "which policies do we actually need". Maps the policy set to the company's size and owners, drafts the top-level policy and the topic policies in testable language that reflects what the company does, flags commitments that need a decision, and prepares the approval and communication record for leadership.

中文简介正在准备中。当前显示原文说明。

Use this skill when an engineering team needs a secure development policy, or has one that does not match how code really ships, and asks "write our secure SDLC policy", "secure development policy from our CI", "document our code review and scanning for the audit", "what does our pipeline already enforce", "change management for engineers" or "secure coding policy for SOC 2 or CRA". Reads the repositories and pipeline definitions, inventories what is actually enforced (reviews, checks, scanners, deploy gates, dependency and secret controls), and writes a policy whose every "must" points to the place it is enforced, with gaps listed as decisions.

中文简介正在准备中。当前显示原文说明。

Use this skill when a team must define what its management system covers before a certification project, or its current scope is one vague sentence, and asks "write our ISMS scope", "what should be in scope", "can we exclude the sales office", "scope for the certificate", "draw the boundary of our management system" or "the auditor says our scope is unclear". Drafts the scope statement with boundaries, interfaces, dependencies and justified exclusions, for a security, privacy or AI management system, and writes a statement file plus a boundary table of open questions.

中文简介正在准备中。当前显示原文说明。

Use this skill when an internal or external audit raised a nonconformity, finding, exception or observation and the team must answer it, or asks "write the corrective action plan", "root cause for this audit finding", "respond to the major nonconformity", "CAPA for the auditor", "how do we close this finding" or "the auditor rejected our corrective action". Separates correction from corrective action, runs a root cause analysis that stops at a cause the company controls, checks for the same problem elsewhere, and drafts a response with actions, owners, dates and the evidence that will prove effectiveness at the next audit.

中文简介正在准备中。当前显示原文说明。

Use this skill when a financial entity in scope of DORA needs to build or refresh its register of ICT third-party arrangements, and someone asks "build our register of information", "list our ICT providers for the regulator", "which providers support critical or important functions", "refresh the DORA register", "map our ICT contracts to functions" or "where is our provider concentration". Builds the population of ICT arrangements including intra-group ones, maps each to the functions it supports, collects the fields a supervisor will ask about, flags concentration, missing exit plans and contract gaps, and writes a working register with open questions for function owners.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company answers to two or more frameworks and is collecting the same evidence twice, and asks "map our controls across frameworks", "crosswalk between our certification and our attestation", "can our ISMS cover NIS 2", "unified control framework", "collect evidence once, use it everywhere" or "what is unique to each framework". Builds one internal control set in the company's own words, maps each control to the framework references by bare identifier with an honest match strength, flags what only one framework asks for, and writes a control map plus an evidence plan where each artefact is collected once.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company has no incident response plan, has one copied from a template that names teams it does not have, or an auditor, customer or insurer asks for it, and the team says "write our incident response plan", "IR plan", "security incident procedure", "who does what in an incident", "incident playbooks", "contact tree for incidents" or "our plan failed in the last incident". Drafts a plan sized to the company with roles and deputies, a severity scale, a contact tree with an out-of-band channel, one-page playbooks for the likely scenarios, evidence handling and a notification decision step, plus a one-page quick reference card.

中文简介正在准备中。当前显示原文说明。

Use this skill when a bank, payment or e-money institution, investment firm, insurer, crypto-asset service provider or other financial entity in scope of DORA needs to know whether its ICT risk management setup holds up, or when someone asks "DORA gap analysis", "are we DORA compliant on ICT risk", "check our ICT risk management framework", "prepare for the supervisor's DORA review", "does our ISO 27001 ISMS cover DORA" or "audit our Article 6 framework". Confirms the entity type and whether the simplified regime applies, maps the entity's own documents and records against the ICT risk management articles, and writes a gap list with owners, evidence and priorities.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company needs recovery objectives it can defend, before a continuity plan, a disaster recovery design, an audit or a resilience review, and asks "do a BIA", "business impact analysis", "set our RTO and RPO", "what is our maximum tolerable downtime", "which services are critical", "impact tolerance" or "can our backups meet our recovery targets". Lists services from the customer's view, prices an outage over time in the company's own money and obligations, sets recovery time and data loss objectives, maps dependencies, and compares each objective with what backups, restore tests, suppliers and people actually allow, listing the gaps for a decision.

中文简介正在准备中。当前显示原文说明。

Use this skill when an internal auditor has one process or area to audit and needs a working checklist built from the company's own documents, or asks "build an internal audit checklist", "audit questions for access management", "what do I test in the supplier process", "audit plan for this area", "how many samples should I take", "internal audit of our data protection process" or "test our incident process against what the policy says". Turns each commitment in the company's policies and procedures into a test with a question, a record to inspect, a sample and a pass criterion, adds framework-specific checks through a lookup, and writes a checklist file the auditor fills in during fieldwork.

中文简介正在准备中。当前显示原文说明。

Use this skill when the company is about to buy, renew or switch on an AI product or an AI feature inside an existing product, and asks "assess this AI vendor", "do they train on our data", "AI supplier questionnaire", "review the AI terms", "can we use this model provider with customer data", "who are the subprocessors behind this AI tool" or "AI vendor risk assessment". Sizes the review to the use, reads the terms, data processing agreement and documentation before asking questions, checks training use, retention, model changes, subprocessors, transfers, security and exit, and writes an assessment with a recommendation plus the follow-up questions for the vendor.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company needs its internal audit programme for the certification or examination cycle, or asks "plan our internal audits", "internal audit schedule for the year", "audit programme for the three-year cycle", "who can do our internal audit", "we are too small for an independent auditor", "readiness audit before the examination" or "which areas do we audit first". Ranks audit areas by risk, change and past findings, sets how often each is audited across the cycle, assigns auditors who are independent of what they audit, sizes the effort, and writes a programme, a coverage matrix and a calendar for leadership to approve.

中文简介正在准备中。当前显示原文说明。

Use this skill when staff already use AI assistants, coding tools or AI features and the company needs rules people will follow, and asks "write our AI usage policy", "can staff use ChatGPT", "generative AI policy", "what data can we put into AI tools", "approved AI tools list", "rules for AI agents and connectors" or "AI literacy for staff". Finds out what people actually use, sets a short list of approved tools with a data traffic light, rules for checking outputs and for agents that act, a fast route to request a new tool, and writes a two-page rule set, the approved tools list and rollout notes.

中文简介正在准备中。当前显示原文说明。