“grc”的搜索结果

Use this skill when a new product feature, vendor, AI use, monitoring tool or change in processing raises the question "do we need a DPIA", or someone asks "DPIA screening", "is this high risk processing", "data protection impact assessment threshold", "privacy impact screening for this feature", "does our AI feature need a DPIA" or "document why we did not do a DPIA". Describes the processing with numbers, tests it against the GDPR cases, the supervisory authority's list and the EDPB-endorsed criteria, reaches a reasoned outcome (required, recommended, not required) with a re-screen trigger, and keeps a screening log for accountability.

中文简介正在准备中。当前显示原文说明。

Use this skill when a data processing agreement is being negotiated or renewed and someone asks "review the TOMs annex", "check the security measures in this DPA", "can we sign this annex", "the customer sent their DPA with a security schedule", "is our standard annex still true" or "does this vendor's annex promise enough". Breaks the technical and organisational measures annex into single commitments, compares each one with what the company actually runs or with what the use case needs, and writes a line-by-line review, proposed redlines and a list of practice gaps for owners.

中文简介正在准备中。当前显示原文说明。

Use this skill when a set of policies, procedures, plans and registers has grown in pieces and someone asks "check our documents for contradictions", "are our policies consistent", "the retention periods don't match", "which severity scale is right", "harmonise our ISMS documents", "cross-check the incident plan against the policy" or "clean up our documentation before the audit". Extracts the checkable facts from every document (periods, deadlines, scales, roles, labels, references), finds contradictions, naming drift and broken references, proposes which document owns each fact, and drafts a glossary and a fix list for the owners.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company needs a written risk assessment method before it builds or rescores a register, or when the current method produces registers where everything scores 3. Triggers: "write our risk methodology", "define likelihood and impact scales", "what is our risk appetite", "risk acceptance criteria", "who can accept a risk", "our auditor says the method is not repeatable", "risk matrix for our ISMS". Drafts a short method with likelihood and impact anchors in the company's own money, hours and records, a scoring rule, an acceptance threshold with an authority ladder, reassessment triggers, and a calibration test on five sample risks.

中文简介正在准备中。当前显示原文说明。

Use this skill when a risk owner wants to accept a residual risk instead of treating it further, or when someone asks "write a risk acceptance", "we want to accept this risk", "risk exception form", "document the risk acceptance for the auditor", "security exception for this system", "can we sign off this risk" or "management accepted the risk, how do we record it". Drafts a one-page decision record per risk: the risk and its score, the options considered with cost, why acceptance is reasonable, compensating measures with evidence, conditions, expiry and the triggers that reopen it, with a signature block for the person who holds the authority.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company needs a working process for privacy requests, or just received one and has none, and asks "DSAR procedure", "how do we handle a subject access request", "someone asked us to delete their data", "right to erasure process", "data subject rights workflow", "GDPR request handling" or "we missed the one-month deadline". Designs intake from any channel, a proportionate identity check, the system search map, review and redaction, response templates per right, deadline tracking and a request log, written as a procedure the support and privacy teams can run.

中文简介正在准备中。当前显示原文说明。

Use this skill when something is happening now: an alert, a suspicious login, a ransomware note, data sent to the wrong customer, an outage that might be an attack, and someone asks "how bad is this", "classify this incident", "is this a SEV1", "who do we wake up", "is this a breach", "do we need to notify anyone" or "start the incident log". Classifies the incident on the company's own scale in minutes, decides who is called and how fast, flags any regulatory or contractual clock, lists the evidence to preserve, and starts a timestamped triage record that is revisited as facts change.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company has no incident response plan, has one copied from a template that names teams it does not have, or an auditor, customer or insurer asks for it, and the team says "write our incident response plan", "IR plan", "security incident procedure", "who does what in an incident", "incident playbooks", "contact tree for incidents" or "our plan failed in the last incident". Drafts a plan sized to the company with roles and deputies, a severity scale, a contact tree with an out-of-band channel, one-page playbooks for the likely scenarios, evidence handling and a notification decision step, plus a one-page quick reference card.

中文简介正在准备中。当前显示原文说明。

Use this skill when a customer or prospect has sent a security questionnaire, due diligence form or vendor assessment and someone asks "answer this security questionnaire", "fill in the customer's vendor assessment", "draft answers from our policies", "we have 300 questions due Friday", "reuse our previous questionnaire answers" or "which answers can we not back up". Drafts every answer from the company's own documents with a source and a confidence level, flags answers without evidence and answers that create commitments, checks consistency with past answers, and writes an answer sheet plus a list of items for owners to confirm.

中文简介正在准备中。当前显示原文说明。

Use this skill when controls have no clear owner, or "security" owns everything, and the team asks "who owns each control", "build a RACI for our controls", "assign control owners", "nobody knows who runs the access review", "set a review cadence per control" or "the auditor asked who is accountable". Assigns one accountable role and the operators to every applicable control, checks workload and segregation of duties, sets a review cadence from how each control runs, and writes a RACI table plus a one-page brief per owner role.

中文简介正在准备中。当前显示原文说明。

Use this skill when a covered entity or business associate needs to know where protected health information lives and moves, or asks "map our PHI", "ePHI inventory", "HIPAA data flow diagram", "where does patient data go", "PHI flow map for the risk analysis", "which vendors need a BAA" or "do our logs contain PHI". Traces health data from where it enters, through systems, integrations, logs, backups and vendors, to where it leaves and is disposed of, records the safeguards that cover each flow and the business associate agreement behind each external one, and lists the gaps as input to the security risk analysis.

中文简介正在准备中。当前显示原文说明。

Use this skill when an auditor will test change management, or the team wants to know before they do, and asks "sample our production changes", "check our PR approvals", "do we have segregation of duties on deploys", "test change management before the audit", "were emergency changes approved" or "can a developer push to production alone". Builds the change population from what actually reached production, reconciles it with tickets and pull requests, draws a recorded sample, tests approval, testing, segregation and emergency attributes, and writes the results and the exceptions as facts.

中文简介正在准备中。当前显示原文说明。

Use this skill when an internal or external audit raised a nonconformity, finding, exception or observation and the team must answer it, or asks "write the corrective action plan", "root cause for this audit finding", "respond to the major nonconformity", "CAPA for the auditor", "how do we close this finding" or "the auditor rejected our corrective action". Separates correction from corrective action, runs a root cause analysis that stops at a cause the company controls, checks for the same problem elsewhere, and drafts a response with actions, owners, dates and the evidence that will prove effectiveness at the next audit.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company needs recovery objectives it can defend, before a continuity plan, a disaster recovery design, an audit or a resilience review, and asks "do a BIA", "business impact analysis", "set our RTO and RPO", "what is our maximum tolerable downtime", "which services are critical", "impact tolerance" or "can our backups meet our recovery targets". Lists services from the customer's view, prices an outage over time in the company's own money and obligations, sets recovery time and data loss objectives, maps dependencies, and compares each objective with what backups, restore tests, suppliers and people actually allow, listing the gaps for a decision.

中文简介正在准备中。当前显示原文说明。

Use this skill when a financial entity in scope of DORA needs to build or refresh its register of ICT third-party arrangements, and someone asks "build our register of information", "list our ICT providers for the regulator", "which providers support critical or important functions", "refresh the DORA register", "map our ICT contracts to functions" or "where is our provider concentration". Builds the population of ICT arrangements including intra-group ones, maps each to the functions it supports, collects the fields a supervisor will ask about, flags concentration, missing exit plans and contract gaps, and writes a working register with open questions for function owners.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company must test its incident response or continuity plan without breaking anything, because an audit, a customer, a regulator or the plan itself calls for an exercise, and someone asks "design a tabletop", "run a ransomware tabletop", "BCP exercise", "crisis simulation", "test our incident response plan", "write the injects" or "we need exercise evidence". Picks two or three objectives, builds a realistic company-specific scenario with timed injects that force decisions, briefs the facilitator and observers, and writes the exercise plan, the injects, the observer sheet and a findings record that ends in owned actions.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company needs to know whether the NIS 2 Directive applies to it, and asks "are we in scope of NIS 2", "are we an essential or important entity", "which country supervises us", "do we have to register", "a customer says we fall under NIS 2" or "does DORA replace NIS 2 for us". Works through sector, size, the size-independent cases, entity type, jurisdiction and sector-specific law, entity by entity and member state by member state, and writes a reasoned applicability memo with the facts each conclusion rests on and what follows from it.

中文简介正在准备中。当前显示原文说明。

Use this skill when a restore test is due, an auditor or customer asks for proof that backups can be recovered, or someone says "plan a restore test", "prove we can recover in time", "our backups succeed but we never restored", "test our RTO and RPO", "write up the disaster recovery test" or "document the backup restore for the audit". Picks what to restore, writes a test plan with success criteria set before the test, records timings against the recovery objectives, and produces a signed-off test record with the issues found and their owners.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company answers to two or more frameworks and is collecting the same evidence twice, and asks "map our controls across frameworks", "crosswalk between our certification and our attestation", "can our ISMS cover NIS 2", "unified control framework", "collect evidence once, use it everywhere" or "what is unique to each framework". Builds one internal control set in the company's own words, maps each control to the framework references by bare identifier with an honest match strength, flags what only one framework asks for, and writes a control map plus an evidence plan where each artefact is collected once.

中文简介正在准备中。当前显示原文说明。

Use this skill when an external audit, attestation examination or assessment is coming and the team wants populations and evidence ready for the samples the auditor will pull, or asks "prepare for audit sampling", "what samples will the auditor ask for", "get our populations ready", "the auditor wants a list of all changes in the period", "evidence for the leavers sample", "Type II sample prep" or "how do we prove completeness of the population". Lists the populations an auditor is likely to sample, builds each from the system of record with the query that produced it, checks completeness and the evidence behind a dry-run sample, and writes a readiness file per population plus a list of gaps to fix before fieldwork.

中文简介正在准备中。当前显示原文说明。

Use this skill when leadership is due to review the security, privacy or AI management system, or when someone asks "prepare the management review", "management review agenda", "board pack for the ISMS", "write the management review minutes", "what metrics do we show leadership", "the auditor wants evidence of management review" or "our management review is a slide nobody reads". Assembles the facts leadership needs from the registers, audits, incidents and metrics, frames each agenda item as a decision with options, checks coverage against the framework with a lookup, and drafts the pre-read, the agenda and minutes with a decision and action log.

中文简介正在准备中。当前显示原文说明。

Use this skill when process owners, engineers or executives will be interviewed in an external or internal audit and need to be ready, or when someone asks "prepare the team for the auditor interviews", "what will the auditor ask our CTO", "interview briefing for the audit", "how should people answer the auditor", "mock audit interviews" or "our engineers are nervous about the audit". Builds a one-page brief per role: what the auditor is likely to ask, the records that person should be able to open, the honest way to answer what they do not know, and a short mock interview, plus an interview schedule with the evidence each session needs.

中文简介正在准备中。当前显示原文说明。

Use this skill when the company is about to buy, renew or switch on an AI product or an AI feature inside an existing product, and asks "assess this AI vendor", "do they train on our data", "AI supplier questionnaire", "review the AI terms", "can we use this model provider with customer data", "who are the subprocessors behind this AI tool" or "AI vendor risk assessment". Sizes the review to the use, reads the terms, data processing agreement and documentation before asking questions, checks training use, retention, model changes, subprocessors, transfers, security and exit, and writes an assessment with a recommendation plus the follow-up questions for the vendor.

中文简介正在准备中。当前显示原文说明。

Use this skill when an auditor, customer or regulator will ask how security events are logged and watched, and someone says "prepare logging evidence", "show we monitor alerts", "what do we log and for how long", "who looks at the SIEM", "prove an alert was handled" or "our monitoring evidence is just dashboard screenshots". Maps log coverage and retention per system, lists the alert rules that matter and where they go, traces real alerts end to end with timestamps, and writes an evidence pack with the gaps stated plainly.

中文简介正在准备中。当前显示原文说明。