“grc”的搜索结果

Use this skill when the risk register and the statement of applicability were written separately and may not agree, and the team asks "do our risks link to our controls", "traceability between risk treatment and the SoA", "why is this control applicable", "the auditor could not trace a risk to a control", "check our risk treatment plan against the SoA" or "orphan controls". Checks in both directions that every treated risk points to controls and actions, and every applicable control traces back to a risk or obligation, then writes a traceability matrix and a list of orphans and contradictions with proposed fixes.

中文简介正在准备中。当前显示原文说明。

Use this skill when an existing risk register needs a check before an audit, a management review or a new owner takes it over, or when someone asks "clean up our risk register", "is our risk register any good", "review the risk register before the audit", "our risks have not been updated", "find duplicate risks", "who owns these risks" or "the scores look wrong". Reads the register read-only and finds stale, duplicated, unowned, orphaned and mis-scored entries, risks missing given the company's own incidents and findings, and expired acceptances, then writes a findings file with a proposed fix per line for the owners to decide.

中文简介正在准备中。当前显示原文说明。

Use this skill when a team needs its first information security risk register, or has one that is a copied catalogue nobody owns, and asks "build our risk register", "draft a risk assessment", "what are our top risks", "risk register from scratch", "our auditor wants a risk assessment" or "turn our incidents and findings into risks". Drafts 20 to 40 company-specific risk scenarios from the material the agent can reach, scores them against an agreed method, proposes owners and treatments, and writes a CSV register plus a notes file of assumptions and questions for owners.

中文简介正在准备中。当前显示原文说明。

Use this skill when staff already use AI assistants, coding tools or AI features and the company needs rules people will follow, and asks "write our AI usage policy", "can staff use ChatGPT", "generative AI policy", "what data can we put into AI tools", "approved AI tools list", "rules for AI agents and connectors" or "AI literacy for staff". Finds out what people actually use, sets a short list of approved tools with a data traffic light, rules for checking outputs and for agents that act, a fast route to request a new tool, and writes a two-page rule set, the approved tools list and rollout notes.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company answers to two or more frameworks and is collecting the same evidence twice, and asks "map our controls across frameworks", "crosswalk between our certification and our attestation", "can our ISMS cover NIS 2", "unified control framework", "collect evidence once, use it everywhere" or "what is unique to each framework". Builds one internal control set in the company's own words, maps each control to the framework references by bare identifier with an honest match strength, flags what only one framework asks for, and writes a control map plus an evidence plan where each artefact is collected once.

中文简介正在准备中。当前显示原文说明。

Use this skill when leadership is due to review the security, privacy or AI management system, or when someone asks "prepare the management review", "management review agenda", "board pack for the ISMS", "write the management review minutes", "what metrics do we show leadership", "the auditor wants evidence of management review" or "our management review is a slide nobody reads". Assembles the facts leadership needs from the registers, audits, incidents and metrics, frames each agenda item as a decision with options, checks coverage against the framework with a lookup, and drafts the pre-read, the agenda and minutes with a decision and action log.

中文简介正在准备中。当前显示原文说明。

Use this skill when an auditor, customer or regulator will ask how security events are logged and watched, and someone says "prepare logging evidence", "show we monitor alerts", "what do we log and for how long", "who looks at the SIEM", "prove an alert was handled" or "our monitoring evidence is just dashboard screenshots". Maps log coverage and retention per system, lists the alert rules that matter and where they go, traces real alerts end to end with timestamps, and writes an evidence pack with the gaps stated plainly.

中文简介正在准备中。当前显示原文说明。

Use this skill when a periodic user access review is due, an auditor asked for access review evidence, or someone says "prepare the access review", "run the quarterly user recertification", "who still has admin", "check leavers still have access", "build the access review sheets for managers" or "our last review was a rubber stamp". Picks the systems in scope, builds account populations reconciled against HR, pre-flags leavers, orphans, shared and dormant accounts, assigns independent reviewers, defines the decisions to record, and plans the removal follow-up.

中文简介正在准备中。当前显示原文说明。

Use this skill when a customer or prospect has sent a security questionnaire, due diligence form or vendor assessment and someone asks "answer this security questionnaire", "fill in the customer's vendor assessment", "draft answers from our policies", "we have 300 questions due Friday", "reuse our previous questionnaire answers" or "which answers can we not back up". Drafts every answer from the company's own documents with a source and a confidence level, flags answers without evidence and answers that create commitments, checks consistency with past answers, and writes an answer sheet plus a list of items for owners to confirm.

中文简介正在准备中。当前显示原文说明。

Use this skill when an internal or external audit raised a nonconformity, finding, exception or observation and the team must answer it, or asks "write the corrective action plan", "root cause for this audit finding", "respond to the major nonconformity", "CAPA for the auditor", "how do we close this finding" or "the auditor rejected our corrective action". Separates correction from corrective action, runs a root cause analysis that stops at a cause the company controls, checks for the same problem elsewhere, and drafts a response with actions, owners, dates and the evidence that will prove effectiveness at the next audit.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company needs to know whether the NIS 2 Directive applies to it, and asks "are we in scope of NIS 2", "are we an essential or important entity", "which country supervises us", "do we have to register", "a customer says we fall under NIS 2" or "does DORA replace NIS 2 for us". Works through sector, size, the size-independent cases, entity type, jurisdiction and sector-specific law, entity by entity and member state by member state, and writes a reasoned applicability memo with the facts each conclusion rests on and what follows from it.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company needs a working process for privacy requests, or just received one and has none, and asks "DSAR procedure", "how do we handle a subject access request", "someone asked us to delete their data", "right to erasure process", "data subject rights workflow", "GDPR request handling" or "we missed the one-month deadline". Designs intake from any channel, a proportionate identity check, the system search map, review and redaction, response templates per right, deadline tracking and a request log, written as a procedure the support and privacy teams can run.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company needs recovery objectives it can defend, before a continuity plan, a disaster recovery design, an audit or a resilience review, and asks "do a BIA", "business impact analysis", "set our RTO and RPO", "what is our maximum tolerable downtime", "which services are critical", "impact tolerance" or "can our backups meet our recovery targets". Lists services from the customer's view, prices an outage over time in the company's own money and obligations, sets recovery time and data loss objectives, maps dependencies, and compares each objective with what backups, restore tests, suppliers and people actually allow, listing the gaps for a decision.

中文简介正在准备中。当前显示原文说明。

Use this skill when an internal auditor has one process or area to audit and needs a working checklist built from the company's own documents, or asks "build an internal audit checklist", "audit questions for access management", "what do I test in the supplier process", "audit plan for this area", "how many samples should I take", "internal audit of our data protection process" or "test our incident process against what the policy says". Turns each commitment in the company's policies and procedures into a test with a question, a record to inspect, a sample and a pass criterion, adds framework-specific checks through a lookup, and writes a checklist file the auditor fills in during fieldwork.

中文简介正在准备中。当前显示原文说明。

Automates SOC 2 Type II audit preparation including gap assessment against AICPA Trust Services Criteria (CC1-CC9), evidence collection from cloud providers and identity systems, control testing validation, remediation tracking, and continuous compliance monitoring. Covers all five TSC categories (Security, Availability, Processing Integrity, Confidentiality, Privacy) with automated evidence gathering from AWS, Azure, GCP, Okta, GitHub, and Jira. Use when preparing for or maintaining SOC 2 Ty...

中文简介正在准备中。当前显示原文说明。

Use when asked to map, crosswalk, align, compare, or gap-analyze any two cybersecurity frameworks, control catalogs, or regulatory requirements using NIST IR 8477 Set-Theory Relationship Mapping (STRM). Triggers on terms like "map controls", "crosswalk", "framework alignment", "gap analysis", or producing a STRM CSV output file.

中文简介正在准备中。当前显示原文说明。

Generates sourced, BDR-ready account research briefs for named target accounts in B2B SaaS ABM and outbound motions. Use after a target account list is built and before outreach sequences are written. Best for Tier 1, Tier 2, and intent-qualified accounts where BDRs need a clear "why this account, why now, why this persona" hypothesis. Designed for B2B SaaS teams selling compliance, security, GRC, risk, or other technical platforms into mid-market and enterprise buyers. Not intended for broad list building or mass enrichment.

中文简介正在准备中。当前显示原文说明。

Generates account research briefs, personalized outreach sequences, persona-specific talk tracks, and objection handling frameworks for B2B SaaS BDR teams. Use when preparing BDR outreach for target accounts, building prospecting sequences, creating call scripts, developing objection responses, onboarding new BDRs, or reviewing outreach performance. Also use when asked to "write outreach emails," "build a prospecting sequence," "create a call script," "handle objections," or "research an account for outreach." Designed for BDR teams selling compliance, security, and GRC platforms to mid-market and enterprise buyers with multi-persona buying committees.

中文简介正在准备中。当前显示原文说明。

Orchestrates the end-to-end germline short-variant pipeline from FASTQ to a filtered, normalized, benchmarked VCF, chaining QC/trim, BWA-MEM2 alignment, duplicate marking, optional BQSR, calling (bcftools/GATK HaplotypeCaller/DeepVariant/DRAGEN), normalization, site+genotype filtering, annotation, and hap.py/vcfeval benchmarking. Use when deciding the pipeline-wide reference-genome commitment (GRCh38 analysis set vs T2T, ALT/decoy handling), sequencing the steps in the defensible order (normalize BEFORE annotate, filter site- then genotype-level), choosing the calling engine and single-sample vs cohort joint-calling, picking a filtering strategy by cohort size, or benchmarking stratified within GIAB confident regions. Hands off mechanism to the variant-calling and read-alignment component skills; not a re-teach of any single step.

中文简介正在准备中。当前显示原文说明。

Map controls to SOC2, ISO 27001, PCI, or internal policy for the org you work for. Evidence and control design — not audit theater.

中文简介正在准备中。当前显示原文说明。