Skip to content

Skills tagged General

23 skills apply whatever the framework.

Acceptable use policy draftingUse this skill when a company needs rules for how staff use company systems, data, devices and AI tools, or asks "write our acceptable use policy", "AUP for employees", "can staff use ChatGPT at…Policies and documentationGeneral, ISO 27001, SOC 2Tristan Roth
AI acceptable use rulesUse this skill when staff already use AI assistants, coding tools or AI features and the company needs rules people will follow, and asks "write our AI usage policy", "can staff use ChatGPT"…AI systemsGeneral, ISO 42001, EU AI ActTristan Roth
Auditor interview prepUse this skill when process owners, engineers or executives will be interviewed in an external or internal audit and need to be ready, or when someone asks "prepare the team for the auditor…Audit prep and responseISO 27001, SOC 2, GeneralTristan Roth
Business impact analysisUse this skill when a company needs recovery objectives it can defend, before a continuity plan, a disaster recovery design, an audit or a resilience review, and asks "do a BIA", "business impact…Incidents and continuityISO 27001, DORA, NIS 2, GeneralTristan Roth
Control owner RACIUse this skill when controls have no clear owner, or "security" owns everything, and the team asks "who owns each control", "build a RACI for our controls", "assign control owners", "nobody knows who…Statement of applicabilityISO 27001, SOC 2, GeneralTristan Roth
Customer security questionnaire answersUse this skill when a customer or prospect has sent a security questionnaire, due diligence form or vendor assessment and someone asks "answer this security questionnaire", "fill in the customer's…Vendors and third partiesGeneral, SOC 2, ISO 27001, GDPRTristan Roth
Document consistency checkUse this skill when a set of policies, procedures, plans and registers has grown in pieces and someone asks "check our documents for contradictions", "are our policies consistent", "the retention…Policies and documentationGeneralTristan Roth
Evidence freshness checkUse this skill when an audit, attestation period or customer review is coming and someone asks "is our evidence up to date", "check the evidence folder before the auditor sees it", "which screenshots…EvidenceGeneral, ISO 27001, SOC 2Tristan Roth
First gap assessmentUse this skill when a company starts a compliance programme and needs to know how far it is from a framework, and asks "run a gap analysis", "how ready are we for the audit", "baseline us against the…Gap and readinessGeneral, ISO 27001, SOC 2, HIPAA, NIS 2, ISO 42001Tristan Roth
GRC setup reviewUse this skill when someone wants to know where to start with the grcskills library, or asks "review my GRC setup", "what should I fix before the audit", "which compliance skills do I need", "audit…Gap and readinessGeneral, ISO 27001, SOC 2, GDPR, NIS 2, DORA, ISO 42001, EU AI ActTristan Roth
Incident severity triageUse this skill when something is happening now: an alert, a suspicious login, a ransomware note, data sent to the wrong customer, an outage that might be an attack, and someone asks "how bad is…Incidents and continuityGeneral, ISO 27001, SOC 2, NIS 2, DORATristan Roth
Multi-framework overlap mapUse this skill when a company answers to two or more frameworks and is collecting the same evidence twice, and asks "map our controls across frameworks", "crosswalk between our certification and our…Gap and readinessGeneral, ISO 27001, SOC 2, NIS 2, NIST CSF, GDPRTristan Roth
Nonconformity root cause and corrective actionUse this skill when an internal or external audit raised a nonconformity, finding, exception or observation and the team must answer it, or asks "write the corrective action plan", "root cause for…Audit prep and responseISO 27001, ISO 27701, ISO 42001, SOC 2, GeneralTristan Roth
Policy gap review against practiceUse this skill when a team suspects its policies describe a company that does not exist, before an audit or customer review, or asks "do our policies match what we actually do", "check the policy…Policies and documentationGeneral, ISO 27001, SOC 2Tristan Roth
Policy review cycle refreshUse this skill when the periodic policy review is due or overdue, or someone asks "run the annual policy review", "our policies are out of date", "re-approve the policies before the audit", "what…Policies and documentationGeneral, ISO 27001, SOC 2Tristan Roth
Post-incident reviewUse this skill when an incident or a serious near miss is closed and the team must learn from it, or an auditor asks for lessons learned, and someone says "run the post-mortem", "post-incident…Incidents and continuityGeneral, ISO 27001, SOC 2Tristan Roth
Risk acceptance memoUse this skill when a risk owner wants to accept a residual risk instead of treating it further, or when someone asks "write a risk acceptance", "we want to accept this risk", "risk exception form"…RiskGeneral, ISO 27001, DORATristan Roth
Risk method draftingUse this skill when a company needs a written risk assessment method before it builds or rescores a register, or when the current method produces registers where everything scores 3. Triggers: "write…RiskISO 27001, ISO 27701, ISO 42001, DORA, GeneralTristan Roth
Risk register first passUse this skill when a team needs its first information security risk register, or has one that is a copied catalogue nobody owns, and asks "build our risk register", "draft a risk assessment", "what…RiskISO 27001, SOC 2, NIS 2, DORA, GeneralTristan Roth
Risk register hygiene reviewUse this skill when an existing risk register needs a check before an audit, a management review or a new owner takes it over, or when someone asks "clean up our risk register", "is our risk register…RiskGeneral, ISO 27001, SOC 2Tristan Roth
Risk treatment plan draftingUse this skill when a risk register has treatment decisions but no plan anyone can execute, or when someone asks "write the risk treatment plan", "turn the risk register into actions", "what do we do…RiskISO 27001, SOC 2, GeneralTristan Roth
Vendor security questionnaire triageUse this skill when a supplier has returned a security questionnaire, assurance report, certificate or trust pack and someone asks "review this vendor's answers", "is this supplier safe to use"…Vendors and third partiesGeneral, ISO 27001, SOC 2, GDPRTristan Roth
Vendor tieringUse this skill when a company needs to decide how much assessment each supplier deserves, or asks "tier our vendors", "which suppliers are critical", "we have 200 vendors and cannot assess them all"…Vendors and third partiesGeneral, ISO 27001, SOC 2, DORA, NIS 2Tristan Roth