Skip to content

Skills Categories Contribute GitHub

Menu

Skills Categories Contribute GitHub

Home
Skills

All skills

60 practitioner skills. Filter by the kind of work or by framework tag.

Category

Framework

60 of 60 skills

Acceptable use policy draftingUse this skill when a company needs rules for how staff use company systems, data, devices and AI tools, or asks "write our acceptable use policy", "AUP for employees", "can staff use ChatGPT at…Policies and documentationGeneral, ISO 27001, SOC 2Tristan Roth
Access review campaign prepUse this skill when a periodic user access review is due, an auditor asked for access review evidence, or someone says "prepare the access review", "run the quarterly user recertification", "who…EvidenceISO 27001, SOC 2, HIPAA, PCI DSSTristan Roth
AI acceptable use rulesUse this skill when staff already use AI assistants, coding tools or AI features and the company needs rules people will follow, and asks "write our AI usage policy", "can staff use ChatGPT"…AI systemsGeneral, ISO 42001, EU AI ActTristan Roth
AI Act risk classificationUse this skill when a company must work out where each of its AI systems sits under the EU AI Act, and asks "is this high-risk", "classify our AI systems", "AI Act risk tier", "are we a provider or a…AI systemsEU AI ActTristan Roth
AI impact assessmentUse this skill when one AI system needs its impact on people and on the company assessed before launch, after a significant change, or because a customer, auditor or regulator asks for it, and the…AI systemsISO 42001, EU AI ActTristan Roth
AI management system scopeUse this skill when a company that already runs a security management system wants to add an AI management system, or is preparing for an AI governance certification, and asks "scope our AI…AI systemsISO 42001Tristan Roth
AI system inventoryUse this skill when a company needs to know what AI it builds, buys or uses, before an AI governance programme, an AI regulation review or a customer questionnaire, and asks "list our AI systems"…AI systemsEU AI Act, ISO 42001Tristan Roth
AI vendor due diligenceUse this skill when the company is about to buy, renew or switch on an AI product or an AI feature inside an existing product, and asks "assess this AI vendor", "do they train on our data", "AI…AI systemsISO 42001, GDPR, EU AI ActTristan Roth
Applicability status reconciliationUse this skill when the implementation status column of a statement of applicability may not match reality, and the team asks "is our SoA accurate", "check the implemented column", "do we have…Statement of applicabilityISO 27001Tristan Roth
Auditor interview prepUse this skill when process owners, engineers or executives will be interviewed in an external or internal audit and need to be ready, or when someone asks "prepare the team for the auditor…Audit prep and responseISO 27001, SOC 2, GeneralTristan Roth
Auditor sample preparationUse this skill when an external audit, attestation examination or assessment is coming and the team wants populations and evidence ready for the samples the auditor will pull, or asks "prepare for…Audit prep and responseISO 27001, SOC 2, PCI DSSTristan Roth
Backup restore test evidenceUse this skill when a restore test is due, an auditor or customer asks for proof that backups can be recovered, or someone says "plan a restore test", "prove we can recover in time", "our backups…EvidenceISO 27001, SOC 2, DORA, HIPAATristan Roth
Business impact analysisUse this skill when a company needs recovery objectives it can defend, before a continuity plan, a disaster recovery design, an audit or a resilience review, and asks "do a BIA", "business impact…Incidents and continuityISO 27001, DORA, NIS 2, GeneralTristan Roth
Change management evidence samplingUse this skill when an auditor will test change management, or the team wants to know before they do, and asks "sample our production changes", "check our PR approvals", "do we have segregation of…EvidenceSOC 2, ISO 27001Tristan Roth
Continuity tabletop designUse this skill when a company must test its incident response or continuity plan without breaking anything, because an audit, a customer, a regulator or the plan itself calls for an exercise, and…Incidents and continuityISO 27001, SOC 2, DORA, NIS 2Tristan Roth
Control owner RACIUse this skill when controls have no clear owner, or "security" owns everything, and the team asks "who owns each control", "build a RACI for our controls", "assign control owners", "nobody knows who…Statement of applicabilityISO 27001, SOC 2, GeneralTristan Roth
Customer security questionnaire answersUse this skill when a customer or prospect has sent a security questionnaire, due diligence form or vendor assessment and someone asks "answer this security questionnaire", "fill in the customer's…Vendors and third partiesGeneral, SOC 2, ISO 27001, GDPRTristan Roth
Data processing agreement security annex reviewUse this skill when a data processing agreement is being negotiated or renewed and someone asks "review the TOMs annex", "check the security measures in this DPA", "can we sign this annex", "the…Vendors and third partiesGDPRTristan Roth
Data subject request procedureUse this skill when a company needs a working process for privacy requests, or just received one and has none, and asks "DSAR procedure", "how do we handle a subject access request", "someone asked…PrivacyGDPR, ISO 27701Tristan Roth
Document consistency checkUse this skill when a set of policies, procedures, plans and registers has grown in pieces and someone asks "check our documents for contradictions", "are our policies consistent", "the retention…Policies and documentationGeneralTristan Roth
DPIA screeningUse this skill when a new product feature, vendor, AI use, monitoring tool or change in processing raises the question "do we need a DPIA", or someone asks "DPIA screening", "is this high risk…PrivacyGDPR, ISO 27701Tristan Roth
Evidence freshness checkUse this skill when an audit, attestation period or customer review is coming and someone asks "is our evidence up to date", "check the evidence folder before the auditor sees it", "which screenshots…EvidenceGeneral, ISO 27001, SOC 2Tristan Roth
Evidence request list builderUse this skill when an auditor, assessor or regulator has sent a request list and the team asks "turn the auditor's request list into tasks", "who needs to provide what", "build the evidence…EvidenceISO 27001, SOC 2, NIS 2, DORATristan Roth
Exclusion justification reviewUse this skill when a statement of applicability already exists and the team wants its exclusions to survive the audit, and asks "review our SoA exclusions", "is this a valid justification", "can we…Statement of applicabilityISO 27001, ISO 27701, ISO 42001Tristan Roth
First gap assessmentUse this skill when a company starts a compliance programme and needs to know how far it is from a framework, and asks "run a gap analysis", "how ready are we for the audit", "baseline us against the…Gap and readinessGeneral, ISO 27001, SOC 2, HIPAA, NIS 2, ISO 42001Tristan Roth
GRC setup reviewUse this skill when someone wants to know where to start with the grcskills library, or asks "review my GRC setup", "what should I fix before the audit", "which compliance skills do I need", "audit…Gap and readinessGeneral, ISO 27001, SOC 2, GDPR, NIS 2, DORA, ISO 42001, EU AI ActTristan Roth
Health data flow mappingUse this skill when a covered entity or business associate needs to know where protected health information lives and moves, or asks "map our PHI", "ePHI inventory", "HIPAA data flow diagram", "where…PrivacyHIPAATristan Roth
ICT risk framework checkUse this skill when a bank, payment or e-money institution, investment firm, insurer, crypto-asset service provider or other financial entity in scope of DORA needs to know whether its ICT risk…RiskDORATristan Roth
ICT third-party registerUse this skill when a financial entity in scope of DORA needs to build or refresh its register of ICT third-party arrangements, and someone asks "build our register of information", "list our ICT…Vendors and third partiesDORATristan Roth
Incident response plan draftingUse this skill when a company has no incident response plan, has one copied from a template that names teams it does not have, or an auditor, customer or insurer asks for it, and the team says "write…Incidents and continuityISO 27001, SOC 2, HIPAA, NIS 2Tristan Roth
Incident severity triageUse this skill when something is happening now: an alert, a suspicious login, a ransomware note, data sent to the wrong customer, an outage that might be an attack, and someone asks "how bad is…Incidents and continuityGeneral, ISO 27001, SOC 2, NIS 2, DORATristan Roth
Internal audit checklist from scopeUse this skill when an internal auditor has one process or area to audit and needs a working checklist built from the company's own documents, or asks "build an internal audit checklist", "audit…Audit prep and responseISO 27001, ISO 42001, GDPR, NIS 2, DORATristan Roth
Internal audit programme planningUse this skill when a company needs its internal audit programme for the certification or examination cycle, or asks "plan our internal audits", "internal audit schedule for the year", "audit…Audit prep and responseISO 27001, ISO 27701, ISO 42001, SOC 2Tristan Roth
Logging and monitoring evidence packUse this skill when an auditor, customer or regulator will ask how security events are logged and watched, and someone says "prepare logging evidence", "show we monitor alerts", "what do we log and…EvidenceISO 27001, SOC 2, NIS 2Tristan Roth
Management review packUse this skill when leadership is due to review the security, privacy or AI management system, or when someone asks "prepare the management review", "management review agenda", "board pack for the…Audit prep and responseISO 27001, ISO 27701, ISO 42001Tristan Roth
Multi-framework overlap mapUse this skill when a company answers to two or more frameworks and is collecting the same evidence twice, and asks "map our controls across frameworks", "crosswalk between our certification and our…Gap and readinessGeneral, ISO 27001, SOC 2, NIS 2, NIST CSF, GDPRTristan Roth
NIS 2 entity applicability checkUse this skill when a company needs to know whether the NIS 2 Directive applies to it, and asks "are we in scope of NIS 2", "are we an essential or important entity", "which country supervises us"…Gap and readinessNIS 2Tristan Roth
Nonconformity root cause and corrective actionUse this skill when an internal or external audit raised a nonconformity, finding, exception or observation and the team must answer it, or asks "write the corrective action plan", "root cause for…Audit prep and responseISO 27001, ISO 27701, ISO 42001, SOC 2, GeneralTristan Roth
Policy gap review against practiceUse this skill when a team suspects its policies describe a company that does not exist, before an audit or customer review, or asks "do our policies match what we actually do", "check the policy…Policies and documentationGeneral, ISO 27001, SOC 2Tristan Roth
Policy review cycle refreshUse this skill when the periodic policy review is due or overdue, or someone asks "run the annual policy review", "our policies are out of date", "re-approve the policies before the audit", "what…Policies and documentationGeneral, ISO 27001, SOC 2Tristan Roth
Post-incident reviewUse this skill when an incident or a serious near miss is closed and the team must learn from it, or an auditor asks for lessons learned, and someone says "run the post-mortem", "post-incident…Incidents and continuityGeneral, ISO 27001, SOC 2Tristan Roth
Privacy and AI control applicabilityUse this skill when a company with a security applicability statement extends its management system to privacy or to AI, and asks "extend our SoA for privacy", "which privacy controls apply to a…Statement of applicabilityISO 27701, ISO 42001Tristan Roth
Privacy notice gap checkUse this skill when a published privacy notice may no longer match what the company does, or someone asks "is our privacy policy accurate", "check our privacy notice against the RoPA", "privacy…PrivacyGDPRTristan Roth
Records of processing first draftUse this skill when a company needs its record of processing activities for the first time, or has one that is really a list of tools, and asks "build our RoPA", "records of processing", "data map…PrivacyGDPR, ISO 27701Tristan Roth
Regulatory incident reporting clockUse this skill when an incident may have to be reported to an authority, customers or affected people, and the team asks "do we have to notify", "72 hours", "24 hour early warning", "is this a…Incidents and continuityNIS 2, DORA, GDPR, HIPAATristan Roth
Risk acceptance memoUse this skill when a risk owner wants to accept a residual risk instead of treating it further, or when someone asks "write a risk acceptance", "we want to accept this risk", "risk exception form"…RiskGeneral, ISO 27001, DORATristan Roth
Risk method draftingUse this skill when a company needs a written risk assessment method before it builds or rescores a register, or when the current method produces registers where everything scores 3. Triggers: "write…RiskISO 27001, ISO 27701, ISO 42001, DORA, GeneralTristan Roth
Risk register first passUse this skill when a team needs its first information security risk register, or has one that is a copied catalogue nobody owns, and asks "build our risk register", "draft a risk assessment", "what…RiskISO 27001, SOC 2, NIS 2, DORA, GeneralTristan Roth
Risk register hygiene reviewUse this skill when an existing risk register needs a check before an audit, a management review or a new owner takes it over, or when someone asks "clean up our risk register", "is our risk register…RiskGeneral, ISO 27001, SOC 2Tristan Roth
Risk to control traceability checkUse this skill when the risk register and the statement of applicability were written separately and may not agree, and the team asks "do our risks link to our controls", "traceability between risk…Statement of applicabilityISO 27001, ISO 42001Tristan Roth
Risk treatment plan draftingUse this skill when a risk register has treatment decisions but no plan anyone can execute, or when someone asks "write the risk treatment plan", "turn the risk register into actions", "what do we do…RiskISO 27001, SOC 2, GeneralTristan Roth
Scope statement draftingUse this skill when a team must define what its management system covers before a certification project, or its current scope is one vague sentence, and asks "write our ISMS scope", "what should be…Gap and readinessISO 27001, ISO 27701, ISO 42001Tristan Roth
Secure development policy from the pipelineUse this skill when an engineering team needs a secure development policy, or has one that does not match how code really ships, and asks "write our secure SDLC policy", "secure development policy…Policies and documentationISO 27001, SOC 2, Cyber Resilience ActTristan Roth
Security policy draftingUse this skill when a company needs its information security policy set written or rebuilt, or asks "write our security policies", "draft the information security policy", "we need policies for the…Policies and documentationISO 27001, SOC 2, HIPAA, GDPRTristan Roth
Stage 1 readiness walkUse this skill when a certification audit is booked and the team wants to know whether the first stage will go through, and asks "are we ready for stage 1", "pre-audit readiness check", "what will…Gap and readinessISO 27001, ISO 27701, ISO 42001Tristan Roth
Statement of applicability first draftUse this skill when a company has a risk assessment and treatment plan and now needs its first statement of applicability, and asks "build our SoA", "draft the statement of applicability", "which…Statement of applicabilityISO 27001Tristan Roth
Subprocessor register updateUse this skill when the company acts as a processor for its customers and someone asks "update our subprocessor list", "are we missing subprocessors", "we added a new tool, do we need to tell…Vendors and third partiesGDPR, ISO 27701Tristan Roth
Transfer impact assessmentUse this skill when personal data goes, or will go, to a recipient outside the EEA, or someone asks "do we need a TIA", "transfer impact assessment", "SCCs for this vendor", "can we use this US…PrivacyGDPRTristan Roth
Vendor security questionnaire triageUse this skill when a supplier has returned a security questionnaire, assurance report, certificate or trust pack and someone asks "review this vendor's answers", "is this supplier safe to use"…Vendors and third partiesGeneral, ISO 27001, SOC 2, GDPRTristan Roth
Vendor tieringUse this skill when a company needs to decide how much assessment each supplier deserves, or asks "tier our vendors", "which suppliers are critical", "we have 200 vendors and cannot assess them all"…Vendors and third partiesGeneral, ISO 27001, SOC 2, DORA, NIS 2Tristan Roth

grcskillsOpen source, MIT licensed

Skills Contribute GitHub llms.txt

by ISMS Copilot

ISO, IEC, AICPA, SOC 2, PCI DSS, NIST and other framework names appear only as tags saying which framework a skill relates to; they belong to their owners. grcskills is not affiliated with, endorsed by or sponsored by any standards body or regulator, and the skills contain no text from the standards.