Tristan Roth
Founder, Better ISMS (makers of ISMS Copilot). ISO 27001 Lead Auditor
Tristan Roth founded Better ISMS, the company behind ISMS Copilot, a GRC specialist that people and their AI agents call for framework work. He is a certified ISO 27001 Lead Auditor and runs internal audits for software companies. The skills under his name encode the checks he makes before an external auditor does.
60 skills
- Acceptable use policy draftingUse this skill when a company needs rules for how staff use company systems, data, devices and AI tools, or asks "write our acceptable use policy", "AUP for employees", "can staff use ChatGPT at…
- Access review campaign prepUse this skill when a periodic user access review is due, an auditor asked for access review evidence, or someone says "prepare the access review", "run the quarterly user recertification", "who…
- AI acceptable use rulesUse this skill when staff already use AI assistants, coding tools or AI features and the company needs rules people will follow, and asks "write our AI usage policy", "can staff use ChatGPT"…
- AI Act risk classificationUse this skill when a company must work out where each of its AI systems sits under the EU AI Act, and asks "is this high-risk", "classify our AI systems", "AI Act risk tier", "are we a provider or a…
- AI impact assessmentUse this skill when one AI system needs its impact on people and on the company assessed before launch, after a significant change, or because a customer, auditor or regulator asks for it, and the…
- AI management system scopeUse this skill when a company that already runs a security management system wants to add an AI management system, or is preparing for an AI governance certification, and asks "scope our AI…
- AI system inventoryUse this skill when a company needs to know what AI it builds, buys or uses, before an AI governance programme, an AI regulation review or a customer questionnaire, and asks "list our AI systems"…
- AI vendor due diligenceUse this skill when the company is about to buy, renew or switch on an AI product or an AI feature inside an existing product, and asks "assess this AI vendor", "do they train on our data", "AI…
- Applicability status reconciliationUse this skill when the implementation status column of a statement of applicability may not match reality, and the team asks "is our SoA accurate", "check the implemented column", "do we have…
- Auditor interview prepUse this skill when process owners, engineers or executives will be interviewed in an external or internal audit and need to be ready, or when someone asks "prepare the team for the auditor…
- Auditor sample preparationUse this skill when an external audit, attestation examination or assessment is coming and the team wants populations and evidence ready for the samples the auditor will pull, or asks "prepare for…
- Backup restore test evidenceUse this skill when a restore test is due, an auditor or customer asks for proof that backups can be recovered, or someone says "plan a restore test", "prove we can recover in time", "our backups…
- Business impact analysisUse this skill when a company needs recovery objectives it can defend, before a continuity plan, a disaster recovery design, an audit or a resilience review, and asks "do a BIA", "business impact…
- Change management evidence samplingUse this skill when an auditor will test change management, or the team wants to know before they do, and asks "sample our production changes", "check our PR approvals", "do we have segregation of…
- Continuity tabletop designUse this skill when a company must test its incident response or continuity plan without breaking anything, because an audit, a customer, a regulator or the plan itself calls for an exercise, and…
- Control owner RACIUse this skill when controls have no clear owner, or "security" owns everything, and the team asks "who owns each control", "build a RACI for our controls", "assign control owners", "nobody knows who…
- Customer security questionnaire answersUse this skill when a customer or prospect has sent a security questionnaire, due diligence form or vendor assessment and someone asks "answer this security questionnaire", "fill in the customer's…
- Data processing agreement security annex reviewUse this skill when a data processing agreement is being negotiated or renewed and someone asks "review the TOMs annex", "check the security measures in this DPA", "can we sign this annex", "the…
- Data subject request procedureUse this skill when a company needs a working process for privacy requests, or just received one and has none, and asks "DSAR procedure", "how do we handle a subject access request", "someone asked…
- Document consistency checkUse this skill when a set of policies, procedures, plans and registers has grown in pieces and someone asks "check our documents for contradictions", "are our policies consistent", "the retention…
- DPIA screeningUse this skill when a new product feature, vendor, AI use, monitoring tool or change in processing raises the question "do we need a DPIA", or someone asks "DPIA screening", "is this high risk…
- Evidence freshness checkUse this skill when an audit, attestation period or customer review is coming and someone asks "is our evidence up to date", "check the evidence folder before the auditor sees it", "which screenshots…
- Evidence request list builderUse this skill when an auditor, assessor or regulator has sent a request list and the team asks "turn the auditor's request list into tasks", "who needs to provide what", "build the evidence…
- Exclusion justification reviewUse this skill when a statement of applicability already exists and the team wants its exclusions to survive the audit, and asks "review our SoA exclusions", "is this a valid justification", "can we…
- First gap assessmentUse this skill when a company starts a compliance programme and needs to know how far it is from a framework, and asks "run a gap analysis", "how ready are we for the audit", "baseline us against the…
- GRC setup reviewUse this skill when someone wants to know where to start with the grcskills library, or asks "review my GRC setup", "what should I fix before the audit", "which compliance skills do I need", "audit…
- Health data flow mappingUse this skill when a covered entity or business associate needs to know where protected health information lives and moves, or asks "map our PHI", "ePHI inventory", "HIPAA data flow diagram", "where…
- ICT risk framework checkUse this skill when a bank, payment or e-money institution, investment firm, insurer, crypto-asset service provider or other financial entity in scope of DORA needs to know whether its ICT risk…
- ICT third-party registerUse this skill when a financial entity in scope of DORA needs to build or refresh its register of ICT third-party arrangements, and someone asks "build our register of information", "list our ICT…
- Incident response plan draftingUse this skill when a company has no incident response plan, has one copied from a template that names teams it does not have, or an auditor, customer or insurer asks for it, and the team says "write…
- Incident severity triageUse this skill when something is happening now: an alert, a suspicious login, a ransomware note, data sent to the wrong customer, an outage that might be an attack, and someone asks "how bad is…
- Internal audit checklist from scopeUse this skill when an internal auditor has one process or area to audit and needs a working checklist built from the company's own documents, or asks "build an internal audit checklist", "audit…
- Internal audit programme planningUse this skill when a company needs its internal audit programme for the certification or examination cycle, or asks "plan our internal audits", "internal audit schedule for the year", "audit…
- Logging and monitoring evidence packUse this skill when an auditor, customer or regulator will ask how security events are logged and watched, and someone says "prepare logging evidence", "show we monitor alerts", "what do we log and…
- Management review packUse this skill when leadership is due to review the security, privacy or AI management system, or when someone asks "prepare the management review", "management review agenda", "board pack for the…
- Multi-framework overlap mapUse this skill when a company answers to two or more frameworks and is collecting the same evidence twice, and asks "map our controls across frameworks", "crosswalk between our certification and our…
- NIS 2 entity applicability checkUse this skill when a company needs to know whether the NIS 2 Directive applies to it, and asks "are we in scope of NIS 2", "are we an essential or important entity", "which country supervises us"…
- Nonconformity root cause and corrective actionUse this skill when an internal or external audit raised a nonconformity, finding, exception or observation and the team must answer it, or asks "write the corrective action plan", "root cause for…
- Policy gap review against practiceUse this skill when a team suspects its policies describe a company that does not exist, before an audit or customer review, or asks "do our policies match what we actually do", "check the policy…
- Policy review cycle refreshUse this skill when the periodic policy review is due or overdue, or someone asks "run the annual policy review", "our policies are out of date", "re-approve the policies before the audit", "what…
- Post-incident reviewUse this skill when an incident or a serious near miss is closed and the team must learn from it, or an auditor asks for lessons learned, and someone says "run the post-mortem", "post-incident…
- Privacy and AI control applicabilityUse this skill when a company with a security applicability statement extends its management system to privacy or to AI, and asks "extend our SoA for privacy", "which privacy controls apply to a…
- Privacy notice gap checkUse this skill when a published privacy notice may no longer match what the company does, or someone asks "is our privacy policy accurate", "check our privacy notice against the RoPA", "privacy…
- Records of processing first draftUse this skill when a company needs its record of processing activities for the first time, or has one that is really a list of tools, and asks "build our RoPA", "records of processing", "data map…
- Regulatory incident reporting clockUse this skill when an incident may have to be reported to an authority, customers or affected people, and the team asks "do we have to notify", "72 hours", "24 hour early warning", "is this a…
- Risk acceptance memoUse this skill when a risk owner wants to accept a residual risk instead of treating it further, or when someone asks "write a risk acceptance", "we want to accept this risk", "risk exception form"…
- Risk method draftingUse this skill when a company needs a written risk assessment method before it builds or rescores a register, or when the current method produces registers where everything scores 3. Triggers: "write…
- Risk register first passUse this skill when a team needs its first information security risk register, or has one that is a copied catalogue nobody owns, and asks "build our risk register", "draft a risk assessment", "what…
- Risk register hygiene reviewUse this skill when an existing risk register needs a check before an audit, a management review or a new owner takes it over, or when someone asks "clean up our risk register", "is our risk register…
- Risk to control traceability checkUse this skill when the risk register and the statement of applicability were written separately and may not agree, and the team asks "do our risks link to our controls", "traceability between risk…
- Risk treatment plan draftingUse this skill when a risk register has treatment decisions but no plan anyone can execute, or when someone asks "write the risk treatment plan", "turn the risk register into actions", "what do we do…
- Scope statement draftingUse this skill when a team must define what its management system covers before a certification project, or its current scope is one vague sentence, and asks "write our ISMS scope", "what should be…
- Secure development policy from the pipelineUse this skill when an engineering team needs a secure development policy, or has one that does not match how code really ships, and asks "write our secure SDLC policy", "secure development policy…
- Security policy draftingUse this skill when a company needs its information security policy set written or rebuilt, or asks "write our security policies", "draft the information security policy", "we need policies for the…
- Stage 1 readiness walkUse this skill when a certification audit is booked and the team wants to know whether the first stage will go through, and asks "are we ready for stage 1", "pre-audit readiness check", "what will…
- Statement of applicability first draftUse this skill when a company has a risk assessment and treatment plan and now needs its first statement of applicability, and asks "build our SoA", "draft the statement of applicability", "which…
- Subprocessor register updateUse this skill when the company acts as a processor for its customers and someone asks "update our subprocessor list", "are we missing subprocessors", "we added a new tool, do we need to tell…
- Transfer impact assessmentUse this skill when personal data goes, or will go, to a recipient outside the EEA, or someone asks "do we need a TIA", "transfer impact assessment", "SCCs for this vendor", "can we use this US…
- Vendor security questionnaire triageUse this skill when a supplier has returned a security questionnaire, assurance report, certificate or trust pack and someone asks "review this vendor's answers", "is this supplier safe to use"…
- Vendor tieringUse this skill when a company needs to decide how much assessment each supplier deserves, or asks "tier our vendors", "which suppliers are critical", "we have 200 vendors and cannot assess them all"…