skills.rest
alirezarezvani
alirezarezvaniCOMMUNITY
Explore all skills by this author →
Website𝕏@RezaRezvaniBlnGitHub

ciso-review

Reviews plans touching data or compliance through six CISO threat-modeling questions.

25.3k|3.6k|Updated Oct 19, 2025
Search Tags:#security review#threat model#soc 2#ciso#Stride#Risk Assessment#Compliance
One-click install
npx skills add https://github.com/alirezarezvani/claude-skills --skill ciso-review
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ciso-review
Source: https://github.com/alirezarezvani/claude-skills/tree/main/c-level-agents/skills/ciso-review
Command: npx skills add https://github.com/alirezarezvani/claude-skills --skill ciso-review

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security and compliance risks in plans that touch customer data, production access, or regulated systems are often discovered too late. This Skill forces a structured risk interrogation before shipping, so threat models, blast radius, detection, and regulatory obligations are addressed upfront.

Core Features & Use Cases

  • Six CISO Forcing Questions: Covers STRIDE threat modeling, blast radius quantification via FAIR-based ALE, detection/MTTD, incident response readiness, regulatory notification windows (GDPR 72h, HIPAA 60d), and vendor/supply-chain posture.
  • Structured Verdict Output: Produces a markdown review report ending in a SHIP, MITIGATE THEN SHIP, or BLOCK verdict.
  • Use Case: Before deploying a feature that stores customer PII, run the review to identify the top STRIDE threat, confirm an IR runbook exists, verify DPA coverage for new vendors, and document risk acceptance.

Quick Start

Ask the AI to run /cs:ciso-review on your launch plan for a feature that handles customer data before your SOC 2 audit.

Frequently Asked Questions about ciso-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security review on a plan before launch?▼

Invoke /cs:ciso-review with your plan to walk through six questions covering threat model, blast radius, detection, response, regulatory windows, and vendors. The output is a structured markdown report ending in a SHIP, MITIGATE THEN SHIP, or BLOCK verdict.

What is a STRIDE threat model and how is it used here?▼

STRIDE categorizes threats as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. The review asks you to pick the top three threats by likelihood times impact for the system under review.

When should I run a CISO-style risk review?▼

Run it before deploying systems touching PII, PHI, or cardholder data, before signing vendors with data access, before SOC 2, ISO 27001, HIPAA, or GDPR audits, before architecture decisions crossing trust boundaries, and after any near-miss incident.

Does this review cover regulatory breach notification requirements?▼

Yes, it asks for the regulator notification window per scenario, citing GDPR's 72-hour and HIPAA's 60-day windows, and prompts you to pre-write customer communication templates before shipping.

What are the limitations of a question-based security review?▼

It is a forcing-function checklist, not a penetration test or automated scanner. It depends on honest, informed answers and should be paired with technical testing, tabletop exercises, and the referenced risk quantifier and compliance tracker scripts.

Related Skills

Explore More Legal & Compliance Skills→
sjinkssjinks

security-review-owasp-threat-modeling

Analyze threat models for missing trust boundaries and unmitigated STRIDE risks.

Community
Advanced
jaimedhenriquesjaimedhenriques

legal-risk-assessment

Classify legal risks into severity and likelihood scores for escalation decisions.

Community
Advanced
kcass16kcass16
11

kevin

Analyze AI legal and compliance issues for startup vendor contracts.

Community
Advanced
paulundpaulund

security

Audit web applications and infrastructure for security vulnerabilities.

Community
Advanced