Maps Azure resources to MCSB v2 control domains with NIST 800-53 and CIS crosswalks.
npx skills add https://github.com/microsoft/hve-core --skill mcsb
Please help me install this Agent Skill. Skill: mcsb Source: https://github.com/microsoft/hve-core/tree/main/.github/skills/security/mcsb Command: npx skills add https://github.com/microsoft/hve-core --skill mcsb
Security planners and reviewers need a consistent control vocabulary to assess Azure resources against the Microsoft Cloud Security Benchmark, but the benchmark's per-service details change constantly and are hard to keep current.
Review my Azure architecture against the MCSB control domains and identify security gaps mapped to NIST 800-53 and CIS Controls.
High-intent search queries and answers about installing and using this skill.
Use the 12 MCSB v2 control-domain references, each containing an assessment checklist of observable indicators such as private endpoints, managed identities, and diagnostic logging. Map findings back to domains using the control index.
MCSB v2 replaces v1's Governance and Strategy (GS) domain with an Artificial Intelligence Security (AI) domain. It also updates framework mappings to NIST SP 800-53 Rev. 5 and CIS Controls v8.1, whereas v1 mapped to Rev. 4 and CIS v8.
Each control domain includes a representative crosswalk to NIST SP 800-53 Rev. 5 families and CIS Controls v8.1. For example, Network Security maps to NIST families AC, CA, CM, SC, SI and CIS Controls 9, 12, 13.
No. Per-service baselines, Azure Policy mappings, and Defender for Cloud specifics are volatile and intentionally excluded. They are retrieved at runtime by delegating to a Researcher Subagent following the lookup playbook.
Re-verify before any compliance decision, since MCSB v2 is in preview and Microsoft revises the benchmark and referenced standards on its own release cadence. The skill content is version-pinned and retrieval-dated 2026-07-21.
qprjack86Analyze Azure resource groups and generate Mermaid architecture diagrams.
parandurume-labsAudit and harden Azure infrastructure security configurations across identity, network, and monitoring.
dreadnodeEnforce rigorous vulnerability assessment workflows with source-to-sink tracing and disprove-first validation.
aws-samplesMap service capabilities to CCMv4, NIST 800-53, CIS Benchmarks, and ISO 27001.
