security-architecture

Security architecture documentation for ISO 27001 requires structured files like SECURITY_ARCHITECTURE.md and THREAT_MODEL.md. This skill scaffolds these documents, mapping defense-in-depth strategies and governance controls directly to ISO 27001 and NIST CSF standards.

Defense-in-depth is a multi-layered security strategy documented within a formal security architecture. This skill enforces its documentation by generating dedicated threat models and architecture guidelines that map layered controls to CIS and NIST CSF frameworks.

Generating a threat model document involves creating a structured THREAT_MODEL.md file. This skill automates that scaffolding, ensuring the threat model aligns with your repository's security posture and integrates with the main README security section.

Yes, NIST CSF and CIS Controls mapping is supported. The skill structures your security architecture documentation to explicitly align with these governance frameworks, ensuring formal controls are auditable and integrated into your repository policy.

A complete repository security policy requires SECURITY_ARCHITECTURE.md, FUTURE_SECURITY_ARCHITECTURE.md, THREAT_MODEL.md, and a .github/SECURITY.md file. This skill creates and maintains all required documentation scaffolding to enforce architecture reviews.

Yes, you can use this to document governance controls for security audits. It structures architecture documentation across formal security controls and threat models, providing the operational clarity and compliance mapping needed for ISMS audit readiness.