/cs:ciso-review — CISO Forcing Questions
/cs:ciso-review <plan> — Risk-paranoid interrogation of any plan that touches data, compliance, or production access.
How to use it
Claude Code
- Run the line below. It pulls the whole folder into
~/.claude/skills/ciso-review. - Describe your job in plain words. Claude Code follows the skill from there.
Claude Code — installs the whole folder, not just SKILL.md
npx degit alirezarezvani/claude-skills/c-level-agents/skills/ciso-review#main ~/.claude/skills/ciso-reviewFor one project only, change the path to .claude/skills/ciso-review.
Claude (web or desktop app)
- On this page open ⋯ → Download .md.
- Save it as SKILL.md in a folder, zip the folder, then Customize → Skills → + → Create skill → Upload a skill.
- Pick the file and Save. Claude shows the name and description and runs a security scan.
- Check the skill is switched on.
- Start a new chat and describe your job in plain words. The AI follows the skill from there.
ChatGPT or another app
- ChatGPT: make a Project and paste it into Instructions.
- Neither? Paste it at the top of a new chat — it works for that chat.
Not working?
- Check which app you pasted it into — the steps above name the right one.
- Some skills need the paid tier of Claude or ChatGPT.
Paste into Claude, ChatGPT or Cursor.
Source of /cs:ciso-review — CISO Forcing Questions
Show the full text114 lines
| name | description |
|---|---|
| ciso-review | /cs:ciso-review <plan> — Risk-paranoid interrogation of any plan that touches data, compliance, or production access. Use when launching features that handle customer data, before a SOC 2 / ISO audit, or after any incident or near-miss. |
/cs:ciso-review — CISO Forcing Questions
Command: /cs:ciso-review <plan>
The risk-paranoid threat-modeler. Six questions before any production change that touches customer data or compliance scope.
When to Run
- Before deploying any system that touches PII / PHI / cardholder data
- Before signing a new vendor with data access
- Before a compliance audit (SOC 2, ISO 27001, HIPAA, GDPR)
- Before any architecture decision crossing trust boundaries
- After any near-miss incident
The Six CISO Questions
1. Threat Model
What's the STRIDE threat model for this system, and which threat is most likely?
- Spoofing, Tampering, Repudiation, Info Disclosure, DoS, Elevation of Privilege.
- Pick the top 3 by likelihood × impact.
2. Blast Radius
If this is fully compromised, what data is exposed and how many users are affected?
- Worst case in plain English.
- Quantify in dollars via FAIR-based ALE.
3. Detection
What signals indicate compromise, and how long until they're triggered (MTTD)?
- Logs alone are not detection.
- Define the detection rule, the alert, and the on-call.
4. Response
Is there an IR runbook for this scenario, and has it been tabletop-tested?
- If no runbook: build one before ship.
- If untested: tabletop before ship.
5. Regulatory Window
What's the regulator notification window if this scenario occurs?
- GDPR: 72h. HIPAA: 60d. State breach laws vary.
- Pre-write the customer comms template.
6. Vendor & Supply Chain
Which third-party vendors are in scope, and what's their security posture?
- Subprocessor list current?
- DPAs in place?
- Last security review per vendor?
Workflow
python ../../../c-level-advisor/skills/ciso-advisor/scripts/risk_quantifier.py
python ../../../c-level-advisor/skills/ciso-advisor/scripts/compliance_tracker.py
Output Format
# CISO Review: <plan>
**Date:** YYYY-MM-DD
## Threat Model
- Top threat: <STRIDE category> — <description>
- Likelihood: H/M/L | Impact: H/M/L
- ALE: $X / year
## Blast Radius
- Data exposed (worst case): <description>
- Users affected: N
- Estimated cost: $X
## Detection
- MTTD target: X hours
- Current MTTD: X hours
- Detection rule: <name>
## Response
- IR runbook: ✅ / ❌
- Last tabletop: <date>
## Regulatory
- Frameworks in scope: SOC 2 / ISO 27001 / HIPAA / GDPR
- Notification window: X hours/days
## Vendors
- New vendors added: N
- DPAs signed: N / N
- Security reviews complete: N / N
## Verdict
🟢 SHIP | 🟡 MITIGATE THEN SHIP | 🔴 BLOCK
Routing
/cs:cto-review— architecture alignment/cs:gc-review— DPA, regulatory implications/cs:decide— log risk acceptance/cs:boardroom— for CRITICAL risks
Related
- Agent:
cs-ciso-advisor - Skill:
ciso-advisor - Compliance:
../../../ra-qm-team/
Version: 1.0.0
| 1 | |
| 2 | name "ciso-review" |
| 3 | description "/cs:ciso-review <plan> — Risk-paranoid interrogation of any plan that touches data, compliance, or production access. Use when launching features that handle customer data, before a SOC 2 / ISO audit, or after any incident or near-miss." |
| 4 | |
| 5 | |
| 6 | # /cs:ciso-review — CISO Forcing Questions |
| 7 | |
| 8 | **Command:** `/cs:ciso-review <plan>` |
| 9 | |
| 10 | The risk-paranoid threat-modeler. Six questions before any production change that touches customer data or compliance scope. |
| 11 | |
| 12 | ## When to Run |
| 13 | |
| 14 | Before deploying any system that touches PII / PHI / cardholder data |
| 15 | Before signing a new vendor with data access |
| 16 | Before a compliance audit (SOC 2, ISO 27001, HIPAA, GDPR) |
| 17 | Before any architecture decision crossing trust boundaries |
| 18 | After any near-miss incident |
| 19 | |
| 20 | ## The Six CISO Questions |
| 21 | |
| 22 | ### 1. Threat Model |
| 23 | **What's the STRIDE threat model for this system, and which threat is most likely?** |
| 24 | Spoofing, Tampering, Repudiation, Info Disclosure, DoS, Elevation of Privilege. |
| 25 | Pick the top 3 by likelihood × impact. |
| 26 | |
| 27 | ### 2. Blast Radius |
| 28 | **If this is fully compromised, what data is exposed and how many users are affected?** |
| 29 | Worst case in plain English. |
| 30 | Quantify in dollars via FAIR-based ALE. |
| 31 | |
| 32 | ### 3. Detection |
| 33 | **What signals indicate compromise, and how long until they're triggered (MTTD)?** |
| 34 | Logs alone are not detection. |
| 35 | Define the detection rule, the alert, and the on-call. |
| 36 | |
| 37 | ### 4. Response |
| 38 | **Is there an IR runbook for this scenario, and has it been tabletop-tested?** |
| 39 | If no runbook: build one before ship. |
| 40 | If untested: tabletop before ship. |
| 41 | |
| 42 | ### 5. Regulatory Window |
| 43 | **What's the regulator notification window if this scenario occurs?** |
| 44 | GDPR: 72h. HIPAA: 60d. State breach laws vary. |
| 45 | Pre-write the customer comms template. |
| 46 | |
| 47 | ### 6. Vendor & Supply Chain |
| 48 | **Which third-party vendors are in scope, and what's their security posture?** |
| 49 | Subprocessor list current? |
| 50 | DPAs in place? |
| 51 | Last security review per vendor? |
| 52 | |
| 53 | ## Workflow |
| 54 | |
| 55 | |
| 56 | python ../../../c-level-advisor/skills/ciso-advisor/scripts/risk_quantifier.py |
| 57 | python ../../../c-level-advisor/skills/ciso-advisor/scripts/compliance_tracker.py |
| 58 | |
| 59 | |
| 60 | ## Output Format |
| 61 | |
| 62 | |
| 63 | # CISO Review: <plan> |
| 64 | **Date:** YYYY-MM-DD |
| 65 | |
| 66 | ## Threat Model |
| 67 | - Top threat: <STRIDE category> — <description> |
| 68 | - Likelihood: H/M/L | Impact: H/M/L |
| 69 | - ALE: $X / year |
| 70 | |
| 71 | ## Blast Radius |
| 72 | - Data exposed (worst case): <description> |
| 73 | - Users affected: N |
| 74 | - Estimated cost: $X |
| 75 | |
| 76 | ## Detection |
| 77 | - MTTD target: X hours |
| 78 | - Current MTTD: X hours |
| 79 | - Detection rule: <name> |
| 80 | |
| 81 | ## Response |
| 82 | - IR runbook: ✅ / ❌ |
| 83 | - Last tabletop: <date> |
| 84 | |
| 85 | ## Regulatory |
| 86 | - Frameworks in scope: SOC 2 / ISO 27001 / HIPAA / GDPR |
| 87 | - Notification window: X hours/days |
| 88 | |
| 89 | ## Vendors |
| 90 | - New vendors added: N |
| 91 | - DPAs signed: N / N |
| 92 | - Security reviews complete: N / N |
| 93 | |
| 94 | ## Verdict |
| 95 | 🟢 SHIP | 🟡 MITIGATE THEN SHIP | 🔴 BLOCK |
| 96 | |
| 97 | |
| 98 | ## Routing |
| 99 | |
| 100 | `/cs:cto-review` — architecture alignment |
| 101 | `/cs:gc-review` — DPA, regulatory implications |
| 102 | `/cs:decide` — log risk acceptance |
| 103 | `/cs:boardroom` — for CRITICAL risks |
| 104 | |
| 105 | ## Related |
| 106 | |
| 107 | Agent: [`cs-ciso-advisor`] |
| 108 | Skill: [`ciso-advisor`] |
| 109 | Compliance: `../../../ra-qm-team/` |
| 110 | |
| 111 | |
| 112 | |
| 113 | **Version:** 1.0.0 |
| 114 |
Discussion
Gdpr data handlingImplement GDPR-compliant data handling with consent management, data subject rights, and privacy by design. Use when building systems that process EU personal data, implementing privacy controls, or conducting GDPR compliance reviews.Pci complianceImplement PCI DSS compliance requirements for secure handling of payment card data and payment systems. Use when securing payment processing, achieving PCI compliance, or implementing payment card security measures.Compliance OS — Meta-OrchestratorCompliance OS — meta-orchestrator that lets compliance teams CONFIGURE which frameworks apply, COMPUTE cross-framework control overlap, SIMULATE internal audits, and CONSOLIDATE evidence across multiple frameworks. Four decisions: (1) Given a company profile, which of the 12 supported frameworks apply (ISO 27001/13485/42001/14971, EU AI Act, MDR 745, GDPR, SOC 2, FDA QSR, NIST CSF 2.0, NIS2, HIPAA)? (2) Across selected frameworks, which controls overlap and how much evidence reuses? (3) For a given framework + scope, what does a realistic mock audit produce — drawing from the 205-scenario library? (4) Across selected frameworks, what's the unified evidence checklist with reuse map? Use when standing up a multi-framework program, planning the annual audit calendar, or preparing for certification stage 1. Does NOT replace per-framework skills (it orchestrates them).Fda consultant specialistFDA regulatory consultant for medical device companies. Provides 510(k)/PMA/De Novo pathway guidance, QMSR (21 CFR 820, which incorporates ISO 13485:2016 by reference since 2026-02-02; formerly QSR) compliance, HIPAA assessments, and device cybersecurity. Use when user mentions FDA submission, 510(k), PMA, De Novo, QMSR, QSR, ISO 13485 for FDA, premarket, predicate device, substantial equivalence, HIPAA medical device, or FDA cybersecurity.
Browse more free Claude skills or everything in Legal & compliance.