AgentAlley
Submit

Isms audit expert skill

Senior ISMS Audit Expert for internal and external information security management system auditing.

by davila7·MIT license·★ 32,299 Stars on the repo·GitHub ↗

Use now

Files of Isms audit expert

davila7/main1 file shown
SKILL.md
Show the full text280 lines
isms-audit-expert-davila7/SKILL.md280 lines · 12.6 KB
Outline
RawView on GitHub

Senior ISMS Audit Expert

Expert-level Information Security Management System (ISMS) auditing with comprehensive knowledge of ISO 27001, security audit methodologies, security control assessment, and cybersecurity compliance verification.

Core ISMS Auditing Competencies

1. ISO 27001 ISMS Audit Program Management

Design and manage comprehensive ISMS audit programs ensuring systematic security evaluation and continuous improvement.

ISMS Audit Program Framework:

ISMS AUDIT PROGRAM MANAGEMENT
├── Security Audit Planning
│   ├── Risk-based audit scheduling
│   ├── Security domain scope definition
│   ├── Technical auditor competency
│   └── Security testing resource allocation
├── Audit Execution Coordination
│   ├── Technical security assessment
│   ├── Administrative control evaluation
│   ├── Physical security verification
│   └── Security documentation review
├── Security Finding Management
│   ├── Security gap identification
│   ├── Vulnerability assessment integration
│   ├── Risk-based finding prioritization
│   └── Security improvement recommendations
└── ISMS Audit Performance
    ├── Security audit effectiveness
    ├── Technical auditor development
    ├── Security methodology enhancement
    └── Industry best practice adoption
2. Risk-Based Security Audit Planning

Develop strategic security audit plans based on information security risks, threat landscape, and ISMS performance.

Security Audit Risk Assessment:

  1. Information Security Risk Evaluation

    • Asset criticality and threat exposure analysis
    • Security control effectiveness assessment
    • Previous security incident and audit analysis
    • Decision Point: Determine audit priority and frequency based on security risk

  2. Security Audit Scope Definition

    • High-Risk Assets: Quarterly technical security assessments
    • Critical Security Controls: Semi-annual control effectiveness testing
    • Standard Security Processes: Annual compliance verification
    • Emerging Threats: Event-driven security evaluations

  3. Technical Security Testing Integration

    • Vulnerability assessment and penetration testing coordination
    • Security control technical verification
    • Threat simulation and red team exercises
    • Compliance scanning and automated testing
3. ISO 27001 Audit Execution and Methodology

Conduct systematic ISMS audits using proven methodologies ensuring comprehensive security assessment.

ISMS Audit Execution Process:

  1. Security Audit Preparation

    • Pre-audit Security Review: Follow scripts/security-audit-prep.py
    • Technical Assessment Planning: Security testing scope and methods
    • Security Auditor Assignment: Technical competency and independence
    • ISMS Documentation Review: Policy, procedure, and control documentation

  2. Security Audit Conduct

    • ISMS Process Assessment: Security management process evaluation
    • Security Control Testing: Technical and administrative control verification
    • Security Compliance Verification: Regulatory and standard compliance
    • Security Culture Assessment: Security awareness and training effectiveness

  3. Security Audit Documentation

    • Security Finding Documentation: Technical and administrative findings
    • Risk Assessment Integration: Security risk impact and likelihood
    • Security Improvement Recommendations: Control enhancement and optimization
    • Compliance Status Reporting: ISO 27001 and regulatory compliance
4. Security Control Assessment and Testing

Conduct comprehensive security control assessments ensuring effective security implementation and operation.

Security Control Assessment Framework:

ISO 27002 CONTROL ASSESSMENT
├── Organizational Security Controls
│   ├── Information security policies
│   ├── Information security organization
│   ├── Human resource security
│   └── Asset management
├── Technical Security Controls
│   ├── Access control systems
│   ├── Cryptography implementation
│   ├── Systems security configuration
│   ├── Network security controls
│   ├── Application security measures
│   └── Secure development practices
├── Physical Security Controls
│   ├── Physical security perimeters
│   ├── Physical entry controls
│   ├── Equipment protection
│   └── Secure disposal procedures
└── Operational Security Controls
    ├── Operational procedures
    ├── Change management
    ├── Capacity management
    ├── System segregation
    ├── Malware protection
    └── Backup and recovery

Advanced ISMS Audit Applications

Technical Security Testing Integration

Integrate technical security assessments with ISMS auditing ensuring comprehensive security verification.

Technical Security Assessment:

  1. Vulnerability Assessment Integration

    • Network vulnerability scanning and analysis
    • Application security testing and code review
    • Configuration assessment and hardening verification
    • Decision Point: Determine technical testing scope based on risk and compliance

  2. Penetration Testing Coordination

    • For External Networks: Follow references/external-pentest-guide.md
    • For Internal Systems: Follow references/internal-pentest-guide.md
    • For Web Applications: Follow references/webapp-security-testing.md
    • Social engineering and phishing simulation

  3. Security Control Verification

    • Access control effectiveness testing
    • Encryption implementation verification
    • Monitoring and logging system assessment
    • Incident response procedure validation
Cybersecurity Compliance Auditing

Conduct specialized cybersecurity compliance audits addressing regulatory and industry requirements.

Cybersecurity Compliance Framework:

  • Healthcare Cybersecurity: HIPAA Security Rule and healthcare-specific requirements
  • Medical Device Cybersecurity: FDA cybersecurity guidance and IEC 62304 integration
  • Financial Services: PCI DSS and financial industry security standards
  • Critical Infrastructure: NIST Cybersecurity Framework and sector-specific guidelines
Cloud Security Auditing

Assess cloud security implementations ensuring comprehensive cloud service security verification.

Cloud Security Audit Approach:

  1. Cloud Service Provider Assessment

    • CSP security certification and compliance verification
    • Shared responsibility model implementation review
    • Data residency and sovereignty compliance
    • Cloud access and identity management assessment

  2. Cloud Configuration Assessment

    • Cloud resource configuration and hardening
    • Network security and segmentation verification
    • Data encryption and key management assessment
    • Cloud monitoring and logging evaluation

Security Auditor Competency and Development

Security Auditor Technical Competency

Develop and maintain security auditor technical competency ensuring effective security assessment capabilities.

Security Auditor Competency Framework:

SECURITY AUDITOR COMPETENCY
├── Technical Security Knowledge
│   ├── Network security and protocols
│   ├── System security and hardening
│   ├── Application security and testing
│   ├── Cryptography and key management
│   └── Security architecture and design
├── Security Assessment Skills
│   ├── Vulnerability assessment techniques
│   ├── Penetration testing methodologies
│   ├── Security control testing
│   └── Risk assessment and analysis
├── Compliance and Standards
│   ├── ISO 27001/27002 expertise
│   ├── Regulatory requirement knowledge
│   ├── Industry standard familiarity
│   └── Audit methodology proficiency
└── Communication and Reporting
    ├── Technical finding documentation
    ├── Risk communication skills
    ├── Executive reporting capabilities
    └── Stakeholder engagement
Security Audit Tool Proficiency

Maintain proficiency with security audit tools and technologies ensuring effective technical assessment.

Security Audit Tool Categories:

  • Vulnerability Scanners: Network, web application, and database vulnerability assessment
  • Penetration Testing Tools: Exploitation frameworks and security testing utilities
  • Configuration Assessment: System and application configuration analysis
  • Compliance Scanning: Automated compliance verification and reporting

External Security Audit Coordination

ISO 27001 Certification Audit Support

Prepare organization for ISO 27001 certification audits ensuring successful certification and maintenance.

Certification Audit Preparation:

  1. Pre-certification Readiness

    • Internal ISMS audit completion and closure
    • Security control implementation verification
    • ISMS documentation review and compliance
    • Mock Certification Audit: Full-scale external audit simulation

  2. Certification Audit Coordination

    • Stage 1 Audit Support: Documentation review and ISMS assessment
    • Stage 2 Audit Coordination: Implementation testing and verification
    • Surveillance Audit Preparation: Ongoing compliance and improvement
    • Certification body relationship management
Regulatory Security Inspection Preparation

Prepare organization for regulatory security inspections and compliance assessments.

Regulatory Inspection Coordination:

  • Healthcare Inspections: OCR HIPAA security audits and assessments
  • Financial Services: Regulatory cybersecurity examinations
  • Critical Infrastructure: Sector-specific security assessments
  • International Compliance: Multi-jurisdictional security requirements

ISMS Audit Performance and Improvement

Security Audit Performance Metrics

Monitor ISMS audit program effectiveness ensuring continuous security improvement and compliance.

Security Audit KPIs:

  • Security Control Effectiveness: Control implementation and operation success
  • Security Finding Resolution: Finding closure rates and timelines
  • Security Risk Mitigation: Risk reduction and residual risk management
  • Compliance Achievement: ISO 27001 and regulatory compliance rates
  • Security Incident Prevention: Audit-driven security improvement effectiveness
ISMS Audit Program Optimization

Continuously improve ISMS audit program through methodology enhancement and technology integration.

Audit Program Enhancement:

  1. Security Audit Technology Integration

    • Automated security scanning and assessment
    • Continuous security monitoring integration
    • Security information and event management (SIEM) correlation
    • Decision Point: Determine automation opportunities and tool integration

  2. Security Audit Methodology Evolution

    • Threat intelligence integration and analysis
    • Security framework alignment and optimization
    • Industry best practice adoption and customization
    • Regulatory requirement evolution and adaptation

Resources

scripts/
  • isms-audit-scheduler.py: Risk-based ISMS audit planning and scheduling
  • security-audit-prep.py: Security audit preparation and checklist automation
  • security-control-tester.py: Automated security control verification testing
  • compliance-reporting.py: ISO 27001 and regulatory compliance reporting
references/
  • iso27001-audit-methodology.md: Complete ISO 27001 audit framework and procedures
  • security-control-testing-guide.md: Technical security control assessment methodologies
  • external-pentest-guide.md: External penetration testing coordination and oversight
  • cloud-security-audit-guide.md: Cloud service security assessment frameworks
  • regulatory-security-compliance.md: Multi-jurisdictional security compliance requirements
assets/
  • isms-audit-templates/: ISMS audit plan, checklist, and report templates
  • security-testing-tools/: Security assessment and testing automation scripts
  • compliance-checklists/: ISO 27001 and regulatory compliance verification checklists
  • training-materials/: Security auditor training and competency development programs
1---
2name: isms-audit-expert
3description: Senior ISMS Audit Expert for internal and external information security management system auditing. Provides ISO 27001 audit expertise, security audit program management, security control assessment, and compliance verification. Use for ISMS internal auditing, external audit preparation, security control testing, and ISO 27001 certification support.
4---
5 
6# Senior ISMS Audit Expert
7 
8Expert-level Information Security Management System (ISMS) auditing with comprehensive knowledge of ISO 27001, security audit methodologies, security control assessment, and cybersecurity compliance verification.
9 
10## Core ISMS Auditing Competencies
11 
12### 1. ISO 27001 ISMS Audit Program Management
13Design and manage comprehensive ISMS audit programs ensuring systematic security evaluation and continuous improvement.
14 
15**ISMS Audit Program Framework:**
16```
17ISMS AUDIT PROGRAM MANAGEMENT
18├── Security Audit Planning
19│ ├── Risk-based audit scheduling
20│ ├── Security domain scope definition
21│ ├── Technical auditor competency
22│ └── Security testing resource allocation
23├── Audit Execution Coordination
24│ ├── Technical security assessment
25│ ├── Administrative control evaluation
26│ ├── Physical security verification
27│ └── Security documentation review
28├── Security Finding Management
29│ ├── Security gap identification
30│ ├── Vulnerability assessment integration
31│ ├── Risk-based finding prioritization
32│ └── Security improvement recommendations
33└── ISMS Audit Performance
34 ├── Security audit effectiveness
35 ├── Technical auditor development
36 ├── Security methodology enhancement
37 └── Industry best practice adoption
38```
39 
40### 2. Risk-Based Security Audit Planning
41Develop strategic security audit plans based on information security risks, threat landscape, and ISMS performance.
42 
43**Security Audit Risk Assessment:**
441. **Information Security Risk Evaluation**
45 - Asset criticality and threat exposure analysis
46 - Security control effectiveness assessment
47 - Previous security incident and audit analysis
48 - **Decision Point**: Determine audit priority and frequency based on security risk
49 
502. **Security Audit Scope Definition**
51 - **High-Risk Assets**: Quarterly technical security assessments
52 - **Critical Security Controls**: Semi-annual control effectiveness testing
53 - **Standard Security Processes**: Annual compliance verification
54 - **Emerging Threats**: Event-driven security evaluations
55 
563. **Technical Security Testing Integration**
57 - Vulnerability assessment and penetration testing coordination
58 - Security control technical verification
59 - Threat simulation and red team exercises
60 - Compliance scanning and automated testing
61 
62### 3. ISO 27001 Audit Execution and Methodology
63Conduct systematic ISMS audits using proven methodologies ensuring comprehensive security assessment.
64 
65**ISMS Audit Execution Process:**
661. **Security Audit Preparation**
67 - **Pre-audit Security Review**: Follow scripts/security-audit-prep.py
68 - **Technical Assessment Planning**: Security testing scope and methods
69 - **Security Auditor Assignment**: Technical competency and independence
70 - **ISMS Documentation Review**: Policy, procedure, and control documentation
71 
722. **Security Audit Conduct**
73 - **ISMS Process Assessment**: Security management process evaluation
74 - **Security Control Testing**: Technical and administrative control verification
75 - **Security Compliance Verification**: Regulatory and standard compliance
76 - **Security Culture Assessment**: Security awareness and training effectiveness
77 
783. **Security Audit Documentation**
79 - **Security Finding Documentation**: Technical and administrative findings
80 - **Risk Assessment Integration**: Security risk impact and likelihood
81 - **Security Improvement Recommendations**: Control enhancement and optimization
82 - **Compliance Status Reporting**: ISO 27001 and regulatory compliance
83 
84### 4. Security Control Assessment and Testing
85Conduct comprehensive security control assessments ensuring effective security implementation and operation.
86 
87**Security Control Assessment Framework:**
88```
89ISO 27002 CONTROL ASSESSMENT
90├── Organizational Security Controls
91│ ├── Information security policies
92│ ├── Information security organization
93│ ├── Human resource security
94│ └── Asset management
95├── Technical Security Controls
96│ ├── Access control systems
97│ ├── Cryptography implementation
98│ ├── Systems security configuration
99│ ├── Network security controls
100│ ├── Application security measures
101│ └── Secure development practices
102├── Physical Security Controls
103│ ├── Physical security perimeters
104│ ├── Physical entry controls
105│ ├── Equipment protection
106│ └── Secure disposal procedures
107└── Operational Security Controls
108 ├── Operational procedures
109 ├── Change management
110 ├── Capacity management
111 ├── System segregation
112 ├── Malware protection
113 └── Backup and recovery
114```
115 
116## Advanced ISMS Audit Applications
117 
118### Technical Security Testing Integration
119Integrate technical security assessments with ISMS auditing ensuring comprehensive security verification.
120 
121**Technical Security Assessment:**
1221. **Vulnerability Assessment Integration**
123 - Network vulnerability scanning and analysis
124 - Application security testing and code review
125 - Configuration assessment and hardening verification
126 - **Decision Point**: Determine technical testing scope based on risk and compliance
127 
1282. **Penetration Testing Coordination**
129 - **For External Networks**: Follow references/external-pentest-guide.md
130 - **For Internal Systems**: Follow references/internal-pentest-guide.md
131 - **For Web Applications**: Follow references/webapp-security-testing.md
132 - Social engineering and phishing simulation
133 
1343. **Security Control Verification**
135 - Access control effectiveness testing
136 - Encryption implementation verification
137 - Monitoring and logging system assessment
138 - Incident response procedure validation
139 
140### Cybersecurity Compliance Auditing
141Conduct specialized cybersecurity compliance audits addressing regulatory and industry requirements.
142 
143**Cybersecurity Compliance Framework:**
144- **Healthcare Cybersecurity**: HIPAA Security Rule and healthcare-specific requirements
145- **Medical Device Cybersecurity**: FDA cybersecurity guidance and IEC 62304 integration
146- **Financial Services**: PCI DSS and financial industry security standards
147- **Critical Infrastructure**: NIST Cybersecurity Framework and sector-specific guidelines
148 
149### Cloud Security Auditing
150Assess cloud security implementations ensuring comprehensive cloud service security verification.
151 
152**Cloud Security Audit Approach:**
1531. **Cloud Service Provider Assessment**
154 - CSP security certification and compliance verification
155 - Shared responsibility model implementation review
156 - Data residency and sovereignty compliance
157 - Cloud access and identity management assessment
158 
1592. **Cloud Configuration Assessment**
160 - Cloud resource configuration and hardening
161 - Network security and segmentation verification
162 - Data encryption and key management assessment
163 - Cloud monitoring and logging evaluation
164 
165## Security Auditor Competency and Development
166 
167### Security Auditor Technical Competency
168Develop and maintain security auditor technical competency ensuring effective security assessment capabilities.
169 
170**Security Auditor Competency Framework:**
171```
172SECURITY AUDITOR COMPETENCY
173├── Technical Security Knowledge
174│ ├── Network security and protocols
175│ ├── System security and hardening
176│ ├── Application security and testing
177│ ├── Cryptography and key management
178│ └── Security architecture and design
179├── Security Assessment Skills
180│ ├── Vulnerability assessment techniques
181│ ├── Penetration testing methodologies
182│ ├── Security control testing
183│ └── Risk assessment and analysis
184├── Compliance and Standards
185│ ├── ISO 27001/27002 expertise
186│ ├── Regulatory requirement knowledge
187│ ├── Industry standard familiarity
188│ └── Audit methodology proficiency
189└── Communication and Reporting
190 ├── Technical finding documentation
191 ├── Risk communication skills
192 ├── Executive reporting capabilities
193 └── Stakeholder engagement
194```
195 
196### Security Audit Tool Proficiency
197Maintain proficiency with security audit tools and technologies ensuring effective technical assessment.
198 
199**Security Audit Tool Categories:**
200- **Vulnerability Scanners**: Network, web application, and database vulnerability assessment
201- **Penetration Testing Tools**: Exploitation frameworks and security testing utilities
202- **Configuration Assessment**: System and application configuration analysis
203- **Compliance Scanning**: Automated compliance verification and reporting
204 
205## External Security Audit Coordination
206 
207### ISO 27001 Certification Audit Support
208Prepare organization for ISO 27001 certification audits ensuring successful certification and maintenance.
209 
210**Certification Audit Preparation:**
2111. **Pre-certification Readiness**
212 - Internal ISMS audit completion and closure
213 - Security control implementation verification
214 - ISMS documentation review and compliance
215 - **Mock Certification Audit**: Full-scale external audit simulation
216 
2172. **Certification Audit Coordination**
218 - **Stage 1 Audit Support**: Documentation review and ISMS assessment
219 - **Stage 2 Audit Coordination**: Implementation testing and verification
220 - **Surveillance Audit Preparation**: Ongoing compliance and improvement
221 - Certification body relationship management
222 
223### Regulatory Security Inspection Preparation
224Prepare organization for regulatory security inspections and compliance assessments.
225 
226**Regulatory Inspection Coordination:**
227- **Healthcare Inspections**: OCR HIPAA security audits and assessments
228- **Financial Services**: Regulatory cybersecurity examinations
229- **Critical Infrastructure**: Sector-specific security assessments
230- **International Compliance**: Multi-jurisdictional security requirements
231 
232## ISMS Audit Performance and Improvement
233 
234### Security Audit Performance Metrics
235Monitor ISMS audit program effectiveness ensuring continuous security improvement and compliance.
236 
237**Security Audit KPIs:**
238- **Security Control Effectiveness**: Control implementation and operation success
239- **Security Finding Resolution**: Finding closure rates and timelines
240- **Security Risk Mitigation**: Risk reduction and residual risk management
241- **Compliance Achievement**: ISO 27001 and regulatory compliance rates
242- **Security Incident Prevention**: Audit-driven security improvement effectiveness
243 
244### ISMS Audit Program Optimization
245Continuously improve ISMS audit program through methodology enhancement and technology integration.
246 
247**Audit Program Enhancement:**
2481. **Security Audit Technology Integration**
249 - Automated security scanning and assessment
250 - Continuous security monitoring integration
251 - Security information and event management (SIEM) correlation
252 - **Decision Point**: Determine automation opportunities and tool integration
253 
2542. **Security Audit Methodology Evolution**
255 - Threat intelligence integration and analysis
256 - Security framework alignment and optimization
257 - Industry best practice adoption and customization
258 - Regulatory requirement evolution and adaptation
259 
260## Resources
261 
262### scripts/
263- `isms-audit-scheduler.py`: Risk-based ISMS audit planning and scheduling
264- `security-audit-prep.py`: Security audit preparation and checklist automation
265- `security-control-tester.py`: Automated security control verification testing
266- `compliance-reporting.py`: ISO 27001 and regulatory compliance reporting
267 
268### references/
269- `iso27001-audit-methodology.md`: Complete ISO 27001 audit framework and procedures
270- `security-control-testing-guide.md`: Technical security control assessment methodologies
271- `external-pentest-guide.md`: External penetration testing coordination and oversight
272- `cloud-security-audit-guide.md`: Cloud service security assessment frameworks
273- `regulatory-security-compliance.md`: Multi-jurisdictional security compliance requirements
274 
275### assets/
276- `isms-audit-templates/`: ISMS audit plan, checklist, and report templates
277- `security-testing-tools/`: Security assessment and testing automation scripts
278- `compliance-checklists/`: ISO 27001 and regulatory compliance verification checklists
279- `training-materials/`: Security auditor training and competency development programs
280 

Discussion

Alternatives

Ad security reviewerUse this agent when you need to audit Active Directory security posture, evaluate privilege escalation risks, review identity delegation patterns, or assess authentication protocol hardening.Security · MITBest practicesApply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practices", "security audit", "modernize code", "code quality review", or "check for vulnerabilities".Coding · MITHallucination vulnerability prompt checkerIdentify structural openings in a prompt that may lead to hallucinated, fabricated, or over-assumed outputs.Coding · CC0-1.0Repository Security & Architecture Audit FrameworkResearch-backed repository audit workflow covering OWASP Top 10, SOLID principles, DORA metrics, and Google SRE production readiness criteria as knowledge anchors. Generated by prompt-forge.Infrastructure & ops · CC0-1.0

Browse more free Claude skills or everything in Development.