Percerno Skillsbeta
← everything it can do · finance

Ciso Review TEXT

Performs a risk-paranoid security review of a plan or system using six specific CISO questions covering threat modeling, blast radius, detection, response, regulatory windows, and vendor supply chain. Produces a structured markdown report with a final ship/block verdict based on quantified risk and compliance gaps.

2 uses this weeksource alirezarezvanilicence MIT
Quality gate: PASS · better answers · measured 2026-10-23
Blind-judged against the bare model on 2 requests: average lift +2.0 points (specificity, structure, method, fit).
won 1/2, lift +2.0, tokens ×19.48
Security scan: clean · 2026-10-24 · 1 files · ran in sandbox
no network calls, shell tricks, credential access or instruction tampering found in its files.

Try asking

Say it in your own words; the assistant finds this recipe by itself. Examples:

“Gennemfør en CISO-review af planen for den nye kundedatabase.”
“Vi skal udgive en funktion, der håndterer personoplysninger; er vi klar til GDPR?”
“Tjek sikkerheden for den nye leverandør, der får adgang til vores produktionssystem.”
“Run a CISO review on the new payment gateway integration plan.”
“We are launching a feature that stores user health data; check if we are ready for HIPAA.”
“Review the vendor onboarding process for the new analytics tool that accesses our database.”
Try this skill from Claude, ChatGPT or a chat on your own page. Free plan, no credit card.Get started free

Good for

securityrisk-assessmentcompliancethreat-modelingincident-responseauditdata-protectionciso

Not for

Do not use for general architectural design reviews that do not involve data security or compliance (use cto-review). Do not use for pure legal contract drafting or DPA negotiation (use gc-review). Do not use for routine code reviews or bug fixes that do not alter the security posture or data handling.

Details

When it is the right choice

Use this skill when evaluating any plan, feature, or architecture change that involves customer data, PII, or production access. It is essential before compliance audits (SOC 2, ISO 27001, GDPR) or after a security incident/near-miss to verify detection and response readiness. It is also appropriate when onboarding new vendors with data access rights.

The full recipe the assistant reads

/c-level-agents:ciso-review — CISO Forcing Questions

Command: /c-level-agents:ciso-review <plan>

The risk-paranoid threat-modeler. Six questions before any production change that touches customer data or compliance scope.

When to Run

  • Before deploying any system that touches PII / PHI / cardholder data
  • Before signing a new vendor with data access
  • Before a compliance audit (SOC 2, ISO 27001, HIPAA, GDPR)
  • Before any architecture decision crossing trust boundaries
  • After any near-miss incident

The Six CISO Questions

1. Threat Model

What's the STRIDE threat model for this system, and which threat is most likely? - Spoofing, Tampering, Repudiation, Info Disclosure, DoS, Elevation of Privilege. - Pick the top 3 by likelihood × impact.

2. Blast Radius

If this is fully compromised, what data is exposed and how many users are affected? - Worst case in plain English. - Quantify in dollars via FAIR-based ALE.

3. Detection

What signals indicate compromise, and how long until they're triggered (MTTD)? - Logs alone are not detection. - Define the detection rule, the alert, and the on-call.

4. Response

Is there an IR runbook for this scenario, and has it been tabletop-tested? - If no runbook: build one before ship. - If untested: tabletop before ship.

5. Regulatory Window

What's the regulator notification window if this scenario occurs? - GDPR: 72h. HIPAA: 60d. State breach laws vary. - Pre-write the customer comms template.

6. Vendor & Supply Chain

Which third-party vendors are in scope, and what's their security posture? - Subprocessor list current? - DPAs in place? - Last security review per vendor?

Workflow

python ${CLAUDE_PLUGIN_ROOT}/vendor/c-level-advisor/ciso-advisor/scripts/risk_quantifier.py
python ${CLAUDE_PLUGIN_ROOT}/vendor/c-level-advisor/ciso-advisor/scripts/compliance_tracker.py

Output Format

# CISO Review: <plan>
**Date:** YYYY-MM-DD

## Threat Model
- Top threat: <STRIDE category> — <description>
- Likelihood: H/M/L | Impact: H/M/L
- ALE: $X / year

## Blast Radius
- Data exposed (worst case): <description>
- Users affected: N
- Estimated cost: $X

## Detection
- MTTD target: X hours
- Current MTTD: X hours
- Detection rule: <name>

## Response
- IR runbook: ✅ / ❌
- Last tabletop: <date>

## Regulatory
- Frameworks in scope: SOC 2 / ISO 27001 / HIPAA / GDPR
- Notification window: X hours/days

## Vendors
- New vendors added: N
- DPAs signed: N / N
- Security reviews complete: N / N

## Verdict
🟢 SHIP | 🟡 MITIGATE THEN SHIP | 🔴 BLOCK

Routing

  • /c-level-agents:cto-review — architecture alignment
  • /c-level-agents:gc-review — DPA, regulatory implications
  • /c-level-agents:decide — log risk acceptance
  • /c-level-agents:boardroom — for CRITICAL risks

Related

Version: 1.0.0

Files in this skill (2)
  • LICENSE
  • SKILL.md
Where it comes from

Vendored from alirezarezvani/claude-skills, commit 27cfcd0fb0a4, path c-level-agents/skills/ciso-review, licence MIT. The upstream licence file ships inside the skill.