Percerno Skillsbeta
← everything it can do · compliance

Iso27001 Audit Prep TEXT

Executes a six-question forcing interrogation to assess ISO 27001 ISMS audit readiness, covering scope coverage, risk register health, access reviews, supplier management, incident response, and management review inputs. Produces a structured markdown report with a readiness verdict and top corrective actions.

2 uses this weeksource alirezarezvanilicence MIT
Quality gate: INCONCLUSIVE · better answers · measured 2026-10-23
Blind-judged against the bare model on 2 requests: average lift +0.0 points (specificity, structure, method, fit).
won 1/2, lift +0.0, tokens ×29.02
Security scan: clean · 2026-10-24 · 1 files · ran in sandbox
no network calls, shell tricks, credential access or instruction tampering found in its files.

Try asking

Say it in your own words; the assistant finds this recipe by itself. Examples:

“Kør ISO 27001 audit-forberedelse for vores nye cloud-infrastruktur inden overvågningsauditet.”
“Vi skal have en status på vores risikoregister, da det er blevet lidt gammelt. Er vi klar til certificering?”
“Tjek om vores adgangsreviews er dokumenteret korrekt for de seneste fire kvartaler, som auditoren kræver.”
“Run the ISO 27001 audit prep check for our new SaaS product line before the stage 1 audit next month.”
“We had a data breach last week. I need to know if our incident response evidence is ready for an ad-hoc ISMS audit.”
“Check our rolling 3-year audit coverage and see if we have gaps in Annex A controls for the finance department.”
Try this skill from Claude, ChatGPT or a chat on your own page. Free plan, no credit card.Get started free

Good for

iso27001audit-prepismscompliancerisk-assessmentinternal-auditcertificationsecurity-controls

Not for

Do not use this skill for general cybersecurity strategy reviews or executive CISO briefings, which are better handled by c-level-agents:ciso-review. It is not intended for SOC 2 specific audit preparation, for which compliance-os:soc2-audit-prep is the correct tool, nor for GDPR-specific data protection assessments, which require compliance-os:gdpr-audit-prep.

Details

When it is the right choice

Use this skill when preparing for an ISO 27001 internal audit, stage 1 or stage 2 certification audit, or surveillance audit. It is also appropriate after material changes to the ISMS scope or following a security incident that triggers an ad-hoc audit. It helps identify gaps in high-stakes control areas like access management and supplier risk before auditors arrive.

The full recipe the assistant reads

/compliance-os:iso27001-audit-prep — ISO 27001 ISMS Audit Forcing Questions

Command: /compliance-os:iso27001-audit-prep <scope>

The ISO 27001 ISMS auditor pressure-tests any ISMS work. Six sample-driven questions before any internal audit, stage 1 readiness, or surveillance audit.

When to Run

  • Before annual Clause 9.2 internal audit
  • Before stage 1 / stage 2 ISO 27001 certification audit
  • Before surveillance audit (year 2 / year 3)
  • After material change to ISMS scope (new business unit, new product line, new SaaS adoption)
  • Post-incident (breach triggers ad-hoc ISMS audit)
  • Quarterly during high-growth phase

The Six ISMS Questions

1. What's the audit scope, and is rolling 3-year coverage on track?

No 3-year coverage discipline, no defensible programme. - Every Clause 4-10 + every applicable Annex A control must be audited at least once per 3-year cycle - Run isms_audit_scheduler.py in ${CLAUDE_PLUGIN_ROOT}/vendor/ra-qm-team/isms-audit-expert/ - Confirm auditor independence — no self-audit on any sample

2. When was the risk register last refreshed, and are treatments linked to Annex A controls?

Stale risk register = certification finding. - Quarterly refresh expected; annual minimum - Every high/critical risk must link to ≥ 1 Annex A control treating it - Residual risk acceptance documented + signed - Review against iso27001_audit_playbook.md for stage 1 expectations

3. Show me the access review records — quarterly cadence, the last 4 quarters.

Most-cited finding area. - Annex A.5.15 + A.8.2 + A.8.3 access controls - Sample real records pulled from Okta / IAM, not curated audit-prep packs - For each terminated employee in last 90 days: deprovisioning evidence within 24-hour SLA - Privileged access reviewed at finer granularity

4. What's the supplier inventory + last review evidence?

Second-most-cited finding area. - Annex A.5.19-A.5.21 supplier management - Critical SaaS suppliers reviewed at least annually - DPAs signed for personal-data sub-processors (cross-check with cs-dpo-gdpr) - AI-specific contract clauses where third-party AI services in use (cross-check with cs-aims-iso42001)

5. Where's the incident response evidence + post-incident review?

A.5.24-27 + A.6.8 — high-stakes audit area. - Severity definitions documented + consistently applied - Last 5 incidents have post-incident review (PIR) within 30-day SLA - GDPR Article 33 / 34 notification timing aligned with A.5.24 (cross-check with cs-dpo-gdpr) - Blameless retro culture; not punitive

6. What's the management review cadence + inputs?

Clause 9.3 required inputs are prescriptive — easy to miss. - Required inputs: audit results, risks, performance, nonconformities, opportunities - Schedule: annual minimum; quarterly preferred for mature programs - Outputs documented + tracked to closure - Integrated review across frameworks (per multi_framework_audit_playbook.md) preferred to separate reviews

Workflow

# 1. Audit programme planning
python ${CLAUDE_PLUGIN_ROOT}/vendor/ra-qm-team/isms-audit-expert/scripts/isms_audit_scheduler.py audit_scope.json

# 2. Mock audit for readiness check
python ../../skills/compliance-os/scripts/audit_simulator.py iso27001_scope.json

# 3. Cross-framework reuse (SOC 2 = 75% overlap; ISO 42001 = 60% reuse)
python ../../skills/compliance-os/scripts/cross_framework_mapper.py program.json

Output Format

# ISO 27001 Audit Prep: <scope>
**Date:** YYYY-MM-DD

## The Decision Being Made
[programme-plan | finding-severity | cert-readiness | incident-followup]

## Audit Programme Status
- Clauses scheduled this year: <list>
- Annex A controls scheduled: <count>
- Rolling 3-year coverage: clean | gaps in <list>
- Auditor independence: clean | issues in <list>

## Risk Register Health
- Last refresh: YYYY-MM-DD
- High/critical risks without Annex A control link: N
- Residual risk acceptance documentation: complete | gaps

## High-Stakes Controls Status
- A.5.15 + A.8.2 + A.8.3 access control: pass/fail with sample
- A.5.19-A.5.21 supplier mgmt: pass/fail with sample
- A.5.24-27 + A.6.8 incident response: pass/fail with sample
- A.8.15-16 logging: pass/fail with sample

## Management Review Status
- Last review date: YYYY-MM-DD
- Required Article 9.3 inputs present: yes/no
- Open action items past due: N

## Cross-Framework Impact
- SOC 2 controls affected: <list>
- ISO 42001 controls affected (if applicable): <list>
- GDPR Article 32 controls affected: <list>

## Verdict
🟢 READY | 🟡 CLOSE-CRITICALS-FIRST | 🔴 NOT-READY

## Top 3 Actions
[3 concrete next steps with owner + corrective-action timeline]

Routing

  • /compliance-os:compliance-readiness — for multi-framework view
  • /compliance-os:soc2-audit-prep — for SOC 2 cross-walk pair (75% overlap)
  • /compliance-os:aims-audit — for ISO 42001 AIMS cross-walk
  • /compliance-os:gdpr-audit-prep — for Article 32 organizational measures overlap
  • /c-level-agents:ciso-review — for executive cybersecurity strategy
  • /c-level-agents:decide — to log the verdict

Related

Version: 1.0.0

Files in this skill (2)
  • LICENSE
  • SKILL.md
Where it comes from

Vendored from alirezarezvani/claude-skills, commit 27cfcd0fb0a4, path compliance-os/skills/iso27001-audit-prep, licence MIT. The upstream licence file ships inside the skill.