grcskills

In the author's own words, from each skill's SKILL.md — showing the first 30 of 61 files.

• submit-skill

  Use this skill when someone wants to contribute, submit or publish a GRC skill to the grcskills library (github.com/better-isms/grcskills, grcskills.com), or update a skill or author profile they already published there. Interviews the contributor for practitioner judgment, drafts the files in the library format, runs the validator and opens one pull request.

  skills/.system/submit-skill/SKILL.md on GitHub (opens in a new tab)

• acceptable-use-policy-drafting

  Use this skill when a company needs rules for how staff use company systems, data, devices and AI tools, or asks "write our acceptable use policy", "AUP for employees", "can staff use ChatGPT at work", "AI usage policy", "BYOD rules", "remote work security rules" or "a policy people will actually read". Finds how people really work (devices, apps, AI tools, travel), puts the choices to the reader…

  skills/tristan-roth/acceptable-use-policy-drafting/SKILL.md on GitHub (opens in a new tab)

• access-review-campaign-prep

  Use this skill when a periodic user access review is due, an auditor asked for access review evidence, or someone says "prepare the access review", "run the quarterly user recertification", "who still has admin", "check leavers still have access", "build the access review sheets for managers" or "our last review was a rubber stamp". Picks the systems in scope, builds account populations reconcile…

  skills/tristan-roth/access-review-campaign-prep/SKILL.md on GitHub (opens in a new tab)

• ai-acceptable-use-rules

  Use this skill when staff already use AI assistants, coding tools or AI features and the company needs rules people will follow, and asks "write our AI usage policy", "can staff use ChatGPT", "generative AI policy", "what data can we put into AI tools", "approved AI tools list", "rules for AI agents and connectors" or "AI literacy for staff". Finds out what people actually use, sets a short list…

  skills/tristan-roth/ai-acceptable-use-rules/SKILL.md on GitHub (opens in a new tab)

• ai-act-risk-classification

  Use this skill when a company must work out where each of its AI systems sits under the EU AI Act, and asks "is this high-risk", "classify our AI systems", "AI Act risk tier", "are we a provider or a deployer", "does Annex III apply to us", "is this a prohibited practice", "what does the AI Act mean for our chatbot" or "which AI Act obligations do we have". Tests each system, one at a time, for s…

  skills/tristan-roth/ai-act-risk-classification/SKILL.md on GitHub (opens in a new tab)

• ai-impact-assessment

  Use this skill when one AI system needs its impact on people and on the company assessed before launch, after a significant change, or because a customer, auditor or regulator asks for it, and the team says "AI impact assessment", "assess the impact of this model", "fundamental rights impact assessment", "who could this AI harm", "bias assessment before launch" or "sign-off for the AI feature". D…

  skills/tristan-roth/ai-impact-assessment/SKILL.md on GitHub (opens in a new tab)

• ai-management-system-scope

  Use this skill when a company that already runs a security management system wants to add an AI management system, or is preparing for an AI governance certification, and asks "scope our AI management system", "what should the AIMS cover", "AI governance roles", "who owns AI governance", "extend our ISMS to AI" or "write the AI management system scope statement". Decides which AI systems, roles,…

  skills/tristan-roth/ai-management-system-scope/SKILL.md on GitHub (opens in a new tab)

• ai-system-inventory

  Use this skill when a company needs to know what AI it builds, buys or uses, before an AI governance programme, an AI regulation review or a customer questionnaire, and asks "list our AI systems", "build an AI register", "AI inventory", "where are we using AI", "find shadow AI", "which of our vendors use AI" or "what AI do we have before the AI Act". Discovers AI systems from procurement, single…

  skills/tristan-roth/ai-system-inventory/SKILL.md on GitHub (opens in a new tab)

• ai-vendor-due-diligence

  Use this skill when the company is about to buy, renew or switch on an AI product or an AI feature inside an existing product, and asks "assess this AI vendor", "do they train on our data", "AI supplier questionnaire", "review the AI terms", "can we use this model provider with customer data", "who are the subprocessors behind this AI tool" or "AI vendor risk assessment". Sizes the review to the…

  skills/tristan-roth/ai-vendor-due-diligence/SKILL.md on GitHub (opens in a new tab)

• auditor-interview-prep

  Use this skill when process owners, engineers or executives will be interviewed in an external or internal audit and need to be ready, or when someone asks "prepare the team for the auditor interviews", "what will the auditor ask our CTO", "interview briefing for the audit", "how should people answer the auditor", "mock audit interviews" or "our engineers are nervous about the audit". Builds a on…

  skills/tristan-roth/auditor-interview-prep/SKILL.md on GitHub (opens in a new tab)

• auditor-sample-preparation

  Use this skill when an external audit, attestation examination or assessment is coming and the team wants populations and evidence ready for the samples the auditor will pull, or asks "prepare for audit sampling", "what samples will the auditor ask for", "get our populations ready", "the auditor wants a list of all changes in the period", "evidence for the leavers sample", "Type II sample prep" o…

  skills/tristan-roth/auditor-sample-preparation/SKILL.md on GitHub (opens in a new tab)

• backup-restore-test-evidence

  Use this skill when a restore test is due, an auditor or customer asks for proof that backups can be recovered, or someone says "plan a restore test", "prove we can recover in time", "our backups succeed but we never restored", "test our RTO and RPO", "write up the disaster recovery test" or "document the backup restore for the audit". Picks what to restore, writes a test plan with success criter…

  skills/tristan-roth/backup-restore-test-evidence/SKILL.md on GitHub (opens in a new tab)

• bcp-tabletop-design

  Use this skill when a company must test its incident response or continuity plan without breaking anything, because an audit, a customer, a regulator or the plan itself calls for an exercise, and someone asks "design a tabletop", "run a ransomware tabletop", "BCP exercise", "crisis simulation", "test our incident response plan", "write the injects" or "we need exercise evidence". Picks two or thr…

  skills/tristan-roth/bcp-tabletop-design/SKILL.md on GitHub (opens in a new tab)

• business-impact-analysis

  Use this skill when a company needs recovery objectives it can defend, before a continuity plan, a disaster recovery design, an audit or a resilience review, and asks "do a BIA", "business impact analysis", "set our RTO and RPO", "what is our maximum tolerable downtime", "which services are critical", "impact tolerance" or "can our backups meet our recovery targets". Lists services from the custo…

  skills/tristan-roth/business-impact-analysis/SKILL.md on GitHub (opens in a new tab)

• change-management-evidence-sampling

  Use this skill when an auditor will test change management, or the team wants to know before they do, and asks "sample our production changes", "check our PR approvals", "do we have segregation of duties on deploys", "test change management before the audit", "were emergency changes approved" or "can a developer push to production alone". Builds the change population from what actually reached pr…

  skills/tristan-roth/change-management-evidence-sampling/SKILL.md on GitHub (opens in a new tab)

• control-owner-raci

  Use this skill when controls have no clear owner, or "security" owns everything, and the team asks "who owns each control", "build a RACI for our controls", "assign control owners", "nobody knows who runs the access review", "set a review cadence per control" or "the auditor asked who is accountable". Assigns one accountable role and the operators to every applicable control, checks workload and…

  skills/tristan-roth/control-owner-raci/SKILL.md on GitHub (opens in a new tab)

• customer-security-questionnaire-answers

  Use this skill when a customer or prospect has sent a security questionnaire, due diligence form or vendor assessment and someone asks "answer this security questionnaire", "fill in the customer's vendor assessment", "draft answers from our policies", "we have 300 questions due Friday", "reuse our previous questionnaire answers" or "which answers can we not back up". Drafts every answer from the…

  skills/tristan-roth/customer-security-questionnaire-answers/SKILL.md on GitHub (opens in a new tab)

• data-subject-request-procedure

  Use this skill when a company needs a working process for privacy requests, or just received one and has none, and asks "DSAR procedure", "how do we handle a subject access request", "someone asked us to delete their data", "right to erasure process", "data subject rights workflow", "GDPR request handling" or "we missed the one-month deadline". Designs intake from any channel, a proportionate ide…

  skills/tristan-roth/data-subject-request-procedure/SKILL.md on GitHub (opens in a new tab)

• document-consistency-check

  Use this skill when a set of policies, procedures, plans and registers has grown in pieces and someone asks "check our documents for contradictions", "are our policies consistent", "the retention periods don't match", "which severity scale is right", "harmonise our ISMS documents", "cross-check the incident plan against the policy" or "clean up our documentation before the audit". Extracts the ch…

  skills/tristan-roth/document-consistency-check/SKILL.md on GitHub (opens in a new tab)

• dpa-security-annex-review

  Use this skill when a data processing agreement is being negotiated or renewed and someone asks "review the TOMs annex", "check the security measures in this DPA", "can we sign this annex", "the customer sent their DPA with a security schedule", "is our standard annex still true" or "does this vendor's annex promise enough". Breaks the technical and organisational measures annex into single commi…

  skills/tristan-roth/dpa-security-annex-review/SKILL.md on GitHub (opens in a new tab)

• dpia-screening

  Use this skill when a new product feature, vendor, AI use, monitoring tool or change in processing raises the question "do we need a DPIA", or someone asks "DPIA screening", "is this high risk processing", "data protection impact assessment threshold", "privacy impact screening for this feature", "does our AI feature need a DPIA" or "document why we did not do a DPIA". Describes the processing wi…

  skills/tristan-roth/dpia-screening/SKILL.md on GitHub (opens in a new tab)

• evidence-freshness-check

  Use this skill when an audit, attestation period or customer review is coming and someone asks "is our evidence up to date", "check the evidence folder before the auditor sees it", "which screenshots are stale", "do we have evidence for the whole period", "find undated evidence" or "what will the auditor reject". Indexes every evidence artefact with the date inside it, its owner and the period it…

  skills/tristan-roth/evidence-freshness-check/SKILL.md on GitHub (opens in a new tab)

• evidence-request-list-builder

  Use this skill when an auditor, assessor or regulator has sent a request list and the team asks "turn the auditor's request list into tasks", "who needs to provide what", "build the evidence tracker", "split the PBC list by owner", "what exactly do they want for this request" or "we have two weeks to send everything". Normalises each request into owned, dated tasks naming the exact artefact, peri…

  skills/tristan-roth/evidence-request-list-builder/SKILL.md on GitHub (opens in a new tab)

• first-gap-assessment

  Use this skill when a company starts a compliance programme and needs to know how far it is from a framework, and asks "run a gap analysis", "how ready are we for the audit", "baseline us against the framework", "what do we have and what is missing", "readiness assessment before we hire an auditor" or "how long until we can certify". Baselines what exists against the chosen framework from documen…

  skills/tristan-roth/first-gap-assessment/SKILL.md on GitHub (opens in a new tab)

• grc-setup-review

  Use this skill when someone wants to know where to start with the grcskills library, or asks "review my GRC setup", "what should I fix before the audit", "which compliance skills do I need", "audit my ISMS folder", "give me a 30-day compliance plan" or "rank the skills for my company". Reads the frontmatter of every skill in the library, inspects the compliance material the agent can reach (repo,…

  skills/tristan-roth/grc-setup-review/SKILL.md on GitHub (opens in a new tab)

• ict-risk-framework-check

  Use this skill when a bank, payment or e-money institution, investment firm, insurer, crypto-asset service provider or other financial entity in scope of DORA needs to know whether its ICT risk management setup holds up, or when someone asks "DORA gap analysis", "are we DORA compliant on ICT risk", "check our ICT risk management framework", "prepare for the supervisor's DORA review", "does our IS…

  skills/tristan-roth/ict-risk-framework-check/SKILL.md on GitHub (opens in a new tab)

• ict-third-party-register

  Use this skill when a financial entity in scope of DORA needs to build or refresh its register of ICT third-party arrangements, and someone asks "build our register of information", "list our ICT providers for the regulator", "which providers support critical or important functions", "refresh the DORA register", "map our ICT contracts to functions" or "where is our provider concentration". Builds…

  skills/tristan-roth/ict-third-party-register/SKILL.md on GitHub (opens in a new tab)

• incident-response-plan-drafting

  Use this skill when a company has no incident response plan, has one copied from a template that names teams it does not have, or an auditor, customer or insurer asks for it, and the team says "write our incident response plan", "IR plan", "security incident procedure", "who does what in an incident", "incident playbooks", "contact tree for incidents" or "our plan failed in the last incident". Dr…

  skills/tristan-roth/incident-response-plan-drafting/SKILL.md on GitHub (opens in a new tab)

• incident-severity-triage

  Use this skill when something is happening now: an alert, a suspicious login, a ransomware note, data sent to the wrong customer, an outage that might be an attack, and someone asks "how bad is this", "classify this incident", "is this a SEV1", "who do we wake up", "is this a breach", "do we need to notify anyone" or "start the incident log". Classifies the incident on the company's own scale in…

  skills/tristan-roth/incident-severity-triage/SKILL.md on GitHub (opens in a new tab)

• internal-audit-checklist-from-scope

  Use this skill when an internal auditor has one process or area to audit and needs a working checklist built from the company's own documents, or asks "build an internal audit checklist", "audit questions for access management", "what do I test in the supplier process", "audit plan for this area", "how many samples should I take", "internal audit of our data protection process" or "test our incid…

  skills/tristan-roth/internal-audit-checklist-from-scope/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• archifyby tt-a1i Turn any idea, plan, or codebase into a beautiful interactive diagram. An agent skill for Claude Code, Codex, and more. 87.6k stars · 2 skills
• reaby morluto Reverse engineer anything with agents, from app behavior down to native binaries. 366k stars · 1 skill
• taste-skillby Leonxlnx Agent skills that give coding agents taste: art direction, reference images and a browser check instead of generic AI pages 101k stars · 13 skills
• khazix-skillsby KKKKhazix 数字生命卡兹克开源的 AI Skills 合集 | Agent Skills: leader（帮你定义目标）, neat-freak 洁癖, hv-analysis, khazix-writer & more — Claude Code, Codex & 40+ agents 21.6k stars · 6 skills
• video-shotcraftby Vincentwei1021 AI video skill for Claude Code & Codex — cinematic product videos with Remotion: 152 shot recipe cards, 209 motion previews, a production-r… 13k stars · 1 skill
• Kamiby tw93 👩 🚒 Good content deserves good paper. Layout rules and templates that let AI agents export PDF, PNG and editable PowerPoint. 12.1k stars · 1 skill