Guides security professionals in implementing defense-in-depth security architectures, achieving compliance with industry frameworks (SOC2, ISO27001, GDPR, HIPAA), conducting threat modeling and risk assessments, managing security operations and incident response, and embedding security throughout the SDLC.
npxskills add davila7/claude-code-templates--skill security-complianceLoading…
Apply multiple layers of security controls so that if one fails, others provide protection. Never rely on a single security mechanism.
Never trust, always verify. Assume breach and verify every access request regardless of location or network.
Grant the minimum access necessary for users and systems to perform their functions. Regularly review and revoke unused permissions.
Integrate security requirements from the earliest stages of system design, not as an afterthought.
Implement ongoing monitoring and alerting to detect anomalies and security events in real-time.
Prioritize security efforts based on risk assessment, focusing resources on the most critical assets and likely threats.
Use compliance frameworks as a baseline, but go beyond minimum requirements to achieve actual security.
Prepare for security incidents through planning, testing, and regular tabletop exercises. Assume compromise will occur.
Objective: Understand current security posture and compliance requirements
Activities:
Deliverables:
Objective: Design secure systems and architectures
Activities:
Deliverables:
Objective: Deploy security controls and harden systems
Activities:
Deliverables:
Objective: Continuously monitor for threats and anomalies
Activities:
Deliverables:
Objective: Respond to security incidents and recover operations
Activities:
Deliverables:
Objective: Validate compliance and continuously improve security
Activities:
Deliverables:
When to use: Evaluating security risks and prioritizing mitigation efforts
Process:
1. Identify Assets
- What systems, data, and services need protection?
- What is the business value of each asset?
- Who are the asset owners?
2. Identify Threats
- What threat actors might target these assets? (nation-state, cybercriminals, insiders)
- What are their motivations? (financial gain, espionage, disruption)
- What are current threat trends?
3. Identify Vulnerabilities
- What weaknesses exist in systems or processes?
- What security controls are missing or ineffective?
- What are known CVEs affecting your systems?
4. Calculate Risk
Risk = Likelihood × Impact
Likelihood scale (1-5):
1 = Rare (< 5% chance in 1 year)
2 = Unlikely (5-25%)
3 = Possible (25-50%)
4 = Likely (50-75%)
5 = Almost Certain (> 75%)
Impact scale (1-5):
1 = Minimal (< $10K loss, no data breach)
2 = Minor ($10K-$100K, limited data exposure)
3 = Moderate ($100K-$1M, significant data breach)
4 = Major ($1M-$10M, extensive data breach, regulatory fines)
5 = Catastrophic (> $10M, business-threatening)
Risk Score = Likelihood × Impact (max 25)
5. Prioritize Risks
- Critical: Risk score 15-25 (immediate action)
- High: Risk score 10-14 (action within 30 days)
- Medium: Risk score 5-9 (action within 90 days)
- Low: Risk score 1-4 (monitor and accept)
6. Determine Risk Response
- Mitigate: Implement controls to reduce risk
- Accept: Document acceptance if risk is within tolerance
- Transfer: Use insurance or third-party services
- Avoid: Eliminate the activity that creates risk
Output: Risk register with prioritized risks and mitigation plans
When to use: Choosing appropriate security controls for identified risks
Framework: Use NIST CSF categories or CIS Controls
NIST CSF Functions:
1. Identify (ID)
- Asset Management
- Risk Assessment
- Governance
2. Protect (PR)
- Access Control
- Data Security
- Protective Technology
3. Detect (DE)
- Anomalies and Events
- Security Monitoring
- Detection Processes
4. Respond (RS)
- Response Planning
- Communications
- Analysis and Mitigation
5. Recover (RC)
- Recovery Planning
- Improvements
- Communications
Control Types:
- Preventive: Stop incidents before they occur (MFA, firewalls, encryption)
- Detective: Identify incidents when they occur (SIEM, IDS, log monitoring)
- Corrective: Fix issues after detection (patching, incident response)
- Deterrent: Discourage attackers (security policies, warnings)
- Compensating: Alternative controls when primary controls aren't feasible
Selection Criteria:
1. Does it address the identified risk?
2. Is it cost-effective? (Control cost < Risk value)
3. Is it technically feasible?
4. Does it meet compliance requirements?
5. Can we maintain and monitor it?
When to use: Determining which compliance frameworks to implement
Decision Tree:
What type of organization are you?
├─ SaaS/Cloud Service Provider
│ ├─ Selling to enterprises? → SOC2 Type II (required)
│ ├─ International customers? → ISO27001 (strongly recommended)
│ ├─ Handling health data? → HIPAA + HITRUST
│ └─ Handling payment cards? → PCI-DSS
├─ Healthcare Provider/Payer
│ ├─ U.S.-based → HIPAA (required)
│ ├─ International → HIPAA + GDPR
│ └─ Plus: HITRUST for comprehensive framework
├─ Financial Services
│ ├─ U.S. banks → GLBA, SOX (if public)
│ ├─ Payment processing → PCI-DSS (required)
│ ├─ International → ISO27001, local regulations
│ └─ Plus: NIST CSF for framework
├─ E-commerce/Retail
│ ├─ Accept credit cards → PCI-DSS (required)
│ ├─ EU customers → GDPR (required)
│ ├─ California customers → CCPA
│ └─ B2B sales → SOC2 Type II
└─ General Enterprise
├─ Selling to enterprises → SOC2 Type II
├─ Want broad recognition → ISO27001
├─ Government contracts → FedRAMP, NIST 800-53
└─ Industry-specific → Check sector regulations
Multi-Framework Strategy:
- Start with: SOC2 or ISO27001 (choose one as foundation)
- Add: Data privacy regulations (GDPR, CCPA) as needed
- Layer on: Industry-specific requirements
When to use: Triaging and responding to security incidents
Severity Levels:
P0 - Critical (Immediate Response)
- Active breach with data exfiltration occurring
- Ransomware encryption in progress
- Complete system outage of critical services
- Unauthorized access to production databases
- Response: Engage CIRT immediately, executive notification, 24/7 effort
P1 - High (Response within 1 hour)
- Confirmed malware on critical systems
- Attempted unauthorized access to sensitive data
- DDoS attack affecting availability
- Significant vulnerability with active exploits
- Response: Engage CIRT, manager notification, work until contained
P2 - Medium (Response within 4 hours)
- Malware on non-critical systems
- Suspicious account activity
- Policy violations with security impact
- Vulnerability requiring patching
- Response: Security team investigation, business hours
P3 - Low (Response within 24 hours)
- Failed login attempts (below threshold)
- Minor policy violations
- Informational security events
- Response: Standard queue, document findings
Classification Factors:
1. Data confidentiality impact (PHI, PII, financial, IP)
2. System availability impact (revenue, operations)
3. Data integrity impact (corruption, unauthorized changes)
4. Number of affected systems/users
5. Regulatory reporting requirements
When to use: Prioritizing vulnerability remediation
Framework: Enhanced CVSS with business context
Base CVSS Score × Business Context Multiplier = Priority Score
CVSS Severity Ranges:
- Critical: 9.0-10.0
- High: 7.0-8.9
- Medium: 4.0-6.9
- Low: 0.1-3.9
Business Context Multipliers:
- Internet-facing production system: 2.0×
- Internal production system: 1.5×
- Systems with sensitive data: 1.5×
- Development/test environment: 0.5×
- Active exploit in the wild: 2.0×
- Compensating controls in place: 0.7×
Priority Levels:
- P0 (Critical): Score ≥ 14 → Patch within 24-48 hours
- P1 (High): Score 10-13.9 → Patch within 7 days
- P2 (Medium): Score 6-9.9 → Patch within 30 days
- P3 (Low): Score < 6 → Patch within 90 days or accept risk
Additional Considerations:
- Can the system be isolated/segmented?
- Are there effective detective controls?
- What is the patching complexity/risk?
- Is there a vendor patch available?
When to use: Evaluating security risks of vendors and partners
Assessment Framework:
1. Categorize Vendor Risk Level
Low Risk (Minimal assessment):
- No access to systems or data
- Limited integration
- Non-critical service
→ Simple questionnaire
Medium Risk (Standard assessment):
- Limited system access
- Non-sensitive data access
- Important but not critical service
→ Security questionnaire + evidence review
High Risk (Comprehensive assessment):
- Production system access
- Sensitive data processing
- Critical service dependency
→ Full assessment + audit reports + pen test
Critical Risk (Extensive assessment):
- Full production access
- PHI/PII processing
- Business-critical dependency
→ On-site audit + continuous monitoring + SLA
2. Assessment Components
For Medium/High/Critical vendors:
□ Security questionnaire (SIG, CAIQ, or custom)
□ Compliance certifications (SOC2, ISO27001)
□ Insurance certificates (cyber liability)
□ Security policies and procedures
□ Incident response plan
□ Disaster recovery/business continuity plan
□ Data processing agreement (DPA)
□ Penetration test results (for high/critical)
□ Right to audit clause in contract
3. Ongoing Monitoring
- Annual reassessment
- Monitor for breaches/incidents
- Review security updates and patches
- Track compliance certification renewals
- Conduct periodic audits (for critical vendors)
4. Vendor Risk Score
Calculate score (0-100):
- Security maturity: 40 points
- Compliance certifications: 20 points
- Incident history: 15 points
- Financial stability: 15 points
- References and reputation: 10 points
Action based on score:
- 80-100: Approved
- 60-79: Approved with conditions
- 40-59: Requires remediation plan
- < 40: Do not engage
1. Detection & Alert
↓
2. Triage & Classification
- Determine severity (P0-P3)
- Assign to responder
↓
3. Investigation
- Gather evidence
- Analyze logs (SIEM)
- Determine scope
↓
4. Containment
- Isolate affected systems
- Block malicious IPs/domains
- Disable compromised accounts
↓
5. Eradication
- Remove malware
- Close vulnerabilities
- Patch systems
↓
6. Recovery
- Restore from backups
- Verify system integrity
- Return to production
↓
7. Post-Incident Review
- Document timeline
- Root cause analysis
- Update playbooks
- Implement improvements
↓
8. Reporting
- Executive summary
- Regulatory notification (if required)
- Stakeholder communication
1. Asset Discovery
- Scan network for assets
- Maintain asset inventory
↓
2. Vulnerability Scanning
- Authenticated scans
- Unauthenticated scans
- Agent-based monitoring
↓
3. Assessment & Validation
- Validate findings
- Remove false positives
- Add business context
↓
4. Prioritization
- Apply CVSS + context
- Assign severity (P0-P3)
- Create remediation tickets
↓
5. Remediation
- Patch systems
- Apply compensating controls
- Update configurations
↓
6. Verification
- Rescan to confirm fix
- Update vulnerability status
↓
7. Reporting
- Metrics dashboard
- Executive reports
- Trend analysis
1. Schedule Review (Quarterly)
↓
2. Generate Access Reports
- User access by role
- Privileged accounts
- Service accounts
- Orphaned accounts
↓
3. Distribute to Managers
- Each manager reviews their team
- Certify appropriate access
↓
4. Review & Certify
- Approve legitimate access
- Flag inappropriate access
- Identify orphaned accounts
↓
5. Remediation
- Revoke unapproved access
- Disable orphaned accounts
- Update RBAC assignments
↓
6. Document & Report
- Certification completion rate
- Access changes made
- Compliance evidence
1. Scoping (3-4 months before)
- Define in-scope systems
- Select Trust Service Criteria
- Engage auditor
↓
2. Gap Assessment (2-3 months before)
- Map controls to requirements
- Identify control gaps
- Create remediation plan
↓
3. Readiness (1-2 months before)
- Implement missing controls
- Document policies/procedures
- Conduct mock audit
↓
4. Evidence Collection (Ongoing)
- Automate evidence gathering
- Organize evidence repository
- Prepare control narratives
↓
5. Audit Kickoff
- Provide evidence to auditor
- Respond to requests
- Schedule interviews
↓
6. Fieldwork (4-6 weeks)
- Auditor tests controls
- Provide additional evidence
- Address findings
↓
7. Report Issuance
- Review draft report
- Address any exceptions
- Receive final SOC2 report
↓
8. Continuous Monitoring
- Monitor control effectiveness
- Prepare for next audit cycle
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).