Chain risks from the register into one compound attack, where what the attacker holds at the end of one risk is the way in to the next (a phishing email, then an old server, then payroll), score the chain by its hardest step and its final impact, name the one…
Collect audit evidence into `grc/evidence/`, file each piece against the ISO 27001 controls it proves, show which controls in scope are evidenced, stale or missing for ISO 27001, NIS2, DORA or GDPR from fixed mapping files, catch controls the register calls…
Turn the risk register into a report for a security, risk or audit committee or a board: posture in one sentence, portfolio heat map with what moved since the last report, risks above appetite, treatment progress and the decisions to take, after a short…
Answer any question about what a security or privacy framework requires, from fixed mapping files and never from memory, even when you think you know the answer, since only the files are traceable. Use for any question that names or needs an article, clause…
Check the organisation against ISO 27001 and any framework mapped to it (NIS2, DORA, GDPR, SOC 2, PCI DSS, NIST CSF, AI Act and more), requirement by requirement from the fixed framework files, mark each one met, partial, missing, not applicable or unknown…
Grill the user on a governance, risk or compliance decision one question at a time, each with a recommended answer cited to a framework clause, within a question budget, then ask which output format they want. Use when a GRC skill needs decisions from the…
Route a governance, risk or compliance request to the GRC skill that owns it, chain them when the request spans several, and say where the user stands and what to do next, without grilling. Use when the user asks for GRC, cybersecurity governance, risk or…
Write or review a security policy (access control, acceptable use, incident response, supplier security, backup, any topic) in plain words, each rule traced to a framework clause or a register risk, after a hard grill on scope, owner, approver and the rules…