[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEHCMDP3C3SPGNSC9ZMD2Z":3,"skill-same:01M6AEHCMDP3C3SPGNSC9ZMD2Z":94},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":6,"ownerHtmlUrl":54,"ownerBlogUrl":55,"ownerDescription":56,"updatedAt":57,"install":58,"resources":71},"01M6AEHCMDP3C3SPGNSC9ZMD2Z","breach-simulation",null,"Designs and executes tabletop breach simulation exercises for testing organizational breach response capabilities. Covers scenario creation with realistic inject timelines, participant role assignment, communication testing across internal and external channels, decision-point evaluation, and after-action report generation. Keywords: tabletop exercise, breach simulation, incident response testing, scenario design, after-action report.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",336,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fbreach-simulation\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000032","设计师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39],"breach simulation","testing","design","incident response","report","capabilities","communication","privacy","Evaluation","incident-response","data","2026-11-10 10:12:30",false,"---\nname: breach-simulation\ndescription: >-\n  Designs and executes tabletop breach simulation exercises for testing\n  organizational breach response capabilities. Covers scenario creation with\n  realistic inject timelines, participant role assignment, communication\n  testing across internal and external channels, decision-point evaluation,\n  and after-action report generation. Keywords: tabletop exercise, breach\n  simulation, incident response testing, scenario design, after-action report.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: data-breach-response\n  tags: \"tabletop-exercise, breach-simulation, incident-response, scenario-design, after-action\"\n---\n\n# Designing Breach Simulation Exercise\n\n## Overview\n\nBreach simulation exercises (tabletop exercises) test an organization's ability to detect, respond to, and recover from a personal data breach without the consequences of an actual incident. A well-designed exercise validates the breach response plan, identifies gaps in procedures, communication, and decision-making, and builds institutional muscle memory. This skill covers the end-to-end design process from scenario creation through after-action reporting.\n\n## Exercise Design Framework\n\n### Exercise Types\n\n| Type | Duration | Participants | Complexity | Purpose |\n|------|----------|-------------|-----------|---------|\n| Tabletop (discussion-based) | 2-4 hours | 8-15 senior stakeholders | Medium | Test decision-making, communication, and policy application |\n| Functional exercise | 4-8 hours | 15-30 cross-functional team members | High | Test operational procedures and tool usage |\n| Full-scale simulation | 1-3 days | Organization-wide (50+ participants) | Very high | Test end-to-end response including technical, legal, communications, and executive functions |\n\n### Recommended Exercise Cadence\n\n| Exercise Type | Frequency | Audience |\n|--------------|-----------|----------|\n| Tabletop | Semi-annually | Executive team, DPO, legal, communications, CISO |\n| Functional | Annually | SOC, privacy team, IT operations, HR, customer service |\n| Full-scale | Every 2 years | Organization-wide |\n\n## Scenario Design\n\n### Scenario 1: Ransomware Attack on Customer Database\n\n**Complexity**: High\n**Duration**: 3 hours\n**Primary objectives**: Test Art. 33 72-hour notification decision-making, executive communication, and vendor coordination.\n\n**Background briefing (distributed 24 hours before exercise):**\nStellar Payments Group processes payment transactions for 15,230 account holders across 18 EU member states and 12 US states. The production customer database is hosted on a PostgreSQL cluster in AWS eu-west-1. The DPO is Dr. Elena Vasquez. The CISO is Thomas Brenner. Mandiant is the retained incident response firm.\n\n**Inject timeline:**\n\n| Time | Inject | Expected Action |\n|------|--------|-----------------|\n| T+0 min | SOC alert: CrowdStrike detects rapid file encryption on db-prod-eu-west-01. 500+ file renames per second. Known ransomware indicators (LockBit 3.0). | SOC initiates incident response. Incident Commander activated. |\n| T+15 min | Update: Encryption spreading to db-prod-eu-west-02 and 03. Customer portal returning database errors. Customer complaints arriving via support channels. | Decision point: Isolate database cluster? Accept service disruption vs. further damage? |\n| T+30 min | Forensic initial finding: Attack vector appears to be compromised service account (svc-migration-2024). Account authenticated from Tor exit node 3 days prior. | Update risk assessment. Determine scope of potentially compromised data. |\n| T+60 min | Customer database confirmed encrypted. 48,720 records across 15,230 data subjects. Backup from 12 hours ago available and verified clean. | Decision point: Restore from backup? Art. 33 notification clock — when did we \"become aware\"? |\n| T+90 min | Ransom note found: 50 BTC demanded. Threat to publish data on dark web if not paid within 48 hours. Media outlet (Handelsblatt) calls communications team for comment. | Decision points: Pay ransom? Engage law enforcement? Media statement? |\n| T+120 min | Mandiant confirms no evidence of exfiltration but cannot rule it out. Backup restoration is 60% complete. Berliner BfDI opens office in 2 hours. | Decision point: File Art. 33 notification now or wait for more information? Prepare Art. 34 data subject notification? |\n| T+150 min | Second media outlet (Bloomberg) publishes story. Social media discussion begins. 50+ customer support calls in past hour. Three enterprise clients demand written assurance. | Communications crisis management. Customer and B2B stakeholder communication. |\n| T+180 min | Exercise conclusion. Facilitator reveals exercise end state and leads debrief discussion. | After-action discussion. |\n\n### Scenario 2: Insider Threat — Employee Data Exfiltration\n\n**Complexity**: Medium\n**Duration**: 2.5 hours\n\n**Inject timeline:**\n\n| Time | Inject | Expected Action |\n|------|--------|-----------------|\n| T+0 min | DLP alert: HR database export (3,400 employee records) copied to personal OneDrive by departing employee (last day is Friday). | Validate alert. Determine whether personal data is involved. |\n| T+20 min | Records include names, home addresses, salaries, bank details, and national ID numbers. Employee's manager confirms the employee submitted resignation 2 weeks ago. | Decision point: Confront employee? Preserve evidence? Involve legal? |\n| T+45 min | IT confirms the file was synced to the employee's personal laptop. The employee is currently in the office. | Decision points: Device seizure? HR involvement? Works Council (Betriebsrat) notification? |\n| T+75 min | Legal advises on employee rights under German labor law. Works Council representative requests consultation before any confrontation. | Balance breach response urgency against employee rights and Works Council obligations. |\n| T+105 min | Employee is interviewed with Works Council representative present. Claims data was for \"reference purposes.\" Refuses to allow personal laptop examination. | Decision point: Law enforcement referral? Court order for device examination? Art. 33 notification? |\n| T+135 min | DPO completes risk assessment: 3,400 employees, government IDs + financial data = high risk. Art. 33 and Art. 34 notification recommended. | Notification preparation. Employee communication planning (how to tell 3,400 employees their data was compromised by a colleague). |\n| T+150 min | Exercise conclusion and debrief. | After-action discussion. |\n\n### Scenario 3: Third-Party Processor Breach\n\n**Complexity**: Medium\n**Duration**: 2 hours\n\n**Inject timeline:**\n\n| Time | Inject | Expected Action |\n|------|--------|-----------------|\n| T+0 min | Email from cloud payroll processor (PayrollCloud GmbH): \"We are writing to inform you of a security incident affecting customer data hosted on our platform.\" No details provided. | Contact processor for details. Review Art. 28 DPA for incident notification obligations. |\n| T+20 min | Processor confirms: SQL injection attack. Unclear which clients affected. Estimated timeline for client-specific impact assessment: 5-7 days. | Decision point: Can we wait 5-7 days? How does this affect our 72-hour clock? |\n| T+45 min | Processor provides partial information: \"Your organization's data was on the affected server, but we cannot confirm whether it was accessed.\" 3,400 employee payroll records potentially exposed. | Assess when the controller \"became aware\" for Art. 33 purposes. Begin parallel risk assessment. |\n| T+75 min | Media reports the processor breach. Several of the processor's other clients have publicly acknowledged being affected. | Decision point: Proactive disclosure? Wait for confirmed impact? |\n| T+105 min | Processor confirms: Stellar Payments Group data was accessed. 3,400 employee records including names, salaries, bank account numbers, and tax IDs. | Art. 33 notification preparation. Employee communication planning. Processor accountability assessment. |\n| T+120 min | Exercise conclusion and debrief. | After-action discussion. |\n\n## Participant Roles\n\n| Role | Participant | Responsibilities During Exercise |\n|------|------------|----------------------------------|\n| Incident Commander | CISO (Thomas Brenner) | Overall incident coordination, resource allocation, containment decisions |\n| Privacy Lead | DPO (Dr. Elena Vasquez) | Notification decisions, risk assessment, data subject communication |\n| Legal Counsel | General Counsel (Sarah Chen) | Legal advice, privilege management, law enforcement coordination, regulatory strategy |\n| Communications Lead | Communications Director (Martin Keller) | Media response, customer communication, internal communication |\n| IT Operations | IT Director (Petra Hoffmann) | Technical containment, backup restoration, system recovery |\n| Executive Sponsor | CEO (Marcus Lindqvist) | Strategic decisions, board notification, public statements |\n| Customer Relations | VP Customer Success (James Park) | Customer communication, B2B client management |\n| HR Lead | CHRO (Claudia Richter) | Employee communication, Works Council coordination (insider threat scenarios) |\n| Exercise Facilitator | External consultant or internal audit | Scenario delivery, inject timing, discussion facilitation, observation |\n| Observer\u002FRecorder | DPO office analyst | Document decisions, actions, timelines, and gaps for after-action report |\n\n## Decision Points to Evaluate\n\n1. **Breach awareness determination**: When exactly did the controller \"become aware\" for Art. 33 clock purposes?\n2. **Containment vs. evidence preservation**: Did the team balance immediate containment with the need to preserve forensic evidence?\n3. **Notification timing**: Was the 72-hour deadline tracked and met?\n4. **Risk assessment quality**: Was the risk assessment methodology applied consistently and documented?\n5. **Communication coordination**: Were media, customer, and internal communications coordinated and consistent?\n6. **Escalation effectiveness**: Were the right people involved at the right time?\n7. **Cross-functional coordination**: Did legal, privacy, IT, and communications work together effectively?\n8. **Regulatory coordination**: Was the correct supervisory authority identified and notification prepared?\n9. **Data subject communication**: Was Art. 34 notification considered at the appropriate threshold?\n10. **Documentation**: Was the decision-making process documented in real-time?\n\n## After-Action Report Structure\n\n### Section 1: Exercise Summary\n- Exercise date, duration, scenario, and participants.\n- Exercise objectives and whether they were met.\n\n### Section 2: Timeline Analysis\n- Actual timeline of decisions and actions during the exercise.\n- Comparison against expected\u002Fideal timeline from the breach response plan.\n- Identification of delays and bottlenecks.\n\n### Section 3: Findings\n- What worked well (strengths to maintain).\n- What needs improvement (gaps and deficiencies).\n- Severity rating for each finding: Critical, Major, Minor, Observation.\n\n### Section 4: Recommendations\n- Specific, actionable remediation recommendations with owners and deadlines.\n- Prioritized by severity.\n\n### Section 5: Metrics\n- Time from detection to containment decision.\n- Time from awareness to DPO notification.\n- Time from awareness to notification preparation completion.\n- Communication consistency score (number of conflicting messages identified).\n- Decision quality score (percentage of decisions aligned with policy and regulation).\n","# Designing Breach Simulation Exercise\n\n## Overview\n\nBreach simulation exercises (tabletop exercises) test an organization's ability to detect, respond to, and recover from a personal data breach without the consequences of an actual incident. A well-designed exercise validates the breach response plan, identifies gaps in procedures, communication, and decision-making, and builds institutional muscle memory. This skill covers the end-to-end design process from scenario creation through after-action reporting.\n\n## Exercise Design Framework\n\n### Exercise Types\n\n| Type | Duration | Participants | Complexity | Purpose |\n|------|----------|-------------|-----------|---------|\n| Tabletop (discussion-based) | 2-4 hours | 8-15 senior stakeholders | Medium | Test decision-making, communication, and policy application |\n| Functional exercise | 4-8 hours | 15-30 cross-functional team members | High | Test operational procedures and tool usage |\n| Full-scale simulation | 1-3 days | Organization-wide (50+ participants) | Very high | Test end-to-end response including technical, legal, communications, and executive functions |\n\n### Recommended Exercise Cadence\n\n| Exercise Type | Frequency | Audience |\n|--------------|-----------|----------|\n| Tabletop | Semi-annually | Executive team, DPO, legal, communications, CISO |\n| Functional | Annually | SOC, privacy team, IT operations, HR, customer service |\n| Full-scale | Every 2 years | Organization-wide |\n\n## Scenario Design\n\n### Scenario 1: Ransomware Attack on Customer Database\n\n**Complexity**: High\n**Duration**: 3 hours\n**Primary objectives**: Test Art. 33 72-hour notification decision-making, executive communication, and vendor coordination.\n\n**Background briefing (distributed 24 hours before exercise):**\nStellar Payments Group processes payment transactions for 15,230 account holders across 18 EU member states and 12 US states. The production customer database is hosted on a PostgreSQL cluster in AWS eu-west-1. The DPO is Dr. Elena Vasquez. The CISO is Thomas Brenner. Mandiant is the retained incident response firm.\n\n**Inject timeline:**\n\n| Time | Inject | Expected Action |\n|------|--------|-----------------|\n| T+0 min | SOC alert: CrowdStrike detects rapid file encryption on db-prod-eu-west-01. 500+ file renames per second. Known ransomware indicators (LockBit 3.0). | SOC initiates incident response. Incident Commander activated. |\n| T+15 min | Update: Encryption spreading to db-prod-eu-west-02 and 03. Customer portal returning database errors. Customer complaints arriving via support channels. | Decision point: Isolate database cluster? Accept service disruption vs. further damage? |\n| T+30 min | Forensic initial finding: Attack vector appears to be compromised service account (svc-migration-2024). Account authenticated from Tor exit node 3 days prior. | Update risk assessment. Determine scope of potentially compromised data. |\n| T+60 min | Customer database confirmed encrypted. 48,720 records across 15,230 data subjects. Backup from 12 hours ago available and verified clean. | Decision point: Restore from backup? Art. 33 notification clock — when did we \"become aware\"? |\n| T+90 min | Ransom note found: 50 BTC demanded. Threat to publish data on dark web if not paid within 48 hours. Media outlet (Handelsblatt) calls communications team for comment. | Decision points: Pay ransom? Engage law enforcement? Media statement? |\n| T+120 min | Mandiant confirms no evidence of exfiltration but cannot rule it out. Backup restoration is 60% complete. Berliner BfDI opens office in 2 hours. | Decision point: File Art. 33 notification now or wait for more information? Prepare Art. 34 data subject notification? |\n| T+150 min | Second media outlet (Bloomberg) publishes story. Social media discussion begins. 50+ customer support calls in past hour. Three enterprise clients demand written assurance. | Communications crisis management. Customer and B2B stakeholder communication. |\n| T+180 min | Exercise conclusion. Facilitator reveals exercise end state and leads debrief discussion. | After-action discussion. |\n\n### Scenario 2: Insider Threat — Employee Data Exfiltration\n\n**Complexity**: Medium\n**Duration**: 2.5 hours\n\n**Inject timeline:**\n\n| Time | Inject | Expected Action |\n|------|--------|-----------------|\n| T+0 min | DLP alert: HR database export (3,400 employee records) copied to personal OneDrive by departing employee (last day is Friday). | Validate alert. Determine whether personal data is involved. |\n| T+20 min | Records include names, home addresses, salaries, bank details, and national ID numbers. Employee's manager confirms the employee submitted resignation 2 weeks ago. | Decision point: Confront employee? Preserve evidence? Involve legal? |\n| T+45 min | IT confirms the file was synced to the employee's personal laptop. The employee is currently in the office. | Decision points: Device seizure? HR involvement? Works Council (Betriebsrat) notification? |\n| T+75 min | Legal advises on employee rights under German labor law. Works Council representative requests consultation before any confrontation. | Balance breach response urgency against employee rights and Works Council obligations. |\n| T+105 min | Employee is interviewed with Works Council representative present. Claims data was for \"reference purposes.\" Refuses to allow personal laptop examination. | Decision point: Law enforcement referral? Court order for device examination? Art. 33 notification? |\n| T+135 min | DPO completes risk assessment: 3,400 employees, government IDs + financial data = high risk. Art. 33 and Art. 34 notification recommended. | Notification preparation. Employee communication planning (how to tell 3,400 employees their data was compromised by a colleague). |\n| T+150 min | Exercise conclusion and debrief. | After-action discussion. |\n\n### Scenario 3: Third-Party Processor Breach\n\n**Complexity**: Medium\n**Duration**: 2 hours\n\n**Inject timeline:**\n\n| Time | Inject | Expected Action |\n|------|--------|-----------------|\n| T+0 min | Email from cloud payroll processor (PayrollCloud GmbH): \"We are writing to inform you of a security incident affecting customer data hosted on our platform.\" No details provided. | Contact processor for details. Review Art. 28 DPA for incident notification obligations. |\n| T+20 min | Processor confirms: SQL injection attack. Unclear which clients affected. Estimated timeline for client-specific impact assessment: 5-7 days. | Decision point: Can we wait 5-7 days? How does this affect our 72-hour clock? |\n| T+45 min | Processor provides partial information: \"Your organization's data was on the affected server, but we cannot confirm whether it was accessed.\" 3,400 employee payroll records potentially exposed. | Assess when the controller \"became aware\" for Art. 33 purposes. Begin parallel risk assessment. |\n| T+75 min | Media reports the processor breach. Several of the processor's other clients have publicly acknowledged being affected. | Decision point: Proactive disclosure? Wait for confirmed impact? |\n| T+105 min | Processor confirms: Stellar Payments Group data was accessed. 3,400 employee records including names, salaries, bank account numbers, and tax IDs. | Art. 33 notification preparation. Employee communication planning. Processor accountability assessment. |\n| T+120 min | Exercise conclusion and debrief. | After-action discussion. |\n\n## Participant Roles\n\n| Role | Participant | Responsibilities During Exercise |\n|------|------------|----------------------------------|\n| Incident Commander | CISO (Thomas Brenner) | Overall incident coordination, resource allocation, containment decisions |\n| Privacy Lead | DPO (Dr. Elena Vasquez) | Notification decisions, risk assessment, data subject communication |\n| Legal Counsel | General Counsel (Sarah Chen) | Legal advice, privilege management, law enforcement coordination, regulatory strategy |\n| Communications Lead | Communications Director (Martin Keller) | Media response, customer communication, internal communication |\n| IT Operations | IT Director (Petra Hoffmann) | Technical containment, backup restoration, system recovery |\n| Executive Sponsor | CEO (Marcus Lindqvist) | Strategic decisions, board notification, public statements |\n| Customer Relations | VP Customer Success (James Park) | Customer communication, B2B client management |\n| HR Lead | CHRO (Claudia Richter) | Employee communication, Works Council coordination (insider threat scenarios) |\n| Exercise Facilitator | External consultant or internal audit | Scenario delivery, inject timing, discussion facilitation, observation |\n| Observer\u002FRecorder | DPO office analyst | Document decisions, actions, timelines, and gaps for after-action report |\n\n## Decision Points to Evaluate\n\n1. **Breach awareness determination**: When exactly did the controller \"become aware\" for Art. 33 clock purposes?\n2. **Containment vs. evidence preservation**: Did the team balance immediate containment with the need to preserve forensic evidence?\n3. **Notification timing**: Was the 72-hour deadline tracked and met?\n4. **Risk assessment quality**: Was the risk assessment methodology applied consistently and documented?\n5. **Communication coordination**: Were media, customer, and internal communications coordinated and consistent?\n6. **Escalation effectiveness**: Were the right people involved at the right time?\n7. **Cross-functional coordination**: Did legal, privacy, IT, and communications work together effectively?\n8. **Regulatory coordination**: Was the correct supervisory authority identified and notification prepared?\n9. **Data subject communication**: Was Art. 34 notification considered at the appropriate threshold?\n10. **Documentation**: Was the decision-making process documented in real-time?\n\n## After-Action Report Structure\n\n### Section 1: Exercise Summary\n- Exercise date, duration, scenario, and participants.\n- Exercise objectives and whether they were met.\n\n### Section 2: Timeline Analysis\n- Actual timeline of decisions and actions during the exercise.\n- Comparison against expected\u002Fideal timeline from the breach response plan.\n- Identification of delays and bottlenecks.\n\n### Section 3: Findings\n- What worked well (strengths to maintain).\n- What needs improvement (gaps and deficiencies).\n- Severity rating for each finding: Critical, Major, Minor, Observation.\n\n### Section 4: Recommendations\n- Specific, actionable remediation recommendations with owners and deadlines.\n- Prioritized by severity.\n\n### Section 5: Metrics\n- Time from detection to containment decision.\n- Time from awareness to DPO notification.\n- Time from awareness to notification preparation completion.\n- Communication consistency score (number of conflicting messages identified).\n- Decision quality score (percentage of decisions aligned with policy and regulation).\n",{"name":5,"license":15,"metadata":45,"description":7},{"tags":46,"author":9,"domain":36,"version":47,"subdomain":48},"tabletop-exercise, breach-simulation, incident-response, scenario-design, after-action","1.0","data-breach-response","main","9b2ef9eae161c00a17241d42a388571321b33e9f","plugins\u002Fprivacy-skills-complete\u002Fskills\u002Fbreach-simulation",67,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill breach-simulation",{"tool":64,"command":65},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill breach-simulation",{"tool":67,"command":68},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill breach-simulation","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fbreach-simulation\u002FSKILL.md",true,[72,78,84,88],{"path":73,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":77},"assets\u002Ftemplate.md","ASSET","资产文件",5720,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fbreach-simulation\u002Fassets\u002Ftemplate.md",{"path":79,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Fstandards.md","REFERENCE","参考文档",2166,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fbreach-simulation\u002Freferences\u002Fstandards.md",{"path":85,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":86,"sourceHtmlUrl":87},"references\u002Fworkflows.md",3636,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fbreach-simulation\u002Freferences\u002Fworkflows.md",{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"scripts\u002Fprocess.py","SCRIPT","脚本",13066,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fbreach-simulation\u002Fscripts\u002Fprocess.py",[95,118,135,148,165,178],{"skillNo":96,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":110,"publishedAt":40},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[101,104,107],{"categoryNo":102,"categoryName":103,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":105,"categoryName":106,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":108,"categoryName":109,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000037","律师与法务",[111,112,36,113,114,39,115,30,116,117],"email","workplace email privacy","compliance","content","policy","monitoring","metadata",{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":128,"publishedAt":40},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[124,127],{"categoryNo":125,"categoryName":126,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000033","数据分析师",{"categoryNo":108,"categoryName":109,"taxonomyType":26,"taxonomyTypeDesc":27},[39,129,130,131,113,132,133,36,134],"whistleblower data","identity","reporting","data protection","gdpr","prevention",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":142,"publishedAt":40},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[141],{"categoryNo":125,"categoryName":126,"taxonomyType":26,"taxonomyTypeDesc":27},[39,143,144,145,146,133,36,147],"vendor termination data","planning","verification","extraction","certification",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":155,"publishedAt":40},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[154],{"categoryNo":125,"categoryName":126,"taxonomyType":26,"taxonomyTypeDesc":27},[156,157,158,159,160,161,162,163,36,39,164],"vendor risk scoring","risk","risk scoring","methodology","risk-scoring","assessment","transfer","certifications","processor",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":172,"publishedAt":40},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[171],{"categoryNo":108,"categoryName":109,"taxonomyType":26,"taxonomyTypeDesc":27},[36,173,133,174,161,175,176,39,164,157,147,177],"vendor privacy due diligence","review","onboarding","flow","analysis",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":191,"publishedAt":40},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[184,187,190],{"categoryNo":185,"categoryName":186,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":188,"categoryName":189,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000036","内容创作者",{"categoryNo":108,"categoryName":109,"taxonomyType":26,"taxonomyTypeDesc":27},[192,193,36,33,145,194,113,133,195,164,196,197,198,144],"vendor privacy audit","audit","audit report","remediation","collection","remediation-tracking","classification"]