[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF9RVBS63VPDMA7RA5F9ST":3,"skill-same:01M6AF9RVBS63VPDMA7RA5F9ST":99},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":37,"linkOnly":38,"markdownContent":39,"markdownBody":40,"frontMatter":41,"refName":46,"commitSha":47,"skillDirectory":48,"forksCount":49,"repositoryHtmlUrl":50,"repositoryHomepageUrl":6,"ownerHtmlUrl":51,"ownerBlogUrl":52,"ownerDescription":53,"updatedAt":54,"install":55,"resources":68},"01M6AF9RVBS63VPDMA7RA5F9ST","cloud-provider-assessment",null,"Cloud service provider privacy assessment framework. Covers ISO 27018 cloud privacy controls, CSA STAR certification, SOC 2 Type II evaluation, shared responsibility model mapping, data residency verification, and cloud-specific privacy risk analysis.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",336,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fvendor-privacy-management-skills\u002Fskills\u002Fcloud-provider-assessment\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35,36],"assessment","cloud","cloud provider assessment","risk analysis","verification","framework","soc","privacy","Evaluation","data","shared-responsibility","risk","certification","2026-11-10 10:12:30",false,"---\nname: cloud-provider-assessment\ndescription: >-\n  Cloud service provider privacy assessment framework. Covers ISO 27018 cloud\n  privacy controls, CSA STAR certification, SOC 2 Type II evaluation, shared\n  responsibility model mapping, data residency verification, and cloud-specific\n  privacy risk analysis.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: vendor-privacy-management\n  tags: \"cloud-assessment, iso-27018, csa-star, shared-responsibility, data-residency\"\n---\n\n# Cloud Service Provider Privacy Assessment\n\n## Overview\n\nCloud service providers present unique privacy assessment challenges due to shared responsibility models, multi-tenancy architectures, global infrastructure, and the abstraction of physical processing locations. GDPR Article 28 obligations apply fully to cloud processing relationships, but the assessment approach must account for cloud-specific characteristics.\n\nISO\u002FIEC 27018:2019 provides the international standard for protecting personally identifiable information (PII) in public clouds, supplementing ISO 27001 with cloud-specific privacy controls. The Cloud Security Alliance (CSA) STAR program provides a cloud-specific security assurance framework. SOC 2 Type II with the Privacy trust services criterion addresses personal data handling controls.\n\nAt Summit Cloud Partners, cloud providers undergo enhanced assessment incorporating these cloud-specific frameworks alongside standard vendor due diligence.\n\n## Cloud Service Models and Privacy Implications\n\n### IaaS (Infrastructure as a Service)\n\n| Aspect | Controller Responsibility | Provider Responsibility |\n|--------|--------------------------|------------------------|\n| Data encryption at rest | Configure and manage keys | Provide encryption infrastructure |\n| Access management (app level) | Define and manage | Provide IAM platform |\n| Network security (app level) | Configure security groups, firewall rules | Provide network infrastructure |\n| Physical security | None | Full responsibility |\n| Patch management (OS) | Controller (or managed service) | Hypervisor and below |\n| Data backup | Configure and manage | Provide backup infrastructure |\n| Incident detection (app) | Application-level monitoring | Infrastructure-level monitoring |\n\n### PaaS (Platform as a Service)\n\n| Aspect | Controller Responsibility | Provider Responsibility |\n|--------|--------------------------|------------------------|\n| Application code security | Full responsibility | None |\n| Data handling in application | Full responsibility | None |\n| Runtime and middleware | Limited — configuration only | Manage platform components |\n| OS and infrastructure | None | Full responsibility |\n| Platform security patching | None | Full responsibility |\n| Identity management | Configure | Provide identity platform |\n\n### SaaS (Software as a Service)\n\n| Aspect | Controller Responsibility | Provider Responsibility |\n|--------|--------------------------|------------------------|\n| Data entered by users | Determine what data to process | Process per controller instructions |\n| Application security | None (except configuration) | Full responsibility |\n| Infrastructure security | None | Full responsibility |\n| Data portability | Define export requirements | Provide export functionality |\n| Data deletion | Request deletion | Implement deletion per DPA |\n| Access configuration | Configure user roles | Provide RBAC platform |\n\n## Assessment Framework\n\n### Domain 1: Data Residency and Sovereignty\n\n**Assessment Questions:**\n\n| # | Question | Expected Evidence |\n|---|----------|-------------------|\n| 1.1 | In which regions\u002Favailability zones will personal data be stored at rest? | Architecture documentation specifying data storage locations |\n| 1.2 | Can the controller restrict processing to specific geographic regions? | Configuration documentation showing region-locking capability |\n| 1.3 | Are there any circumstances where data may be processed outside the selected region? | Disclosure of any cross-region processing (DR, support, analytics) |\n| 1.4 | Where is metadata and telemetry data stored? | Often stored in provider's home jurisdiction — must be disclosed |\n| 1.5 | Where do support staff access data from? | List of countries from which support personnel may access data |\n| 1.6 | What government access or disclosure obligations apply in processing jurisdictions? | Legal analysis of government access powers per EDPB Recommendations 01\u002F2020 |\n\n### Domain 2: Multi-Tenancy and Data Isolation\n\n| # | Question | Expected Evidence |\n|---|----------|-------------------|\n| 2.1 | How is tenant data isolated from other customers' data? | Architecture documentation — logical\u002Fphysical separation details |\n| 2.2 | Are encryption keys unique per tenant? | Key management architecture documentation |\n| 2.3 | Can one tenant's operations affect another tenant's data? | Side-channel and cross-tenant risk assessment |\n| 2.4 | How are shared infrastructure components secured? | Hypervisor security, shared storage controls |\n| 2.5 | What tenant isolation testing has been performed? | Penetration test results covering cross-tenant attacks |\n\n### Domain 3: ISO 27018 Cloud Privacy Controls\n\nISO\u002FIEC 27018:2019 extends ISO 27001 with cloud-specific PII protection controls:\n\n| Control | Requirement | Assessment Check |\n|---------|-------------|-----------------|\n| A.1 | PII processor consent — process only per controller instructions | Verify contractual terms and processing boundaries |\n| A.2 | Purpose limitation — no processing beyond controller purpose | Review processing scope documentation |\n| A.3 | Use for marketing — no use of PII for marketing without consent | Confirm no data monetization or marketing use |\n| A.4 | Notification — notify controller of government access requests | Verify government access notification process |\n| A.5 | Disclosure — document all disclosures of PII | Review disclosure logging mechanism |\n| A.10 | Return, transfer, and disposal — secure data handling at termination | Verify deletion procedures and certification |\n| A.11 | Confidentiality — binding confidentiality obligations on personnel | Verify personnel agreements cover cloud-specific risks |\n| A.12 | Sub-contracting — notification of sub-processor engagement | Verify sub-processor management per Art. 28(2) |\n\n### Domain 4: CSA STAR Assessment\n\nThe Cloud Security Alliance STAR (Security, Trust, Assurance, and Risk) program provides three levels:\n\n| Level | Description | Assessment Method |\n|-------|-------------|-------------------|\n| Level 1: Self-Assessment | Provider completes CSA Consensus Assessments Initiative Questionnaire (CAIQ) | Review self-assessment for completeness and substantiation |\n| Level 2: Third-Party Audit | Independent audit against CSA Cloud Controls Matrix (CCM) | Review audit report, scope, and findings |\n| Level 3: Continuous Monitoring | Real-time monitoring of control effectiveness | Review continuous monitoring dashboard and alerts |\n\n**Key CCM Control Domains for Privacy:**\n\n| Domain | Controls | Privacy Relevance |\n|--------|----------|------------------|\n| DSP (Data Security & Privacy) | DSP-01 through DSP-19 | Data classification, retention, inventory, privacy by design |\n| GRC (Governance, Risk, Compliance) | GRC-01 through GRC-08 | Governance framework, risk assessment, policy management |\n| IAM (Identity & Access Management) | IAM-01 through IAM-16 | Access control, credential management, MFA |\n| SEF (Security Incident Management) | SEF-01 through SEF-08 | Incident response, breach notification |\n\n### Domain 5: SOC 2 Type II Privacy Criterion\n\nThe AICPA Trust Services Criteria Privacy criterion evaluates:\n\n| Criterion | Area | Assessment Focus |\n|-----------|------|-----------------|\n| P1 | Notice | Provider discloses privacy practices to controllers |\n| P2 | Choice and consent | Controller can configure privacy settings |\n| P3 | Collection | Data collection limited to stated purposes |\n| P4 | Use, retention, disposal | Processing per instructions; retention per DPA; certified deletion |\n| P5 | Access | Controller can access and retrieve their data |\n| P6 | Disclosure to third parties | Sub-processor disclosure and management |\n| P7 | Security for privacy | Technical controls protecting PII |\n| P8 | Quality | Data integrity and accuracy controls |\n| P9 | Monitoring and enforcement | Compliance monitoring and breach response |\n\n### Domain 6: Shared Responsibility Model Mapping\n\nDocument the shared responsibility boundary for every control domain:\n\n| Control Domain | Controller Responsibility | Provider Responsibility | Gap\u002FRisk |\n|---------------|--------------------------|------------------------|----------|\n| Data classification | Classify data before upload | Provide classification tools | [Gap?] |\n| Encryption key management | [Depends on model] | [Depends on model] | [Gap?] |\n| Access control (application) | [Depends on model] | [Depends on model] | [Gap?] |\n| Vulnerability management | [Depends on model] | [Depends on model] | [Gap?] |\n| Incident detection | [Depends on model] | [Depends on model] | [Gap?] |\n| Data backup | [Depends on model] | [Depends on model] | [Gap?] |\n| Compliance reporting | [Depends on model] | [Depends on model] | [Gap?] |\n\n## Assessment Scoring\n\n| Domain | Weight | Score (1-5) | Weighted |\n|--------|--------|-------------|----------|\n| Data residency and sovereignty | 20% | | |\n| Multi-tenancy and isolation | 20% | | |\n| ISO 27018 compliance | 15% | | |\n| CSA STAR level | 15% | | |\n| SOC 2 Privacy criterion | 15% | | |\n| Shared responsibility clarity | 15% | | |\n| **TOTAL** | **100%** | | |\n\n## Key Regulatory References\n\n- GDPR Article 28 — Controller-processor relationship applies fully to cloud\n- GDPR Article 32 — Security measures including cloud-specific controls\n- ISO\u002FIEC 27018:2019 — Code of practice for protection of PII in public clouds\n- ISO\u002FIEC 27017:2015 — Code of practice for information security controls for cloud services\n- CSA Cloud Controls Matrix (CCM) v4.0 — Cloud security control framework\n- EDPB Recommendations 01\u002F2020 — Supplementary measures for cloud transfers\n- ENISA Cloud Computing Risk Assessment (2009, updated) — EU cloud risk framework\n","# Cloud Service Provider Privacy Assessment\n\n## Overview\n\nCloud service providers present unique privacy assessment challenges due to shared responsibility models, multi-tenancy architectures, global infrastructure, and the abstraction of physical processing locations. GDPR Article 28 obligations apply fully to cloud processing relationships, but the assessment approach must account for cloud-specific characteristics.\n\nISO\u002FIEC 27018:2019 provides the international standard for protecting personally identifiable information (PII) in public clouds, supplementing ISO 27001 with cloud-specific privacy controls. The Cloud Security Alliance (CSA) STAR program provides a cloud-specific security assurance framework. SOC 2 Type II with the Privacy trust services criterion addresses personal data handling controls.\n\nAt Summit Cloud Partners, cloud providers undergo enhanced assessment incorporating these cloud-specific frameworks alongside standard vendor due diligence.\n\n## Cloud Service Models and Privacy Implications\n\n### IaaS (Infrastructure as a Service)\n\n| Aspect | Controller Responsibility | Provider Responsibility |\n|--------|--------------------------|------------------------|\n| Data encryption at rest | Configure and manage keys | Provide encryption infrastructure |\n| Access management (app level) | Define and manage | Provide IAM platform |\n| Network security (app level) | Configure security groups, firewall rules | Provide network infrastructure |\n| Physical security | None | Full responsibility |\n| Patch management (OS) | Controller (or managed service) | Hypervisor and below |\n| Data backup | Configure and manage | Provide backup infrastructure |\n| Incident detection (app) | Application-level monitoring | Infrastructure-level monitoring |\n\n### PaaS (Platform as a Service)\n\n| Aspect | Controller Responsibility | Provider Responsibility |\n|--------|--------------------------|------------------------|\n| Application code security | Full responsibility | None |\n| Data handling in application | Full responsibility | None |\n| Runtime and middleware | Limited — configuration only | Manage platform components |\n| OS and infrastructure | None | Full responsibility |\n| Platform security patching | None | Full responsibility |\n| Identity management | Configure | Provide identity platform |\n\n### SaaS (Software as a Service)\n\n| Aspect | Controller Responsibility | Provider Responsibility |\n|--------|--------------------------|------------------------|\n| Data entered by users | Determine what data to process | Process per controller instructions |\n| Application security | None (except configuration) | Full responsibility |\n| Infrastructure security | None | Full responsibility |\n| Data portability | Define export requirements | Provide export functionality |\n| Data deletion | Request deletion | Implement deletion per DPA |\n| Access configuration | Configure user roles | Provide RBAC platform |\n\n## Assessment Framework\n\n### Domain 1: Data Residency and Sovereignty\n\n**Assessment Questions:**\n\n| # | Question | Expected Evidence |\n|---|----------|-------------------|\n| 1.1 | In which regions\u002Favailability zones will personal data be stored at rest? | Architecture documentation specifying data storage locations |\n| 1.2 | Can the controller restrict processing to specific geographic regions? | Configuration documentation showing region-locking capability |\n| 1.3 | Are there any circumstances where data may be processed outside the selected region? | Disclosure of any cross-region processing (DR, support, analytics) |\n| 1.4 | Where is metadata and telemetry data stored? | Often stored in provider's home jurisdiction — must be disclosed |\n| 1.5 | Where do support staff access data from? | List of countries from which support personnel may access data |\n| 1.6 | What government access or disclosure obligations apply in processing jurisdictions? | Legal analysis of government access powers per EDPB Recommendations 01\u002F2020 |\n\n### Domain 2: Multi-Tenancy and Data Isolation\n\n| # | Question | Expected Evidence |\n|---|----------|-------------------|\n| 2.1 | How is tenant data isolated from other customers' data? | Architecture documentation — logical\u002Fphysical separation details |\n| 2.2 | Are encryption keys unique per tenant? | Key management architecture documentation |\n| 2.3 | Can one tenant's operations affect another tenant's data? | Side-channel and cross-tenant risk assessment |\n| 2.4 | How are shared infrastructure components secured? | Hypervisor security, shared storage controls |\n| 2.5 | What tenant isolation testing has been performed? | Penetration test results covering cross-tenant attacks |\n\n### Domain 3: ISO 27018 Cloud Privacy Controls\n\nISO\u002FIEC 27018:2019 extends ISO 27001 with cloud-specific PII protection controls:\n\n| Control | Requirement | Assessment Check |\n|---------|-------------|-----------------|\n| A.1 | PII processor consent — process only per controller instructions | Verify contractual terms and processing boundaries |\n| A.2 | Purpose limitation — no processing beyond controller purpose | Review processing scope documentation |\n| A.3 | Use for marketing — no use of PII for marketing without consent | Confirm no data monetization or marketing use |\n| A.4 | Notification — notify controller of government access requests | Verify government access notification process |\n| A.5 | Disclosure — document all disclosures of PII | Review disclosure logging mechanism |\n| A.10 | Return, transfer, and disposal — secure data handling at termination | Verify deletion procedures and certification |\n| A.11 | Confidentiality — binding confidentiality obligations on personnel | Verify personnel agreements cover cloud-specific risks |\n| A.12 | Sub-contracting — notification of sub-processor engagement | Verify sub-processor management per Art. 28(2) |\n\n### Domain 4: CSA STAR Assessment\n\nThe Cloud Security Alliance STAR (Security, Trust, Assurance, and Risk) program provides three levels:\n\n| Level | Description | Assessment Method |\n|-------|-------------|-------------------|\n| Level 1: Self-Assessment | Provider completes CSA Consensus Assessments Initiative Questionnaire (CAIQ) | Review self-assessment for completeness and substantiation |\n| Level 2: Third-Party Audit | Independent audit against CSA Cloud Controls Matrix (CCM) | Review audit report, scope, and findings |\n| Level 3: Continuous Monitoring | Real-time monitoring of control effectiveness | Review continuous monitoring dashboard and alerts |\n\n**Key CCM Control Domains for Privacy:**\n\n| Domain | Controls | Privacy Relevance |\n|--------|----------|------------------|\n| DSP (Data Security & Privacy) | DSP-01 through DSP-19 | Data classification, retention, inventory, privacy by design |\n| GRC (Governance, Risk, Compliance) | GRC-01 through GRC-08 | Governance framework, risk assessment, policy management |\n| IAM (Identity & Access Management) | IAM-01 through IAM-16 | Access control, credential management, MFA |\n| SEF (Security Incident Management) | SEF-01 through SEF-08 | Incident response, breach notification |\n\n### Domain 5: SOC 2 Type II Privacy Criterion\n\nThe AICPA Trust Services Criteria Privacy criterion evaluates:\n\n| Criterion | Area | Assessment Focus |\n|-----------|------|-----------------|\n| P1 | Notice | Provider discloses privacy practices to controllers |\n| P2 | Choice and consent | Controller can configure privacy settings |\n| P3 | Collection | Data collection limited to stated purposes |\n| P4 | Use, retention, disposal | Processing per instructions; retention per DPA; certified deletion |\n| P5 | Access | Controller can access and retrieve their data |\n| P6 | Disclosure to third parties | Sub-processor disclosure and management |\n| P7 | Security for privacy | Technical controls protecting PII |\n| P8 | Quality | Data integrity and accuracy controls |\n| P9 | Monitoring and enforcement | Compliance monitoring and breach response |\n\n### Domain 6: Shared Responsibility Model Mapping\n\nDocument the shared responsibility boundary for every control domain:\n\n| Control Domain | Controller Responsibility | Provider Responsibility | Gap\u002FRisk |\n|---------------|--------------------------|------------------------|----------|\n| Data classification | Classify data before upload | Provide classification tools | [Gap?] |\n| Encryption key management | [Depends on model] | [Depends on model] | [Gap?] |\n| Access control (application) | [Depends on model] | [Depends on model] | [Gap?] |\n| Vulnerability management | [Depends on model] | [Depends on model] | [Gap?] |\n| Incident detection | [Depends on model] | [Depends on model] | [Gap?] |\n| Data backup | [Depends on model] | [Depends on model] | [Gap?] |\n| Compliance reporting | [Depends on model] | [Depends on model] | [Gap?] |\n\n## Assessment Scoring\n\n| Domain | Weight | Score (1-5) | Weighted |\n|--------|--------|-------------|----------|\n| Data residency and sovereignty | 20% | | |\n| Multi-tenancy and isolation | 20% | | |\n| ISO 27018 compliance | 15% | | |\n| CSA STAR level | 15% | | |\n| SOC 2 Privacy criterion | 15% | | |\n| Shared responsibility clarity | 15% | | |\n| **TOTAL** | **100%** | | |\n\n## Key Regulatory References\n\n- GDPR Article 28 — Controller-processor relationship applies fully to cloud\n- GDPR Article 32 — Security measures including cloud-specific controls\n- ISO\u002FIEC 27018:2019 — Code of practice for protection of PII in public clouds\n- ISO\u002FIEC 27017:2015 — Code of practice for information security controls for cloud services\n- CSA Cloud Controls Matrix (CCM) v4.0 — Cloud security control framework\n- EDPB Recommendations 01\u002F2020 — Supplementary measures for cloud transfers\n- ENISA Cloud Computing Risk Assessment (2009, updated) — EU cloud risk framework\n",{"name":5,"license":15,"metadata":42,"description":7},{"tags":43,"author":9,"domain":31,"version":44,"subdomain":45},"cloud-assessment, iso-27018, csa-star, shared-responsibility, data-residency","1.0","vendor-privacy-management","main","9b2ef9eae161c00a17241d42a388571321b33e9f","plugins\u002Fvendor-privacy-management-skills\u002Fskills\u002Fcloud-provider-assessment",67,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":67},[57,60,63],{"tool":58,"command":59},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill cloud-provider-assessment",{"tool":61,"command":62},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill cloud-provider-assessment",{"tool":64,"command":65},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill cloud-provider-assessment","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fvendor-privacy-management-skills\u002Fskills\u002Fcloud-provider-assessment\u002FSKILL.md",true,[69,75,81,85,89,93],{"path":70,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"assets\u002Ftemplate.md","ASSET","资产文件",2750,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fvendor-privacy-management-skills\u002Fskills\u002Fcloud-provider-assessment\u002Fassets\u002Ftemplate.md",{"path":76,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":79,"sourceHtmlUrl":80},"reference\u002Flanguages.md","REFERENCE","参考文档",9197,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fowasp-security\u002Freference\u002Flanguages.md",{"path":82,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":83,"sourceHtmlUrl":84},"reference\u002Fowasp-report.md",41604,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fowasp-security\u002Freference\u002Fowasp-report.md",{"path":86,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":87,"sourceHtmlUrl":88},"references\u002Fstandards.md",4513,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fvendor-privacy-management-skills\u002Fskills\u002Fcloud-provider-assessment\u002Freferences\u002Fstandards.md",{"path":90,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":91,"sourceHtmlUrl":92},"references\u002Fworkflows.md",5040,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fvendor-privacy-management-skills\u002Fskills\u002Fcloud-provider-assessment\u002Freferences\u002Fworkflows.md",{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"scripts\u002Fprocess.py","SCRIPT","脚本",12323,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fvendor-privacy-management-skills\u002Fskills\u002Fcloud-provider-assessment\u002Fscripts\u002Fprocess.py",[100,126,141,152,167,180],{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":117,"publishedAt":37},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[106,111,114],{"categoryNo":107,"categoryName":108,"taxonomyType":109,"taxonomyTypeDesc":110},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",{"categoryNo":112,"categoryName":113,"taxonomyType":109,"taxonomyTypeDesc":110},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":115,"categoryName":116,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务",[118,119,31,120,121,33,122,123,124,125],"email","workplace email privacy","compliance","content","policy","testing","monitoring","metadata",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":134,"publishedAt":37},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[132,133],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":115,"categoryName":116,"taxonomyType":21,"taxonomyTypeDesc":22},[33,135,136,137,120,138,139,31,140],"whistleblower data","identity","reporting","data protection","gdpr","prevention",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":148,"publishedAt":37},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[147],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[33,149,150,28,151,139,31,36],"vendor termination data","planning","extraction",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":159,"publishedAt":37},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[158],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[160,35,161,162,163,24,164,165,31,33,166],"vendor risk scoring","risk scoring","methodology","risk-scoring","transfer","certifications","processor",{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":174,"publishedAt":37},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[173],{"categoryNo":115,"categoryName":116,"taxonomyType":21,"taxonomyTypeDesc":22},[31,175,139,176,24,177,178,33,166,35,36,179],"vendor privacy due diligence","review","onboarding","flow","analysis",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":193,"publishedAt":37},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[186,189,192],{"categoryNo":187,"categoryName":188,"taxonomyType":109,"taxonomyTypeDesc":110},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":190,"categoryName":191,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000036","内容创作者",{"categoryNo":115,"categoryName":116,"taxonomyType":21,"taxonomyTypeDesc":22},[194,195,31,196,28,197,120,139,198,166,199,200,201,150],"vendor privacy audit","audit","report","audit report","remediation","collection","remediation-tracking","classification"]