[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6P738FTH2FC2Z7EYHVQ0Z8D":3,"skill-same:01M6P738FTH2FC2Z7EYHVQ0Z8D":75},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":32,"commitSha":56,"skillDirectory":57,"forksCount":13,"repositoryHtmlUrl":58,"repositoryHomepageUrl":6,"ownerHtmlUrl":59,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":60,"install":61,"resources":74},"01M6P738FTH2FC2Z7EYHVQ0Z8D","iso27001-compliance",null,"Implement ISO 27001 Information Security Management System. Configure ISMS controls and risk management. Use when implementing enterprise security frameworks.","duc-duy-1612\u002FOnline-Delivery-Systems-Web","duc-duy-1612","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F192231384?v=4","01M6NSDKQQDKVTHZ8DZMZ1VYY6","01M6NSDKW8DDVTQHBT1HBDDJPT",0,"MIT","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fiso27001-compliance\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"iso27001 compliance","compliance","iso27001","configure","implementing","security management","information","iso","frameworks","main","community","system","safe","devops-security","risk","Enterprise","license","framework","change","security","2026-11-10 10:12:30",false,"---\nname: iso27001-compliance\ndescription: Implement ISO 27001 Information Security Management System. Configure\n  ISMS controls and risk management. Use when implementing enterprise security frameworks.\ncategory: security\nrisk: safe\nsource: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\nsource_repo: BagelHole\u002FDevOps-Security-Agent-Skills\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Checklist and framework guidance; no privileged tooling required. Apply\n  controls through your own change process.\nmetadata:\n  author: devops-skills\n  version: '1.0'\n---\n\n# ISO 27001 Compliance\n\nImplement an Information Security Management System (ISMS) aligned with ISO\u002FIEC 27001:2022.\n\n## When to Use\n\n- Establishing an ISMS for the first time in an organization\n- Preparing for ISO 27001 certification audit\n- Conducting risk assessments and developing risk treatment plans\n- Creating the Statement of Applicability (SoA)\n- Transitioning from ISO 27001:2013 to the 2022 revision\n- Meeting customer or regulatory requirements for ISO 27001 certification\n\n## ISMS Plan-Do-Check-Act Cycle\n\n```yaml\npdca_cycle:\n  plan:\n    - Define ISMS scope and boundaries\n    - Establish information security policy\n    - Conduct risk assessment\n    - Develop risk treatment plan\n    - Produce Statement of Applicability\n    - Obtain management approval and commitment\n    - Define security objectives and metrics\n\n  do:\n    - Implement selected Annex A controls\n    - Deploy technical security controls\n    - Conduct security awareness training\n    - Document all procedures and processes\n    - Implement incident management process\n    - Establish supplier security management\n\n  check:\n    - Conduct internal audits (at least annual)\n    - Perform management review meetings\n    - Monitor and measure control effectiveness\n    - Review incident trends and near misses\n    - Assess compliance with legal requirements\n    - Evaluate security metrics against objectives\n\n  act:\n    - Address nonconformities with corrective actions\n    - Implement continual improvement initiatives\n    - Update risk assessment based on changes\n    - Refine controls based on audit findings\n    - Communicate improvements to stakeholders\n```\n\n## ISMS Scope Definition\n\n```yaml\nisms_scope:\n  template:\n    organization: \"Company Name, Ltd.\"\n    scope_statement: |\n      The ISMS covers the design, development, operation, and support of\n      the Company's cloud-based SaaS platform, including all supporting\n      infrastructure, personnel, and processes at the following locations.\n\n    included:\n      locations:\n        - \"Primary office: 123 Main Street, City, Country\"\n        - \"AWS us-east-1 and eu-west-1 regions\"\n        - \"Remote workers accessing corporate systems\"\n      business_processes:\n        - \"Software development and deployment\"\n        - \"Cloud infrastructure management\"\n        - \"Customer data processing and storage\"\n        - \"Customer support operations\"\n        - \"Corporate IT and internal systems\"\n      information_assets:\n        - \"Customer data (PII, business data)\"\n        - \"Source code and intellectual property\"\n        - \"Employee personal data\"\n        - \"Financial records\"\n        - \"Security configurations and credentials\"\n      technology:\n        - \"AWS cloud infrastructure\"\n        - \"SaaS application stack\"\n        - \"Corporate IT systems (Google Workspace, Okta, Jira)\"\n        - \"Development tools (GitHub, CI\u002FCD pipelines)\"\n\n    excluded:\n      - \"Physical data center operations (inherited from AWS)\"\n      - \"Third-party SaaS platforms beyond integration points\"\n    exclusion_justification: \"Physical data center controls are inherited from AWS, which maintains its own ISO 27001 certification.\"\n\n    interfaces:\n      - \"Customer API endpoints\"\n      - \"Third-party integrations (payment processor, email provider)\"\n      - \"AWS management plane\"\n```\n\n## Risk Assessment Process\n\n```yaml\nrisk_assessment:\n  methodology:\n    approach: \"Asset-based risk assessment\"\n    risk_formula: \"Risk = Likelihood x Impact\"\n    scale: \"1-5 for both likelihood and impact (total 1-25)\"\n\n  likelihood_scale:\n    1: \"Rare - less than once per 5 years\"\n    2: \"Unlikely - once per 2-5 years\"\n    3: \"Possible - once per 1-2 years\"\n    4: \"Likely - multiple times per year\"\n    5: \"Almost Certain - monthly or more frequent\"\n\n  impact_scale:\n    1: \"Negligible - minimal operational impact, no data loss\"\n    2: \"Minor - limited impact, small data exposure, \u003C$10K cost\"\n    3: \"Moderate - significant impact, data breach \u003C1K records, \u003C$100K cost\"\n    4: \"Major - severe impact, large data breach, \u003C$1M cost, regulatory action\"\n    5: \"Critical - catastrophic, massive breach, >$1M cost, business viability at risk\"\n\n  risk_matrix:\n    #        Impact: 1    2    3    4    5\n    likelihood_5:  [5,  10,  15,  20,  25]\n    likelihood_4:  [4,   8,  12,  16,  20]\n    likelihood_3:  [3,   6,   9,  12,  15]\n    likelihood_2:  [2,   4,   6,   8,  10]\n    likelihood_1:  [1,   2,   3,   4,   5]\n\n  risk_appetite:\n    accept: \"Score 1-4 (low risk, accept with monitoring)\"\n    mitigate: \"Score 5-14 (medium risk, implement controls to reduce)\"\n    escalate: \"Score 15-25 (high\u002Fcritical risk, immediate action required)\"\n\n  treatment_options:\n    mitigate: \"Implement controls to reduce likelihood or impact\"\n    transfer: \"Insurance or contractual transfer to third party\"\n    avoid: \"Eliminate the risk by removing the activity or asset\"\n    accept: \"Accept with documented management approval\"\n\n  example_risk_register:\n    - id: \"RISK-001\"\n      asset: \"Customer database\"\n      threat: \"SQL injection attack\"\n      vulnerability: \"Insufficient input validation\"\n      likelihood: 3\n      impact: 4\n      inherent_risk: 12\n      treatment: \"mitigate\"\n      controls: [\"A.8.28 Secure coding\", \"A.8.8 Vulnerability management\"]\n      residual_likelihood: 1\n      residual_impact: 4\n      residual_risk: 4\n      risk_owner: \"CTO\"\n\n    - id: \"RISK-002\"\n      asset: \"Source code repository\"\n      threat: \"Insider theft of intellectual property\"\n      vulnerability: \"Excessive access permissions\"\n      likelihood: 2\n      impact: 5\n      inherent_risk: 10\n      treatment: \"mitigate\"\n      controls: [\"A.5.15 Access control\", \"A.8.3 Information access restriction\"]\n      residual_likelihood: 1\n      residual_impact: 5\n      residual_risk: 5\n      risk_owner: \"VP Engineering\"\n\n    - id: \"RISK-003\"\n      asset: \"Cloud infrastructure\"\n      threat: \"Cloud provider outage\"\n      vulnerability: \"Single-region deployment\"\n      likelihood: 3\n      impact: 3\n      inherent_risk: 9\n      treatment: \"mitigate\"\n      controls: [\"A.5.30 ICT readiness for business continuity\", \"A.8.14 Redundancy\"]\n      residual_likelihood: 3\n      residual_impact: 2\n      residual_risk: 6\n      risk_owner: \"Head of Infrastructure\"\n```\n\n## Statement of Applicability (SoA)\n\n```yaml\n# ISO 27001:2022 Annex A Controls - Statement of Applicability\nsoa_template:\n  organizational_controls_5:\n    \"A.5.1\":\n      control: \"Policies for information security\"\n      applicable: true\n      justification: \"Required to establish security governance\"\n      implementation: \"Information security policy approved by CEO, reviewed annually\"\n\n    \"A.5.2\":\n      control: \"Information security roles and responsibilities\"\n      applicable: true\n      justification: \"Required for accountability\"\n      implementation: \"RACI matrix for security responsibilities, CISO appointed\"\n\n    \"A.5.7\":\n      control: \"Threat intelligence\"\n      applicable: true\n      justification: \"Required for proactive threat management\"\n      implementation: \"Subscribe to threat feeds, CVE monitoring, vendor advisories\"\n\n    \"A.5.15\":\n      control: \"Access control\"\n      applicable: true\n      justification: \"Required for data protection\"\n      implementation: \"RBAC via Okta, least-privilege IAM policies, quarterly access reviews\"\n\n    \"A.5.23\":\n      control: \"Information security for use of cloud services\"\n      applicable: true\n      justification: \"Primary infrastructure is cloud-based\"\n      implementation: \"AWS security baseline, CSP shared responsibility documented\"\n\n    \"A.5.29\":\n      control: \"Information security during disruption\"\n      applicable: true\n      justification: \"Business continuity requirement\"\n      implementation: \"BCP\u002FDR plans tested annually, multi-AZ deployment\"\n\n    \"A.5.30\":\n      control: \"ICT readiness for business continuity\"\n      applicable: true\n      justification: \"Ensure technology supports continuity\"\n      implementation: \"DR runbooks, RTO\u002FRPO defined, failover tested quarterly\"\n\n  people_controls_6:\n    \"A.6.1\":\n      control: \"Screening\"\n      applicable: true\n      implementation: \"Background checks for all employees before hiring\"\n\n    \"A.6.3\":\n      control: \"Information security awareness, education and training\"\n      applicable: true\n      implementation: \"Annual security training, phishing simulations quarterly\"\n\n    \"A.6.5\":\n      control: \"Responsibilities after termination or change of employment\"\n      applicable: true\n      implementation: \"Offboarding checklist, access revoked within 24 hours\"\n\n  physical_controls_7:\n    \"A.7.1\":\n      control: \"Physical security perimeters\"\n      applicable: false\n      exclusion_justification: \"No company-operated data centers, inherited from AWS\"\n\n  technology_controls_8:\n    \"A.8.1\":\n      control: \"User endpoint devices\"\n      applicable: true\n      implementation: \"MDM enrollment, disk encryption, screen lock policy\"\n\n    \"A.8.5\":\n      control: \"Secure authentication\"\n      applicable: true\n      implementation: \"MFA required for all systems, SSO via Okta\"\n\n    \"A.8.8\":\n      control: \"Management of technical vulnerabilities\"\n      applicable: true\n      implementation: \"Weekly vulnerability scans, 30-day patch SLA for critical\"\n\n    \"A.8.9\":\n      control: \"Configuration management\"\n      applicable: true\n      implementation: \"Infrastructure as code, AWS Config rules, baseline hardening\"\n\n    \"A.8.15\":\n      control: \"Logging\"\n      applicable: true\n      implementation: \"Centralized logging via CloudWatch + SIEM, 12-month retention\"\n\n    \"A.8.16\":\n      control: \"Monitoring activities\"\n      applicable: true\n      implementation: \"SIEM alerting, 24\u002F7 on-call rotation, anomaly detection\"\n\n    \"A.8.24\":\n      control: \"Use of cryptography\"\n      applicable: true\n      implementation: \"TLS 1.2+, AES-256 at rest, KMS key management\"\n\n    \"A.8.25\":\n      control: \"Secure development lifecycle\"\n      applicable: true\n      implementation: \"SAST\u002FDAST in CI, code review required, dependency scanning\"\n\n    \"A.8.28\":\n      control: \"Secure coding\"\n      applicable: true\n      implementation: \"OWASP guidelines, security code review, automated linting\"\n```\n\n## Internal Audit Program\n\n```yaml\ninternal_audit:\n  schedule:\n    frequency: \"Annual full cycle, quarterly focused audits\"\n    cycle: \"All ISMS clauses and applicable Annex A controls audited over 12 months\"\n\n  audit_plan_template:\n    audit_id: \"IA-2025-Q1\"\n    scope: \"Clauses 4-10, Annex A controls A.5.1-A.5.15\"\n    auditor: \"Internal auditor (independent of audited area)\"\n    audit_dates: \"2025-03-10 to 2025-03-14\"\n    areas:\n      - area: \"Access Control (A.5.15)\"\n        auditee: \"IT Security Team\"\n        evidence_requested:\n          - \"Access review records from last quarter\"\n          - \"Joiner\u002Fmover\u002Fleaver process records\"\n          - \"Privileged access management logs\"\n      - area: \"Risk Management (Clause 6.1)\"\n        auditee: \"Risk Management Team\"\n        evidence_requested:\n          - \"Current risk register\"\n          - \"Risk assessment methodology document\"\n          - \"Management risk review meeting minutes\"\n\n  finding_categories:\n    major_nonconformity: \"Requirement not met, significant risk to ISMS effectiveness\"\n    minor_nonconformity: \"Requirement partially met, limited risk\"\n    observation: \"Area for improvement, no requirement breach\"\n    positive_finding: \"Notably effective implementation\"\n\n  corrective_action:\n    major: \"Root cause analysis within 10 days, corrective action within 30 days\"\n    minor: \"Corrective action within 60 days\"\n    observation: \"Address in next ISMS review cycle\"\n    verification: \"Auditor verifies corrective action effectiveness\"\n```\n\n## Management Review Meeting\n\n```yaml\nmanagement_review:\n  frequency: \"At least annually, recommended quarterly\"\n  attendees:\n    required:\n      - \"CEO or Managing Director\"\n      - \"CISO or Information Security Manager\"\n      - \"Department heads\"\n    optional:\n      - \"Internal auditor\"\n      - \"Risk manager\"\n      - \"External consultant\"\n\n  mandatory_inputs:\n    - \"Status of actions from previous management reviews\"\n    - \"Changes in external and internal issues relevant to the ISMS\"\n    - \"Information security performance (metrics and KPIs)\"\n    - \"Audit results (internal and external)\"\n    - \"Incident trends and nonconformities\"\n    - \"Risk assessment results and risk treatment plan status\"\n    - \"Interested party feedback\"\n    - \"Opportunities for continual improvement\"\n\n  mandatory_outputs:\n    - \"Decisions on continual improvement opportunities\"\n    - \"Decisions on changes needed to the ISMS\"\n    - \"Resource allocation decisions\"\n    - \"Updated risk acceptance decisions\"\n\n  kpis_to_report:\n    - \"Number and severity of security incidents\"\n    - \"Vulnerability remediation SLA compliance\"\n    - \"Security awareness training completion rate\"\n    - \"Access review completion rate\"\n    - \"Audit finding closure rate\"\n    - \"Risk treatment plan progress\"\n    - \"Patch compliance percentage\"\n```\n\n## ISO 27001 Certification Checklist\n\n```yaml\ncertification_checklist:\n  stage_1_audit_preparation:\n    - [ ] ISMS scope documented and approved\n    - [ ] Information security policy published\n    - [ ] Risk assessment methodology defined\n    - [ ] Risk assessment completed with risk register\n    - [ ] Risk treatment plan developed\n    - [ ] Statement of Applicability completed\n    - [ ] ISMS objectives defined with measurable targets\n    - [ ] Internal audit program established\n    - [ ] At least one full internal audit completed\n    - [ ] Management review conducted with minutes documented\n    - [ ] Document control process in place\n\n  stage_2_audit_preparation:\n    - [ ] All Annex A controls implemented per SoA\n    - [ ] Evidence of control operation for 3+ months\n    - [ ] Corrective actions from internal audit tracked and closed\n    - [ ] Security awareness training delivered and recorded\n    - [ ] Incident management process operational with records\n    - [ ] Supplier security assessments performed\n    - [ ] Business continuity plan tested\n    - [ ] All mandatory documented information available\n    - [ ] Employees aware of security policy and their responsibilities\n\n  surveillance_audit_readiness:\n    - [ ] All corrective actions from certification audit closed\n    - [ ] Continuous internal audit schedule maintained\n    - [ ] Management reviews conducted per schedule\n    - [ ] Risk register updated with new threats and changes\n    - [ ] Metrics demonstrate ISMS effectiveness\n    - [ ] Changes to ISMS scope documented\n```\n\n## Best Practices\n\n- Secure visible management commitment with a signed information security policy\n- Define ISMS scope carefully; too broad makes certification expensive, too narrow reduces value\n- Use an asset-based risk assessment approach to ensure comprehensive coverage\n- Maintain the Statement of Applicability as a living document aligned with the risk register\n- Conduct internal audits with auditors independent of the area being audited\n- Hold management review meetings quarterly rather than only annually\n- Integrate ISO 27001 controls into daily operations rather than treating them as a separate compliance exercise\n- Use metrics and KPIs to demonstrate ISMS effectiveness to auditors and management\n- Plan for the 3-year certification cycle: certification audit, then two surveillance audits\n- Start collecting evidence of control operation at least 3 months before the Stage 2 audit\n\n## Limitations\n\n- Guidance and checklists only; not legal advice and not a substitute for a qualified auditor.\n- Docs-only import: upstream templates and scripts not bundled.\n\n### Example\n\n```markdown\nMap this skill's control checklist to our current evidence and list gaps.\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n","# ISO 27001 Compliance\n\nImplement an Information Security Management System (ISMS) aligned with ISO\u002FIEC 27001:2022.\n\n## When to Use\n\n- Establishing an ISMS for the first time in an organization\n- Preparing for ISO 27001 certification audit\n- Conducting risk assessments and developing risk treatment plans\n- Creating the Statement of Applicability (SoA)\n- Transitioning from ISO 27001:2013 to the 2022 revision\n- Meeting customer or regulatory requirements for ISO 27001 certification\n\n## ISMS Plan-Do-Check-Act Cycle\n\n```yaml\npdca_cycle:\n  plan:\n    - Define ISMS scope and boundaries\n    - Establish information security policy\n    - Conduct risk assessment\n    - Develop risk treatment plan\n    - Produce Statement of Applicability\n    - Obtain management approval and commitment\n    - Define security objectives and metrics\n\n  do:\n    - Implement selected Annex A controls\n    - Deploy technical security controls\n    - Conduct security awareness training\n    - Document all procedures and processes\n    - Implement incident management process\n    - Establish supplier security management\n\n  check:\n    - Conduct internal audits (at least annual)\n    - Perform management review meetings\n    - Monitor and measure control effectiveness\n    - Review incident trends and near misses\n    - Assess compliance with legal requirements\n    - Evaluate security metrics against objectives\n\n  act:\n    - Address nonconformities with corrective actions\n    - Implement continual improvement initiatives\n    - Update risk assessment based on changes\n    - Refine controls based on audit findings\n    - Communicate improvements to stakeholders\n```\n\n## ISMS Scope Definition\n\n```yaml\nisms_scope:\n  template:\n    organization: \"Company Name, Ltd.\"\n    scope_statement: |\n      The ISMS covers the design, development, operation, and support of\n      the Company's cloud-based SaaS platform, including all supporting\n      infrastructure, personnel, and processes at the following locations.\n\n    included:\n      locations:\n        - \"Primary office: 123 Main Street, City, Country\"\n        - \"AWS us-east-1 and eu-west-1 regions\"\n        - \"Remote workers accessing corporate systems\"\n      business_processes:\n        - \"Software development and deployment\"\n        - \"Cloud infrastructure management\"\n        - \"Customer data processing and storage\"\n        - \"Customer support operations\"\n        - \"Corporate IT and internal systems\"\n      information_assets:\n        - \"Customer data (PII, business data)\"\n        - \"Source code and intellectual property\"\n        - \"Employee personal data\"\n        - \"Financial records\"\n        - \"Security configurations and credentials\"\n      technology:\n        - \"AWS cloud infrastructure\"\n        - \"SaaS application stack\"\n        - \"Corporate IT systems (Google Workspace, Okta, Jira)\"\n        - \"Development tools (GitHub, CI\u002FCD pipelines)\"\n\n    excluded:\n      - \"Physical data center operations (inherited from AWS)\"\n      - \"Third-party SaaS platforms beyond integration points\"\n    exclusion_justification: \"Physical data center controls are inherited from AWS, which maintains its own ISO 27001 certification.\"\n\n    interfaces:\n      - \"Customer API endpoints\"\n      - \"Third-party integrations (payment processor, email provider)\"\n      - \"AWS management plane\"\n```\n\n## Risk Assessment Process\n\n```yaml\nrisk_assessment:\n  methodology:\n    approach: \"Asset-based risk assessment\"\n    risk_formula: \"Risk = Likelihood x Impact\"\n    scale: \"1-5 for both likelihood and impact (total 1-25)\"\n\n  likelihood_scale:\n    1: \"Rare - less than once per 5 years\"\n    2: \"Unlikely - once per 2-5 years\"\n    3: \"Possible - once per 1-2 years\"\n    4: \"Likely - multiple times per year\"\n    5: \"Almost Certain - monthly or more frequent\"\n\n  impact_scale:\n    1: \"Negligible - minimal operational impact, no data loss\"\n    2: \"Minor - limited impact, small data exposure, \u003C$10K cost\"\n    3: \"Moderate - significant impact, data breach \u003C1K records, \u003C$100K cost\"\n    4: \"Major - severe impact, large data breach, \u003C$1M cost, regulatory action\"\n    5: \"Critical - catastrophic, massive breach, >$1M cost, business viability at risk\"\n\n  risk_matrix:\n    #        Impact: 1    2    3    4    5\n    likelihood_5:  [5,  10,  15,  20,  25]\n    likelihood_4:  [4,   8,  12,  16,  20]\n    likelihood_3:  [3,   6,   9,  12,  15]\n    likelihood_2:  [2,   4,   6,   8,  10]\n    likelihood_1:  [1,   2,   3,   4,   5]\n\n  risk_appetite:\n    accept: \"Score 1-4 (low risk, accept with monitoring)\"\n    mitigate: \"Score 5-14 (medium risk, implement controls to reduce)\"\n    escalate: \"Score 15-25 (high\u002Fcritical risk, immediate action required)\"\n\n  treatment_options:\n    mitigate: \"Implement controls to reduce likelihood or impact\"\n    transfer: \"Insurance or contractual transfer to third party\"\n    avoid: \"Eliminate the risk by removing the activity or asset\"\n    accept: \"Accept with documented management approval\"\n\n  example_risk_register:\n    - id: \"RISK-001\"\n      asset: \"Customer database\"\n      threat: \"SQL injection attack\"\n      vulnerability: \"Insufficient input validation\"\n      likelihood: 3\n      impact: 4\n      inherent_risk: 12\n      treatment: \"mitigate\"\n      controls: [\"A.8.28 Secure coding\", \"A.8.8 Vulnerability management\"]\n      residual_likelihood: 1\n      residual_impact: 4\n      residual_risk: 4\n      risk_owner: \"CTO\"\n\n    - id: \"RISK-002\"\n      asset: \"Source code repository\"\n      threat: \"Insider theft of intellectual property\"\n      vulnerability: \"Excessive access permissions\"\n      likelihood: 2\n      impact: 5\n      inherent_risk: 10\n      treatment: \"mitigate\"\n      controls: [\"A.5.15 Access control\", \"A.8.3 Information access restriction\"]\n      residual_likelihood: 1\n      residual_impact: 5\n      residual_risk: 5\n      risk_owner: \"VP Engineering\"\n\n    - id: \"RISK-003\"\n      asset: \"Cloud infrastructure\"\n      threat: \"Cloud provider outage\"\n      vulnerability: \"Single-region deployment\"\n      likelihood: 3\n      impact: 3\n      inherent_risk: 9\n      treatment: \"mitigate\"\n      controls: [\"A.5.30 ICT readiness for business continuity\", \"A.8.14 Redundancy\"]\n      residual_likelihood: 3\n      residual_impact: 2\n      residual_risk: 6\n      risk_owner: \"Head of Infrastructure\"\n```\n\n## Statement of Applicability (SoA)\n\n```yaml\n# ISO 27001:2022 Annex A Controls - Statement of Applicability\nsoa_template:\n  organizational_controls_5:\n    \"A.5.1\":\n      control: \"Policies for information security\"\n      applicable: true\n      justification: \"Required to establish security governance\"\n      implementation: \"Information security policy approved by CEO, reviewed annually\"\n\n    \"A.5.2\":\n      control: \"Information security roles and responsibilities\"\n      applicable: true\n      justification: \"Required for accountability\"\n      implementation: \"RACI matrix for security responsibilities, CISO appointed\"\n\n    \"A.5.7\":\n      control: \"Threat intelligence\"\n      applicable: true\n      justification: \"Required for proactive threat management\"\n      implementation: \"Subscribe to threat feeds, CVE monitoring, vendor advisories\"\n\n    \"A.5.15\":\n      control: \"Access control\"\n      applicable: true\n      justification: \"Required for data protection\"\n      implementation: \"RBAC via Okta, least-privilege IAM policies, quarterly access reviews\"\n\n    \"A.5.23\":\n      control: \"Information security for use of cloud services\"\n      applicable: true\n      justification: \"Primary infrastructure is cloud-based\"\n      implementation: \"AWS security baseline, CSP shared responsibility documented\"\n\n    \"A.5.29\":\n      control: \"Information security during disruption\"\n      applicable: true\n      justification: \"Business continuity requirement\"\n      implementation: \"BCP\u002FDR plans tested annually, multi-AZ deployment\"\n\n    \"A.5.30\":\n      control: \"ICT readiness for business continuity\"\n      applicable: true\n      justification: \"Ensure technology supports continuity\"\n      implementation: \"DR runbooks, RTO\u002FRPO defined, failover tested quarterly\"\n\n  people_controls_6:\n    \"A.6.1\":\n      control: \"Screening\"\n      applicable: true\n      implementation: \"Background checks for all employees before hiring\"\n\n    \"A.6.3\":\n      control: \"Information security awareness, education and training\"\n      applicable: true\n      implementation: \"Annual security training, phishing simulations quarterly\"\n\n    \"A.6.5\":\n      control: \"Responsibilities after termination or change of employment\"\n      applicable: true\n      implementation: \"Offboarding checklist, access revoked within 24 hours\"\n\n  physical_controls_7:\n    \"A.7.1\":\n      control: \"Physical security perimeters\"\n      applicable: false\n      exclusion_justification: \"No company-operated data centers, inherited from AWS\"\n\n  technology_controls_8:\n    \"A.8.1\":\n      control: \"User endpoint devices\"\n      applicable: true\n      implementation: \"MDM enrollment, disk encryption, screen lock policy\"\n\n    \"A.8.5\":\n      control: \"Secure authentication\"\n      applicable: true\n      implementation: \"MFA required for all systems, SSO via Okta\"\n\n    \"A.8.8\":\n      control: \"Management of technical vulnerabilities\"\n      applicable: true\n      implementation: \"Weekly vulnerability scans, 30-day patch SLA for critical\"\n\n    \"A.8.9\":\n      control: \"Configuration management\"\n      applicable: true\n      implementation: \"Infrastructure as code, AWS Config rules, baseline hardening\"\n\n    \"A.8.15\":\n      control: \"Logging\"\n      applicable: true\n      implementation: \"Centralized logging via CloudWatch + SIEM, 12-month retention\"\n\n    \"A.8.16\":\n      control: \"Monitoring activities\"\n      applicable: true\n      implementation: \"SIEM alerting, 24\u002F7 on-call rotation, anomaly detection\"\n\n    \"A.8.24\":\n      control: \"Use of cryptography\"\n      applicable: true\n      implementation: \"TLS 1.2+, AES-256 at rest, KMS key management\"\n\n    \"A.8.25\":\n      control: \"Secure development lifecycle\"\n      applicable: true\n      implementation: \"SAST\u002FDAST in CI, code review required, dependency scanning\"\n\n    \"A.8.28\":\n      control: \"Secure coding\"\n      applicable: true\n      implementation: \"OWASP guidelines, security code review, automated linting\"\n```\n\n## Internal Audit Program\n\n```yaml\ninternal_audit:\n  schedule:\n    frequency: \"Annual full cycle, quarterly focused audits\"\n    cycle: \"All ISMS clauses and applicable Annex A controls audited over 12 months\"\n\n  audit_plan_template:\n    audit_id: \"IA-2025-Q1\"\n    scope: \"Clauses 4-10, Annex A controls A.5.1-A.5.15\"\n    auditor: \"Internal auditor (independent of audited area)\"\n    audit_dates: \"2025-03-10 to 2025-03-14\"\n    areas:\n      - area: \"Access Control (A.5.15)\"\n        auditee: \"IT Security Team\"\n        evidence_requested:\n          - \"Access review records from last quarter\"\n          - \"Joiner\u002Fmover\u002Fleaver process records\"\n          - \"Privileged access management logs\"\n      - area: \"Risk Management (Clause 6.1)\"\n        auditee: \"Risk Management Team\"\n        evidence_requested:\n          - \"Current risk register\"\n          - \"Risk assessment methodology document\"\n          - \"Management risk review meeting minutes\"\n\n  finding_categories:\n    major_nonconformity: \"Requirement not met, significant risk to ISMS effectiveness\"\n    minor_nonconformity: \"Requirement partially met, limited risk\"\n    observation: \"Area for improvement, no requirement breach\"\n    positive_finding: \"Notably effective implementation\"\n\n  corrective_action:\n    major: \"Root cause analysis within 10 days, corrective action within 30 days\"\n    minor: \"Corrective action within 60 days\"\n    observation: \"Address in next ISMS review cycle\"\n    verification: \"Auditor verifies corrective action effectiveness\"\n```\n\n## Management Review Meeting\n\n```yaml\nmanagement_review:\n  frequency: \"At least annually, recommended quarterly\"\n  attendees:\n    required:\n      - \"CEO or Managing Director\"\n      - \"CISO or Information Security Manager\"\n      - \"Department heads\"\n    optional:\n      - \"Internal auditor\"\n      - \"Risk manager\"\n      - \"External consultant\"\n\n  mandatory_inputs:\n    - \"Status of actions from previous management reviews\"\n    - \"Changes in external and internal issues relevant to the ISMS\"\n    - \"Information security performance (metrics and KPIs)\"\n    - \"Audit results (internal and external)\"\n    - \"Incident trends and nonconformities\"\n    - \"Risk assessment results and risk treatment plan status\"\n    - \"Interested party feedback\"\n    - \"Opportunities for continual improvement\"\n\n  mandatory_outputs:\n    - \"Decisions on continual improvement opportunities\"\n    - \"Decisions on changes needed to the ISMS\"\n    - \"Resource allocation decisions\"\n    - \"Updated risk acceptance decisions\"\n\n  kpis_to_report:\n    - \"Number and severity of security incidents\"\n    - \"Vulnerability remediation SLA compliance\"\n    - \"Security awareness training completion rate\"\n    - \"Access review completion rate\"\n    - \"Audit finding closure rate\"\n    - \"Risk treatment plan progress\"\n    - \"Patch compliance percentage\"\n```\n\n## ISO 27001 Certification Checklist\n\n```yaml\ncertification_checklist:\n  stage_1_audit_preparation:\n    - [ ] ISMS scope documented and approved\n    - [ ] Information security policy published\n    - [ ] Risk assessment methodology defined\n    - [ ] Risk assessment completed with risk register\n    - [ ] Risk treatment plan developed\n    - [ ] Statement of Applicability completed\n    - [ ] ISMS objectives defined with measurable targets\n    - [ ] Internal audit program established\n    - [ ] At least one full internal audit completed\n    - [ ] Management review conducted with minutes documented\n    - [ ] Document control process in place\n\n  stage_2_audit_preparation:\n    - [ ] All Annex A controls implemented per SoA\n    - [ ] Evidence of control operation for 3+ months\n    - [ ] Corrective actions from internal audit tracked and closed\n    - [ ] Security awareness training delivered and recorded\n    - [ ] Incident management process operational with records\n    - [ ] Supplier security assessments performed\n    - [ ] Business continuity plan tested\n    - [ ] All mandatory documented information available\n    - [ ] Employees aware of security policy and their responsibilities\n\n  surveillance_audit_readiness:\n    - [ ] All corrective actions from certification audit closed\n    - [ ] Continuous internal audit schedule maintained\n    - [ ] Management reviews conducted per schedule\n    - [ ] Risk register updated with new threats and changes\n    - [ ] Metrics demonstrate ISMS effectiveness\n    - [ ] Changes to ISMS scope documented\n```\n\n## Best Practices\n\n- Secure visible management commitment with a signed information security policy\n- Define ISMS scope carefully; too broad makes certification expensive, too narrow reduces value\n- Use an asset-based risk assessment approach to ensure comprehensive coverage\n- Maintain the Statement of Applicability as a living document aligned with the risk register\n- Conduct internal audits with auditors independent of the area being audited\n- Hold management review meetings quarterly rather than only annually\n- Integrate ISO 27001 controls into daily operations rather than treating them as a separate compliance exercise\n- Use metrics and KPIs to demonstrate ISMS effectiveness to auditors and management\n- Plan for the 3-year certification cycle: certification audit, then two surveillance audits\n- Start collecting evidence of control operation at least 3 months before the Stage 2 audit\n\n## Limitations\n\n- Guidance and checklists only; not legal advice and not a substitute for a qualified auditor.\n- Docs-only import: upstream templates and scripts not bundled.\n\n### Example\n\n```markdown\nMap this skill's control checklist to our current evidence and list gaps.\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n",{"name":5,"risk":35,"source":48,"license":14,"category":42,"metadata":49,"date_added":52,"description":7,"source_repo":53,"source_type":33,"compatibility":54,"license_source":55},"https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills",{"author":50,"version":51},"devops-skills","1.0","2026-09-20","BagelHole\u002FDevOps-Security-Agent-Skills","Checklist and framework guidance; no privileged tooling required. Apply controls through your own change process.","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE","f3312ba749561b6159f477dbfc9313c875d40a56",".agents\u002Fskills_archive\u002Fiso27001-compliance","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612","2026-10-25 23:50:58",{"source":8,"skillName":5,"commands":62,"prompt":72,"zipAvailable":73},[63,66,69],{"tool":64,"command":65},"npx","npx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill iso27001-compliance",{"tool":67,"command":68},"bunx","bunx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill iso27001-compliance",{"tool":70,"command":71},"pnpm","pnpm dlx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill iso27001-compliance","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fiso27001-compliance\u002FSKILL.md",true,[],[76,102,126,149,175,199],{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":87,"publishedAt":43},"01M6Q0FA5FZ410Z33Z3TFQ4DBA","zero-trust","Implement zero-trust network architecture. Configure identity-based access, micro-segmentation, and continuous verification. Use when implementing modern security architectures.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzero-trust\u002FSKILL.md",[82],{"categoryNo":83,"categoryName":84,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[88,89,90,91,92,93,78,94,36,95,26,96,33,32,97,98,99,100,101,27],"ZeRO","trust","zero trust","architecture","assessment","verification","segmentation","access","only","active","critical","scope","scripts","relevant",{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":108,"publishedAt":43},"01M6Q0F1YZJW3KX5FBKEVZ8CV4","zcode-delegate","Delegate coding tasks to the Z.AI ZCode CLI only when the user explicitly requests it, while the orchestrator retains review and landing responsibility.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzcode-delegate\u002FSKILL.md",[],[109,110,111,112,113,114,115,116,117,118,119,120,121,96,122,33,123,124,98,125],"delegate","zcode","zcode delegate","review","cli","orchestration","tasks","run","Bash","model","node","read","orchestrator","files","desktop app","app","agent-orchestration",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":132,"publishedAt":43},"01M6Q0ETK41VGNMYEXW0T00AJN","youtube-transcript","Fetch YouTube transcripts through DeepAPI or local fallback tooling and save clean text output.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript\u002FSKILL.md",[],[133,134,135,35,136,137,138,39,139,140,141,142,143,33,32,144,145,146,147,148],"transcript","youtube transcript","youtube","github","codex","research","https","text","fetch","tooling","clean","local","output","deepapi","youtube transcripts","blob",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":164,"publishedAt":43},"01M6Q0EPPH2PVMDW40017F8WX0","youtube-transcript-skills","Fetch YouTube video transcripts, search videos\u002Fchannels, browse channels, and extract playlists via the getyoutubetranscript.com API - free tier, no card required.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript-skills\u002FSKILL.md",[155,158,161],{"categoryNo":156,"categoryName":157,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":159,"categoryName":160,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":162,"categoryName":163,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000030","开发工程师",[133,134,135,165,35,166,136,137,39,167,168,169,170,141,171,33,32,172,173,174],"youtube transcript skills","gemini","search","api","Video","browse","api-integration","free","card","channels",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":185,"publishedAt":43},"01M6Q0EAB96PX83W5PTE8A0R8D","youtube-notetaker","Turn YouTube talks into local study notes with slides, transcripts, editable annotations, and a markdown-backed viewer.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-notetaker\u002FSKILL.md",[181,184],{"categoryNo":182,"categoryName":183,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":159,"categoryName":160,"taxonomyType":85,"taxonomyTypeDesc":86},[135,186,187,113,35,188,189,190,191,39,169,192,193,194,195,32,196,144,197,198],"youtube notetaker","notetaker","workflow","official","notes","code","markdown","slides","annotations","README","study","dair-academy","viewer",{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":203,"categories":204,"keywords":206,"publishedAt":43},"01M6Q0E55F0GW5MX48V8HXS8B5","youtube-full","Fetch YouTube transcripts, search videos, browse channels, and extract playlists via TranscriptAPI — no yt-dlp, no Google API key, works from any cloud server.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-full\u002FSKILL.md",[205],{"categoryNo":156,"categoryName":157,"taxonomyType":85,"taxonomyTypeDesc":86},[207,135,208,209,35,166,167,210,211,168,169,170,141,212,171,33,32,172,213,147],"youtube full","full","google","server","dlp","credits","automatic"]