security-policy-and-standards
Write and maintain security policies and technical standards that are enforceable, usable, and aligned with real controls. Use when creating security policy frameworks, baselines, or hardening standards for teams.
- License 许可
- MIT
- 最近更新
- 2026-07-22
- Stars
- ★ 7
- Forks
- 1
01 前言 Front Matter
- name
- security-policy-and-standards
- description
- Write and maintain security policies and technical standards that are enforceable, usable, and aligned with real controls. Use when creating security policy frameworks, baselines, or hardening standards for teams.
03 SKILL.md 正文
Security Policy and Standards
Overview
Policies state requirements; standards specify how. Effective security documents are clear enough to implement and test — not generic statements copied from the internet.
When to Use
- Building a security policy hierarchy
- Publishing hardening baselines (CIS-aligned or custom)
- Aligning policy with compliance obligations
- Reducing ambiguity in security requirements for engineers
Core Practices
- Separate policy (what/why) from standards (how) from procedures
- Write testable requirements
- Assign owners and review cycles
- Map controls to implementation evidence
- Involve implementers in drafting to ensure feasibility
- Version and communicate changes
Principles
- Unenforceable policy trains people to ignore security docs
- Exceptions need process, not silent noncompliance
- Shorter, clearer documents get higher compliance
- Standards should enable automation and measurement
Verification
- [ ] Critical domains have current policy/standard coverage
- [ ] Requirements are testable
- [ ] Exception handling is defined
04 同仓库更多 Skills
compliance-monitoring
Design compliance monitoring and testing programs that verify controls work in practice and surface issues before regulators do. Use when building monitoring plans, compliance testing, or continuous control monitoring.
complaints-handling
Operate complaints-handling processes that meet regulatory standards — logging, timely resolution, root-cause analysis, and fair outcomes. Use when designing or improving regulated complaints frameworks or analyzing complaint themes for conduct risk.
aml-kyc-basics
Apply AML/KYC fundamentals — customer due diligence, monitoring, suspicious activity escalation, and recordkeeping — for financial crime compliance. Use when designing onboarding controls, transaction monitoring concepts, or AML program components in financial services.
ai-model-compliance
Apply compliance controls to AI and automated decision systems — transparency, fairness, human oversight, documentation, and regulatory alignment. Use when deploying AI in regulated processes (credit, fraud, customer decisions) or responding to AI governance expectations.
data-quality-management
Manage data quality end-to-end — dimensions, rules, remediation, and prevention — beyond one-off cleaning scripts. Use when building sustained data quality programs or fixing systemic accuracy, completeness, or consistency problems.
data-lineage
Capture and use data lineage — where data comes from, how it transforms, and what depends on it — for impact analysis, debugging, and trust. Use when tracing metric origins, assessing change impact, or diagnosing broken pipelines.