CISO Forcing Questions — Security & Safety

A risk-paranoid threat-modeling skill that interrogates any plan touching customer data, compliance, or production access through six forcing questions. It produces a structured CISO review report with a verdict to ship, mitigate, or block.

c-level-advisor claude-code

📂 View skill on GitHub ↗ 🚀 How to use

✨ What it does

Runs STRIDE threat modeling and ranks top threats by likelihood and impact
Quantifies worst-case data exposure and financial impact (ALE)
Checks detection readiness with MTTD targets and detection rules
Verifies incident response runbooks and tabletop testing status
Identifies regulatory notification windows and pre-writes customer comms templates
Reviews vendor and supply chain security posture, including DPAs and subprocessors

🎯 When to use it

Before deploying any system that handles PII, PHI, or cardholder data
Before signing a new vendor with data access
Before a compliance audit (SOC 2, ISO 27001, HIPAA, GDPR)
After any near-miss incident
Before any architecture decision crossing trust boundaries

🚀 How to use

Trigger: /cs:ciso-review

Trigger with the slash command /cs:ciso-review <plan> where is a description of the change or plan to review. The skill expects a plan that touches data, compliance, or production access. Example prompts:

/cs:ciso-review Deploy new customer analytics dashboard
/cs:ciso-review Add third-party payment processor integration

📄 Output: A structured CISO review report in markdown with sections for threat model, blast radius, detection, response, regulatory, vendors, and a final verdict (SHIP, MITIGATE THEN SHIP, or BLOCK).

📦 Add this skill to Claude Code

# 1. Get the skills repo
git clone --depth 1 https://github.com/alirezarezvani/claude-skills /tmp/claude-skills

# 2. Copy this skill into your project (or ~/.claude/skills for all projects)
mkdir -p .claude/skills
cp -r /tmp/claude-skills/c-level-agents/skills/ciso-review .claude/skills/ciso-review

Skill source: c-level-agents/skills/ciso-review/SKILL.md

⚠️ Good to know

Requires access to the referenced scripts (risk_quantifier.py and compliance_tracker.py) and assumes the user can provide necessary details about the plan and environment.

❓ FAQ

What are the six CISO questions?

The six questions cover threat model (STRIDE), blast radius, detection, response, regulatory window, and vendor/supply chain.

What verdicts can the review output?

The verdict can be 🟢 SHIP, 🟡 MITIGATE THEN SHIP, or 🔴 BLOCK.

Does the skill provide regulatory notification windows?

Yes, it references GDPR (72h), HIPAA (60d), and state breach laws, and suggests pre-writing customer comms templates.

🤖 Overview, features, install steps and FAQ were generated from the project's SKILL.md on Sep 4, 2026. Always check the original source before running commands.