@monoes/monomindcli 2.15.3 → 2.15.4

package/org-skills/isms-audit-expert/SKILL.md

@@ -0,0 +1,229 @@
+---
+name: isms-audit-expert
+description: "Information Security Management System (ISMS) audit expert for ISO 27001 compliance verification, security control assessment, and certification support. Use when the user mentions ISO 27001, ISMS audit, Annex A controls, Statement of Applicability (SOA), gap analysis, nonconformity management, internal audit, surveillance audit, or security certification preparation."
+tags: ["security","legal"]
+tools: []
+license: MIT
+source: https://github.com/alirezarezvani/claude-skills
+source_path: "ra-qm-team/skills/isms-audit-expert"
+source_commit: 19392f7a08264ed00486a251f5b2098321771f94
+---
+# ISMS Audit Expert
+
+Internal and external ISMS audit management for ISO 27001 compliance verification, security control assessment, and certification support.
+
+## Table of Contents
+
+- [Audit Program Management](#audit-program-management)
+- [Audit Execution](#audit-execution)
+- [Control Assessment](#control-assessment)
+- [Finding Management](#finding-management)
+- [Certification Support](#certification-support)
+- [Tools](#tools)
+- [References](#references)
+
+---
+
+## Audit Program Management
+
+### Risk-Based Audit Schedule
+
+| Risk Level | Audit Frequency | Examples |
+|------------|-----------------|----------|
+| Critical | Quarterly | Privileged access, vulnerability management, logging |
+| High | Semi-annual | Access control, incident response, encryption |
+| Medium | Annual | Policies, awareness training, physical security |
+| Low | Annual | Documentation, asset inventory |
+
+### Annual Audit Planning Workflow
+
+1. Review previous audit findings and risk assessment results
+2. Identify high-risk controls and recent security incidents
+3. Determine audit scope based on ISMS boundaries
+4. Assign auditors ensuring independence from audited areas
+5. Create audit schedule with resource allocation
+6. Obtain management approval for audit plan
+7. **Validation:** Audit plan covers all Annex A controls within certification cycle
+
+### Auditor Competency Requirements
+
+- ISO 27001 Lead Auditor certification (preferred)
+- No operational responsibility for audited processes
+- Understanding of technical security controls
+- Knowledge of applicable regulations (GDPR, HIPAA)
+
+---
+
+## Audit Execution
+
+### Pre-Audit Preparation
+
+1. Review ISMS documentation (policies, SoA, risk assessment)
+2. Analyze previous audit reports and open findings
+3. Prepare audit plan with interview schedule
+4. Notify auditees of audit scope and timing
+5. Prepare checklists for controls in scope
+6. **Validation:** All documentation received and reviewed before opening meeting
+
+### Audit Conduct Steps
+
+1. **Opening Meeting**
+   - Confirm audit scope and objectives
+   - Introduce audit team and methodology
+   - Agree on communication channels and logistics
+
+2. **Evidence Collection**
+   - Interview control owners and operators
+   - Review documentation and records
+   - Observe processes in operation
+   - Inspect technical configurations
+
+3. **Control Verification**
+   - Test control design (does it address the risk?)
+   - Test control operation (is it working as intended?)
+   - Sample transactions and records
+   - Document all evidence collected
+
+4. **Closing Meeting**
+   - Present preliminary findings
+   - Clarify any factual inaccuracies
+   - Agree on finding classification
+   - Confirm corrective action timelines
+
+5. **Validation:** All controls in scope assessed with documented evidence
+
+---
+
+## Control Assessment
+
+### Control Testing Approach
+
+1. Identify control objective from ISO 27002
+2. Determine testing method (inquiry, observation, inspection, re-performance)
+3. Define sample size based on population and risk
+4. Execute test and document results
+5. Evaluate control effectiveness
+6. **Validation:** Evidence supports conclusion about control status
+
+For detailed technical verification procedures by Annex A control, see [security-control-testing.md](references/security-control-testing.md).
+
+---
+
+## Finding Management
+
+### Finding Classification
+
+| Severity | Definition | Response Time |
+|----------|------------|---------------|
+| Major Nonconformity | Control failure creating significant risk | 30 days |
+| Minor Nonconformity | Isolated deviation with limited impact | 90 days |
+| Observation | Improvement opportunity | Next audit cycle |
+
+### Finding Documentation Template
+
+```
+Finding ID: ISMS-[YEAR]-[NUMBER]
+Control Reference: A.X.X - [Control Name]
+Severity: [Major/Minor/Observation]
+
+Evidence:
+- [Specific evidence observed]
+- [Records reviewed]
+- [Interview statements]
+
+Risk Impact:
+- [Potential consequences if not addressed]
+
+Root Cause:
+- [Why the nonconformity occurred]
+
+Recommendation:
+- [Specific corrective action steps]
+```
+
+### Corrective Action Workflow
+
+1. Auditee acknowledges finding and severity
+2. Root cause analysis completed within 10 days
+3. Corrective action plan submitted with target dates
+4. Actions implemented by responsible parties
+5. Auditor verifies effectiveness of corrections
+6. Finding closed with evidence of resolution
+7. **Validation:** Root cause addressed, recurrence prevented
+
+---
+
+## Certification Support
+
+### Stage 1 Audit Preparation
+
+Ensure documentation is complete:
+- [ ] ISMS scope statement
+- [ ] Information security policy (management signed)
+- [ ] Statement of Applicability
+- [ ] Risk assessment methodology and results
+- [ ] Risk treatment plan
+- [ ] Internal audit results (past 12 months)
+- [ ] Management review minutes
+
+### Stage 2 Audit Preparation
+
+Verify operational readiness:
+- [ ] All Stage 1 findings addressed
+- [ ] ISMS operational for minimum 3 months
+- [ ] Evidence of control implementation
+- [ ] Security awareness training records
+- [ ] Incident response evidence (if applicable)
+- [ ] Access review documentation
+
+### Surveillance Audit Cycle
+
+| Period | Focus |
+|--------|-------|
+| Year 1, Q2 | High-risk controls, Stage 2 findings follow-up |
+| Year 1, Q4 | Continual improvement, control sample |
+| Year 2, Q2 | Full surveillance |
+| Year 2, Q4 | Re-certification preparation |
+
+**Validation:** No major nonconformities at surveillance audits.
+
+---
+
+## Tools
+
+### scripts/
+
+| Script | Purpose | Usage |
+|--------|---------|-------|
+| `isms_audit_scheduler.py` | Generate risk-based audit plans | `python scripts/isms_audit_scheduler.py --year 2025 --format markdown` |
+
+### Audit Planning Example
+
+```bash
+# Generate annual audit plan
+python scripts/isms_audit_scheduler.py --year 2025 --output audit_plan.json
+
+# With custom control risk ratings
+python scripts/isms_audit_scheduler.py --controls controls.csv --format markdown
+```
+
+---
+
+## References
+
+| File | Content |
+|------|---------|
+| [iso27001-audit-methodology.md](references/iso27001-audit-methodology.md) | Audit program structure, pre-audit phase, certification support |
+| [security-control-testing.md](references/security-control-testing.md) | Technical verification procedures for ISO 27002 controls |
+| [cloud-security-audit.md](references/cloud-security-audit.md) | Cloud provider assessment, configuration security, IAM review |
+
+---
+
+## Audit Performance Metrics
+
+| KPI | Target | Measurement |
+|-----|--------|-------------|
+| Audit plan completion | 100% | Audits completed vs. planned |
+| Finding closure rate | >90% within SLA | Closed on time vs. total |
+| Major nonconformities | 0 at certification | Count per certification cycle |
+| Audit effectiveness | Incidents prevented | Security improvements implemented |

package/org-skills/isms-audit-expert/references/cloud-security-audit.md

@@ -0,0 +1,226 @@
+# Cloud Security Audit Guide
+
+Assessment framework for cloud service security verification.
+
+---
+
+## Table of Contents
+
+- [Shared Responsibility Model](#shared-responsibility-model)
+- [Cloud Provider Assessment](#cloud-provider-assessment)
+- [Configuration Security](#configuration-security)
+- [Data Protection](#data-protection)
+- [Identity and Access Management](#identity-and-access-management)
+
+---
+
+## Shared Responsibility Model
+
+### Responsibility Matrix
+
+| Layer | IaaS | PaaS | SaaS |
+|-------|------|------|------|
+| Data classification | Customer | Customer | Customer |
+| Identity management | Customer | Customer | Shared |
+| Application security | Customer | Shared | Provider |
+| Network controls | Shared | Provider | Provider |
+| Host infrastructure | Provider | Provider | Provider |
+| Physical security | Provider | Provider | Provider |
+
+### Audit Focus by Model
+
+**IaaS (AWS EC2, Azure VMs):**
+- Virtual network configuration
+- OS hardening and patching
+- Application deployment security
+- Data encryption implementation
+
+**PaaS (Azure App Service, AWS Lambda):**
+- Application code security
+- Data handling and encryption
+- Identity integration
+- Logging configuration
+
+**SaaS (Microsoft 365, Salesforce):**
+- User access management
+- Data classification and handling
+- Security configuration settings
+- Integration security
+
+---
+
+## Cloud Provider Assessment
+
+### Certification Verification
+
+Check for current certifications:
+- [ ] ISO 27001 (Information Security)
+- [ ] ISO 27017 (Cloud Security)
+- [ ] ISO 27018 (Cloud Privacy)
+- [ ] SOC 2 Type II
+- [ ] CSA STAR certification
+
+**Verification Steps:**
+1. Request current certificates from provider
+2. Verify certificate scope includes services used
+3. Check certification expiration dates
+4. Review SOC 2 report for relevant controls
+5. Document any scope exclusions
+
+### Data Residency Compliance
+
+| Requirement | Verification |
+|-------------|--------------|
+| GDPR (EU data) | Confirm EU region availability |
+| Data sovereignty | Verify no cross-border transfer |
+| Backup location | Confirm backup region |
+| Disaster recovery | Document DR site location |
+
+### Provider Security Documentation
+
+Request and review:
+- Shared responsibility documentation
+- Security whitepapers
+- Incident notification procedures
+- SLA for security incidents
+- Vulnerability disclosure policy
+
+---
+
+## Configuration Security
+
+### AWS Security Assessment
+
+**Identity and Access (IAM):**
+- [ ] Root account has MFA enabled
+- [ ] No access keys for root account
+- [ ] IAM policies follow least privilege
+- [ ] No wildcard (*) permissions on sensitive resources
+- [ ] Password policy meets requirements
+
+**Network Configuration (VPC):**
+- [ ] Default VPCs removed or secured
+- [ ] Security groups follow least privilege
+- [ ] No 0.0.0.0/0 ingress on management ports
+- [ ] VPC flow logs enabled
+- [ ] Network ACLs configured appropriately
+
+**Storage (S3):**
+- [ ] No public buckets (unless intended)
+- [ ] Bucket policies restrict access
+- [ ] Encryption at rest enabled
+- [ ] Versioning enabled for critical data
+- [ ] Access logging enabled
+
+**Logging (CloudTrail):**
+- [ ] CloudTrail enabled in all regions
+- [ ] Log file validation enabled
+- [ ] Logs encrypted with KMS
+- [ ] S3 bucket for logs is secured
+- [ ] CloudWatch alarms configured
+
+### Azure Security Assessment
+
+**Identity (Azure AD):**
+- [ ] MFA enabled for all users
+- [ ] Privileged Identity Management (PIM) configured
+- [ ] Conditional Access policies defined
+- [ ] Guest access restricted
+- [ ] Password protection enabled
+
+**Network (Virtual Networks):**
+- [ ] NSG rules follow least privilege
+- [ ] No open management ports to internet
+- [ ] Network Watcher enabled
+- [ ] DDoS protection configured
+- [ ] Private endpoints for PaaS services
+
+**Storage:**
+- [ ] No anonymous access to blob storage
+- [ ] Encryption at rest enabled
+- [ ] Shared access signatures time-limited
+- [ ] Storage analytics logging enabled
+- [ ] Soft delete enabled
+
+**Monitoring:**
+- [ ] Azure Monitor enabled
+- [ ] Activity log exported to SIEM
+- [ ] Alerts configured for security events
+- [ ] Azure Security Center enabled
+- [ ] Diagnostic settings configured
+
+---
+
+## Data Protection
+
+### Encryption Verification
+
+**At Rest:**
+| Service | Encryption Check |
+|---------|------------------|
+| Block storage | Verify CMK or provider-managed key |
+| Object storage | Check default encryption settings |
+| Databases | Confirm TDE or column encryption |
+| Backups | Verify backup encryption |
+
+**In Transit:**
+| Connection | Requirement |
+|------------|-------------|
+| User to application | TLS 1.2+ required |
+| Service to service | Internal TLS or VPN |
+| API communications | HTTPS only, no HTTP |
+| Database connections | TLS required |
+
+### Key Management Assessment
+
+- [ ] Customer-managed keys used for sensitive data
+- [ ] Key rotation policy defined and implemented
+- [ ] Key access restricted to authorized services
+- [ ] Key usage logged and monitored
+- [ ] Disaster recovery for keys documented
+
+### Data Classification in Cloud
+
+| Classification | Cloud Requirements |
+|----------------|-------------------|
+| Confidential | CMK encryption, access logging, no public access |
+| Internal | Encryption enabled, network restrictions |
+| Public | Integrity protection, CDN appropriate |
+
+---
+
+## Identity and Access Management
+
+### Privileged Access Review
+
+1. Identify all administrative roles
+2. Verify role assignment justification
+3. Check for standing vs. just-in-time access
+4. Review privileged activity logs
+5. Confirm MFA required for elevation
+
+### Service Account Assessment
+
+| Check | Verification |
+|-------|--------------|
+| Inventory | All service accounts documented |
+| Permissions | Least privilege applied |
+| Credentials | Keys rotated per policy |
+| Monitoring | Activity logged and reviewed |
+| Ownership | Clear owner assigned |
+
+### Federation and SSO
+
+- [ ] SSO configured for cloud console access
+- [ ] Conditional Access/MFA policies applied
+- [ ] Session timeout configured
+- [ ] Failed login monitoring enabled
+- [ ] Emergency access accounts documented
+
+### API Security
+
+- [ ] API keys not embedded in code
+- [ ] Secrets management service used
+- [ ] API access logged
+- [ ] Rate limiting configured
+- [ ] API permissions follow least privilege

package/org-skills/isms-audit-expert/references/iso27001-audit-methodology.md

@@ -0,0 +1,260 @@
+# ISO 27001 ISMS Audit Methodology
+
+Complete audit framework and procedures for Information Security Management System assessments.
+
+---
+
+## Table of Contents
+
+- [Audit Program Structure](#audit-program-structure)
+- [Pre-Audit Phase](#pre-audit-phase)
+- [Audit Execution](#audit-execution)
+- [Finding Classification](#finding-classification)
+- [Certification Audit Support](#certification-audit-support)
+
+---
+
+## Audit Program Structure
+
+### Annual Audit Schedule
+
+| Quarter | Focus Area | Audit Type |
+|---------|------------|------------|
+| Q1 | Access Control, Cryptography | Internal |
+| Q2 | Operations Security, Communications | Internal |
+| Q3 | System Acquisition, Supplier Relations | Internal |
+| Q4 | Full ISMS Review | Pre-certification |
+
+### Risk-Based Scheduling
+
+Prioritize audit frequency based on:
+- Asset criticality and data classification
+- Previous finding history
+- Regulatory requirements
+- Recent security incidents
+- Organizational changes
+
+**High Risk Areas (Quarterly):**
+- Access management systems
+- Cryptographic key management
+- Incident response processes
+- Third-party access controls
+
+**Medium Risk Areas (Semi-Annual):**
+- Change management
+- Backup and recovery
+- Physical security
+- Security awareness training
+
+**Lower Risk Areas (Annual):**
+- Documentation management
+- Asset inventory
+- Business continuity planning
+
+---
+
+## Pre-Audit Phase
+
+### Documentation Review Checklist
+
+- [ ] ISMS scope statement and boundaries
+- [ ] Information security policy (signed, current)
+- [ ] Statement of Applicability (SoA)
+- [ ] Risk assessment methodology and results
+- [ ] Risk treatment plan
+- [ ] Security objectives and metrics
+- [ ] Previous audit reports and corrective actions
+
+### Audit Plan Template
+
+```
+ISMS Audit Plan
+
+Audit ID: ISMS-[YEAR]-[NUMBER]
+Scope: [ISMS scope or specific controls]
+Date: [Start] to [End]
+Lead Auditor: [Name]
+Audit Team: [Names]
+
+Day 1:
+  09:00 - Opening meeting
+  10:00 - Document review (policies, SoA)
+  14:00 - Interview: Information Security Manager
+
+Day 2:
+  09:00 - Technical control verification
+  14:00 - Process observation
+
+Day 3:
+  09:00 - Remaining interviews
+  14:00 - Finding consolidation
+  16:00 - Closing meeting
+```
+
+### Auditor Independence
+
+Verify before audit assignment:
+- No operational responsibility for audited area
+- No recent (12 months) involvement in audited processes
+- No conflict of interest with auditees
+- Required competencies documented
+
+---
+
+## Audit Execution
+
+### Evidence Collection Methods
+
+| Method | Use Case | Evidence Type |
+|--------|----------|---------------|
+| Document review | Policy verification | Screenshots, copies |
+| Interviews | Process understanding | Notes, recordings |
+| Observation | Operational checks | Photos, timestamps |
+| Technical testing | Control effectiveness | System logs, reports |
+
+### Interview Protocol
+
+1. Introduce audit purpose and confidentiality
+2. Explain interview will be documented
+3. Ask open-ended questions about processes
+4. Request evidence to support statements
+5. Clarify any inconsistencies
+6. Summarize key points before closing
+
+### Sample Interview Questions
+
+**For Security Managers:**
+- Describe the risk assessment process
+- How are security incidents reported and managed?
+- What metrics track ISMS effectiveness?
+
+**For System Administrators:**
+- How is privileged access managed?
+- Walk through the change management process
+- Show backup verification records
+
+**For End Users:**
+- What security training have you received?
+- How do you report suspicious activity?
+- Describe the password policy requirements
+
+### Control Testing Procedures
+
+**Access Control (A.9):**
+1. Request user access list for critical system
+2. Verify access rights match job roles
+3. Check for terminated user accounts
+4. Test password policy enforcement
+5. Verify MFA configuration
+
+**Logging (A.12.4):**
+1. Confirm logging enabled on systems in scope
+2. Verify log retention meets policy
+3. Check log protection from tampering
+4. Review sample security event alerts
+
+---
+
+## Finding Classification
+
+### Severity Levels
+
+| Level | Definition | Response Time |
+|-------|------------|---------------|
+| Major Nonconformity | Failure of control, significant risk | 30 days corrective action |
+| Minor Nonconformity | Isolated deviation, limited impact | 90 days corrective action |
+| Observation | Improvement opportunity | Next audit cycle |
+| Good Practice | Exceeds requirements | Document and share |
+
+### Finding Documentation
+
+```
+Finding ID: ISMS-2025-001
+Control Reference: A.9.2.3 - Management of privileged access
+Severity: Major Nonconformity
+
+Evidence:
+- 15 shared admin accounts identified
+- No approval records for privileged access
+- Last access review: 18 months ago
+
+Risk Impact:
+- Unauthorized access to critical systems
+- No accountability for admin actions
+- Regulatory non-compliance
+
+Root Cause:
+- No defined process for privileged access management
+- Insufficient tooling for access tracking
+
+Recommendation:
+- Implement PAM solution within 30 days
+- Document and enforce privileged access process
+- Conduct immediate access review
+```
+
+### Corrective Action Tracking
+
+| Field | Content |
+|-------|---------|
+| Finding ID | Link to original finding |
+| Root Cause | Why the nonconformity occurred |
+| Corrective Action | Specific steps to address |
+| Responsible Person | Named accountable party |
+| Target Date | Completion deadline |
+| Verification Method | How closure will be confirmed |
+| Status | Open / In Progress / Closed |
+
+---
+
+## Certification Audit Support
+
+### Stage 1 Audit Preparation
+
+Ensure availability of:
+- [ ] ISMS documentation (scope, policy, SoA)
+- [ ] Risk assessment records
+- [ ] Internal audit results from past 12 months
+- [ ] Management review minutes
+- [ ] Corrective action evidence
+
+### Stage 2 Audit Preparation
+
+- [ ] All Stage 1 findings addressed
+- [ ] ISMS operational for minimum 3 months
+- [ ] Evidence of control effectiveness
+- [ ] Training and awareness records
+- [ ] Incident response records (if any)
+
+### Surveillance Audit Cycle
+
+| Year | Quarter | Focus |
+|------|---------|-------|
+| Year 1 | Q2 | High-risk controls, Stage 2 findings |
+| Year 1 | Q4 | Remaining controls sample |
+| Year 2 | Q2 | Full surveillance |
+| Year 2 | Q4 | Continual improvement evidence |
+| Year 3 | Q2 | Re-certification preparation |
+
+### Audit Findings Response Template
+
+```
+Subject: Response to Finding ISMS-2025-001
+
+Finding: Major Nonconformity - Privileged Access Management
+
+Root Cause Analysis:
+[5 Whys or fishbone analysis results]
+
+Corrective Action Plan:
+1. [Action] - [Owner] - [Date]
+2. [Action] - [Owner] - [Date]
+
+Evidence of Correction:
+- [Document/screenshot reference]
+
+Preventive Measures:
+- [Steps to prevent recurrence]
+
+Verification Request: [Date auditor can verify]
+```