skilldrop-cli 0.16.3__py3-none-any.whl

skilldrop_cli/data/packs/grc/skills/risk-register/reference.md

@@ -0,0 +1,99 @@
+# risk-register reference
+
+## The default 5×5 scale
+
+Likelihood is judged over a stated horizon (default 12 months). Impact is judged against the
+objective in scope, not against the company in general.
+
+| Score | Likelihood | Rough probability | Impact | What it looks like |
+|---|---|---|---|---|
+| 1 | Rare | under 5% | Minimal | Absorbed in normal operations; nobody outside the team notices |
+| 2 | Unlikely | 5–20% | Minor | Small cost or delay inside existing tolerance; no external notice |
+| 3 | Possible | 20–50% | Moderate | A milestone or budget line is missed; management attention needed |
+| 4 | Likely | 50–80% | Major | An objective is missed; customers, partners or a regulator notice |
+| 5 | Almost certain | over 80% | Severe | The objective fails, serious legal or regulatory action, or harm to people |
+
+Add the organisation's own thresholds to the impact column when it has them, for example
+"Major: £250k to £1m, or one to three months' delay". Use the organisation's scale whenever
+it exists; a register that uses a different scale from the risk committee gets rescored.
+
+**Bands** (score = likelihood × impact): low 1–4, medium 5–9, high 10–16, critical 20–25.
+The script bands other scales by share of the maximum score: up to 16% low, up to 36%
+medium, up to 64% high, above that critical. On 5×5 that gives exactly the bands above.
+
+A common use of the bands, to adapt to the organisation's appetite:
+
+| Band | Who can accept the residual risk | Review at least |
+|---|---|---|
+| critical | Executive or board | monthly |
+| high | Senior leader above the owner | quarterly |
+| medium | Risk owner | six-monthly |
+| low | Risk owner | yearly |
+
+## Writing cause, event, consequence
+
+| Part | Question it answers | ✅ | ❌ |
+|---|---|---|---|
+| Cause | What condition exists today? | "One analyst maintains the route scripts" | "Key person" |
+| Event | What uncertain thing might happen? | "The analyst leaves or is off long-term" | "Resource issues" |
+| Consequence | What happens to the objective? | "Routes are planned by hand and fuel use rises" | "Bad" |
+
+Tests:
+- If the "risk" is already happening, it is an **issue**, not a risk. Track it as an issue
+  with an action, and keep the risk only if it could get worse.
+- If you can't say how likely it is, the event is too vague. Rewrite it.
+- If two causes lead to one event, keep one row and list both causes. If one cause leads to
+  two unrelated events, write two rows.
+
+## Inherent and residual
+
+- **Inherent:** the score if none of the risk's controls existed. Use it to see which
+  controls matter most; a big drop from inherent to residual means a control the business
+  depends on, and that control deserves testing.
+- **Residual:** the score with the controls that operate today. Controls that are planned,
+  budgeted or half-built go in `controls` marked "(planned)" and do not lower residual yet.
+- **Target** (optional, in the summary): where residual should land once planned controls are live.
+
+## Treatments
+
+| Treatment | Use when | Record |
+|---|---|---|
+| avoid | The activity isn't worth the risk | What stops, and by when |
+| reduce | Controls can bring likelihood or impact down at a sensible cost | Each control, owner, due date |
+| transfer | Someone else can carry the consequence: insurance, contract, outsourcing | The policy or clause; note the residual you still hold |
+| accept | Treatment costs more than the exposure, and the residual is within appetite | Who accepted, when, and until what date |
+
+Accepting a high or critical residual risk is a decision above the owner's level; put it in
+the summary's decision list.
+
+## Review triggers
+
+Name an observable event, not a calendar entry:
+
+- ✅ "Vendor misses an SLA two months running or announces a sale"
+- ✅ "Diesel index up 10% in a month"
+- ✅ "Any EDR detection on a depot device"
+- ❌ "Quarterly review"
+- ❌ "If things change"
+
+The calendar date goes in `next_review`; the trigger is what brings the review forward.
+
+## CSV columns
+
+| Column | Required | Values |
+|---|---|---|
+| id | yes | unique, e.g. R-001 |
+| title | yes | short noun phrase |
+| cause, event, consequence | yes | one sentence each |
+| owner | yes | a named person or a role a person holds; not "TBD", "IT", "team" |
+| inherent_likelihood, inherent_impact | yes | whole numbers 1..scale |
+| residual_likelihood, residual_impact | yes | whole numbers 1..scale; residual score ≤ inherent score |
+| treatment | yes | avoid, reduce, transfer, accept |
+| controls | no (warned under reduce) | semicolon-separated |
+| due_date | no (warned under avoid, reduce, transfer) | YYYY-MM-DD |
+| next_review | yes | YYYY-MM-DD |
+| review_trigger | no (warned) | the event that reopens the risk |
+| status | yes | open, closed |
+
+Extra columns (category, objective, last_updated, target score) are allowed; the script
+ignores them.

skilldrop_cli/data/packs/grc/skills/risk-register/scripts/check_register.py

@@ -0,0 +1,338 @@
+#!/usr/bin/env python3
+"""Validate a risk-register CSV and print heat-map counts.
+
+Stdlib only, Python 3.9+. Reads the CSV from a path argument (or "-" for stdin),
+checks every row, and prints a plain-text report: errors, warnings, inherent and
+residual heat maps, overdue reviews and actions, and the top risks by residual score.
+
+Exit codes:
+  0  the register is valid (warnings may still be printed)
+  1  the register has errors (missing fields, scores out of range, bad dates, ...)
+  2  the input could not be read at all (missing file, no header, bad arguments)
+
+Usage:
+  python3 check_register.py register.csv
+  python3 check_register.py register.csv --scale 5 --as-of 2026-10-01 --top 5 --out report.txt
+  cat register.csv | python3 check_register.py -
+"""
+
+import argparse
+import csv
+import datetime
+import io
+import sys
+
+REQUIRED_COLUMNS = [
+    "id",
+    "title",
+    "cause",
+    "event",
+    "consequence",
+    "owner",
+    "inherent_likelihood",
+    "inherent_impact",
+    "residual_likelihood",
+    "residual_impact",
+    "treatment",
+    "controls",
+    "due_date",
+    "next_review",
+    "review_trigger",
+    "status",
+]
+
+# Columns that may be blank on a row without making it an error.
+OPTIONAL_VALUE_COLUMNS = {"controls", "due_date", "review_trigger"}
+
+SCORE_COLUMNS = [
+    "inherent_likelihood",
+    "inherent_impact",
+    "residual_likelihood",
+    "residual_impact",
+]
+
+TREATMENTS = {"avoid", "reduce", "transfer", "accept"}
+STATUSES = {"open", "closed"}
+GENERIC_OWNERS = {"tbd", "tbc", "team", "all", "everyone", "n/a", "na", "none", "it", "?"}
+
+BANDS = ["low", "medium", "high", "critical"]
+
+
+def band_for(score, scale):
+    """Band a likelihood x impact score by its share of the maximum score.
+
+    On a 5x5 scale this gives low 1-4, medium 5-9, high 10-16, critical 20-25.
+    """
+    ratio = float(score) / float(scale * scale)
+    if ratio <= 0.16:
+        return "low"
+    if ratio <= 0.36:
+        return "medium"
+    if ratio <= 0.64:
+        return "high"
+    return "critical"
+
+
+def band_ranges(scale):
+    ranges = {}
+    products = sorted(set(a * b for a in range(1, scale + 1) for b in range(1, scale + 1)))
+    for s in products:
+        b = band_for(s, scale)
+        lo, hi = ranges.get(b, (s, s))
+        ranges[b] = (min(lo, s), max(hi, s))
+    return ranges
+
+
+def parse_date(text):
+    try:
+        return datetime.datetime.strptime(text, "%Y-%m-%d").date()
+    except ValueError:
+        return None
+
+
+def heat_map(rows, lik_col, imp_col, scale):
+    grid = {}
+    for r in rows:
+        key = (r[lik_col], r[imp_col])
+        grid[key] = grid.get(key, 0) + 1
+    lines = []
+    header = "  L\\I |" + "".join(" {:>3}".format(i) for i in range(1, scale + 1))
+    lines.append(header)
+    lines.append("  " + "-" * (len(header) - 2))
+    for lik in range(scale, 0, -1):
+        cells = []
+        for imp in range(1, scale + 1):
+            n = grid.get((lik, imp), 0)
+            cells.append(" {:>3}".format(n if n else "."))
+        lines.append("  {:>3} |".format(lik) + "".join(cells))
+    return lines
+
+
+def band_counts(rows, lik_col, imp_col, scale):
+    counts = dict((b, 0) for b in BANDS)
+    for r in rows:
+        counts[band_for(r[lik_col] * r[imp_col], scale)] += 1
+    return counts
+
+
+def bullets(items):
+    if not items:
+        return ["  none"]
+    return ["  - " + i for i in items]
+
+
+def main(argv=None):
+    ap = argparse.ArgumentParser(description="Validate a risk-register CSV and print heat-map counts.")
+    ap.add_argument("csv", help="path to the register CSV, or - for stdin")
+    ap.add_argument("--scale", type=int, default=5, help="likelihood and impact scale, 1..N (default 5)")
+    ap.add_argument("--as-of", dest="as_of", default=None, help="date to judge overdue items against, YYYY-MM-DD (default today)")
+    ap.add_argument("--top", type=int, default=5, help="how many top residual risks to list (default 5)")
+    ap.add_argument("--out", default=None, help="also write the report to this path")
+    args = ap.parse_args(argv)
+
+    if args.scale < 3 or args.scale > 10:
+        print("error: --scale must be between 3 and 10", file=sys.stderr)
+        return 2
+    if args.as_of:
+        as_of = parse_date(args.as_of)
+        if as_of is None:
+            print("error: --as-of must be YYYY-MM-DD, got %r" % args.as_of, file=sys.stderr)
+            return 2
+    else:
+        as_of = datetime.date.today()
+
+    try:
+        if args.csv == "-":
+            text = sys.stdin.read()
+        else:
+            with io.open(args.csv, "r", encoding="utf-8-sig", newline="") as fh:
+                text = fh.read()
+    except (IOError, OSError) as exc:
+        print("error: cannot read %s: %s" % (args.csv, exc), file=sys.stderr)
+        return 2
+
+    reader = csv.DictReader(io.StringIO(text))
+    if not reader.fieldnames:
+        print("error: %s has no header row" % args.csv, file=sys.stderr)
+        return 2
+    fieldnames = [f.strip() for f in reader.fieldnames]
+    missing_cols = [c for c in REQUIRED_COLUMNS if c not in fieldnames]
+    if missing_cols:
+        print("error: missing required column(s): %s" % ", ".join(missing_cols), file=sys.stderr)
+        print("expected columns: %s" % ",".join(REQUIRED_COLUMNS), file=sys.stderr)
+        return 2
+
+    errors = []
+    warnings = []
+    overdue = []
+    valid = []
+    seen_ids = {}
+    total_rows = 0
+
+    for line_no, raw in enumerate(reader, start=2):
+        row = dict((k.strip(), (v or "").strip()) for k, v in raw.items() if k is not None)
+        if not any(row.values()):
+            continue
+        total_rows += 1
+        rid = row.get("id") or "(line %d)" % line_no
+        where = "line %d [%s]" % (line_no, rid)
+        row_ok = True
+
+        for col in REQUIRED_COLUMNS:
+            if col in OPTIONAL_VALUE_COLUMNS:
+                continue
+            if not row.get(col):
+                errors.append("%s: %s is empty" % (where, col))
+                row_ok = False
+
+        if row.get("id"):
+            if row["id"] in seen_ids:
+                errors.append("%s: duplicate id, first seen on line %d" % (where, seen_ids[row["id"]]))
+                row_ok = False
+            else:
+                seen_ids[row["id"]] = line_no
+
+        owner = row.get("owner", "")
+        if owner and owner.lower() in GENERIC_OWNERS:
+            errors.append("%s: owner %r is not a named person or role" % (where, owner))
+            row_ok = False
+
+        scores = {}
+        for col in SCORE_COLUMNS:
+            val = row.get(col, "")
+            if not val:
+                continue
+            try:
+                n = int(val)
+            except ValueError:
+                errors.append("%s: %s must be a whole number 1-%d, got %r" % (where, col, args.scale, val))
+                row_ok = False
+                continue
+            if n < 1 or n > args.scale:
+                errors.append("%s: %s=%d is outside the 1-%d scale" % (where, col, n, args.scale))
+                row_ok = False
+                continue
+            scores[col] = n
+
+        treatment = row.get("treatment", "").lower()
+        if treatment and treatment not in TREATMENTS:
+            errors.append("%s: treatment %r is not one of avoid/reduce/transfer/accept" % (where, row["treatment"]))
+            row_ok = False
+
+        status = row.get("status", "").lower()
+        if status and status not in STATUSES:
+            errors.append("%s: status %r is not open or closed" % (where, row["status"]))
+            row_ok = False
+
+        dates = {}
+        for col in ("due_date", "next_review"):
+            val = row.get(col, "")
+            if not val:
+                continue
+            d = parse_date(val)
+            if d is None:
+                errors.append("%s: %s must be YYYY-MM-DD, got %r" % (where, col, val))
+                row_ok = False
+            else:
+                dates[col] = d
+
+        if treatment in ("reduce", "avoid", "transfer") and not row.get("due_date"):
+            warnings.append("%s: treatment is %s but there is no due_date for the action" % (where, treatment))
+        if treatment == "reduce" and not row.get("controls"):
+            warnings.append("%s: treatment is reduce but no controls are listed" % where)
+        if not row.get("review_trigger"):
+            warnings.append("%s: no review_trigger; name the event that should reopen this risk" % where)
+
+        if len(scores) == 4:
+            inh = scores["inherent_likelihood"] * scores["inherent_impact"]
+            res = scores["residual_likelihood"] * scores["residual_impact"]
+            if res > inh:
+                errors.append("%s: residual score %d is higher than inherent score %d" % (where, res, inh))
+                row_ok = False
+            if treatment == "reduce" and res == inh:
+                warnings.append("%s: treatment is reduce but residual equals inherent (%d); the controls change nothing" % (where, res))
+            if treatment == "accept" and band_for(res, args.scale) in ("high", "critical"):
+                warnings.append("%s: accepting a %s residual risk (%d) needs a named sign-off above the owner" % (where, band_for(res, args.scale), res))
+
+        if status == "open":
+            if "next_review" in dates and dates["next_review"] < as_of:
+                days = (as_of - dates["next_review"]).days
+                overdue.append("%s: review overdue by %d day(s) (next_review %s), owner %s" % (where, days, dates["next_review"], owner or "?"))
+            if "due_date" in dates and dates["due_date"] < as_of:
+                days = (as_of - dates["due_date"]).days
+                overdue.append("%s: treatment action overdue by %d day(s) (due_date %s), owner %s" % (where, days, dates["due_date"], owner or "?"))
+
+        if row_ok and len(scores) == 4:
+            entry = dict(row)
+            entry.update(scores)
+            entry["status"] = status
+            valid.append(entry)
+
+    open_rows = [r for r in valid if r["status"] == "open"]
+
+    out = []
+    out.append("Risk register check")
+    out.append("  file:   %s" % args.csv)
+    out.append("  as of:  %s" % as_of.isoformat())
+    out.append("  scale:  1-%d likelihood x 1-%d impact" % (args.scale, args.scale))
+    ranges = band_ranges(args.scale)
+    out.append("  bands:  " + ", ".join("%s %d-%d" % (b, ranges[b][0], ranges[b][1]) for b in BANDS if b in ranges))
+    out.append("  rows:   %d read, %d valid, %d open" % (total_rows, len(valid), len(open_rows)))
+    out.append("")
+
+    out.append("Errors (%d)" % len(errors))
+    out.extend(bullets(errors))
+    out.append("")
+    out.append("Warnings (%d)" % len(warnings))
+    out.extend(bullets(warnings))
+    out.append("")
+    out.append("Overdue (%d)" % len(overdue))
+    out.extend(bullets(overdue))
+    out.append("")
+
+    out.append("Inherent heat map, open risks (rows = likelihood, columns = impact)")
+    out.extend(heat_map(open_rows, "inherent_likelihood", "inherent_impact", args.scale))
+    c = band_counts(open_rows, "inherent_likelihood", "inherent_impact", args.scale)
+    out.append("  " + ", ".join("%s %d" % (b, c[b]) for b in BANDS))
+    out.append("")
+    out.append("Residual heat map, open risks (rows = likelihood, columns = impact)")
+    out.extend(heat_map(open_rows, "residual_likelihood", "residual_impact", args.scale))
+    c = band_counts(open_rows, "residual_likelihood", "residual_impact", args.scale)
+    out.append("  " + ", ".join("%s %d" % (b, c[b]) for b in BANDS))
+    out.append("")
+
+    ranked = sorted(
+        open_rows,
+        key=lambda r: (
+            -(r["residual_likelihood"] * r["residual_impact"]),
+            -(r["inherent_likelihood"] * r["inherent_impact"]),
+            r["id"],
+        ),
+    )
+    out.append("Top %d open risks by residual score" % min(args.top, len(ranked)))
+    if not ranked:
+        out.append("  none")
+    for r in ranked[: args.top]:
+        inh = r["inherent_likelihood"] * r["inherent_impact"]
+        res = r["residual_likelihood"] * r["residual_impact"]
+        out.append(
+            "  %s  residual %d (%s), inherent %d  %s  [%s, owner %s]"
+            % (r["id"], res, band_for(res, args.scale), inh, r["title"], r["treatment"].lower(), r["owner"])
+        )
+    out.append("")
+    out.append("Result: %s" % ("FAIL, fix the errors above" if errors else "PASS"))
+
+    report = "\n".join(out) + "\n"
+    sys.stdout.write(report)
+    if args.out:
+        try:
+            with io.open(args.out, "w", encoding="utf-8") as fh:
+                fh.write(report)
+        except (IOError, OSError) as exc:
+            print("error: cannot write %s: %s" % (args.out, exc), file=sys.stderr)
+            return 2
+    return 1 if errors else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

skilldrop_cli/data/packs/grc/skills/risk-register/templates/risk-register.csv

@@ -0,0 +1,2 @@
+id,title,cause,event,consequence,owner,inherent_likelihood,inherent_impact,residual_likelihood,residual_impact,treatment,controls,due_date,next_review,review_trigger,status
+R-001,<short noun phrase>,<because of ... (the condition that exists today)>,<... may happen (the uncertain event)>,<leading to ... (the effect on objectives)>,<named person or role>,1-5,1-5,1-5,1-5,avoid|reduce|transfer|accept,<existing and planned controls; semicolon-separated>,YYYY-MM-DD,YYYY-MM-DD,<the event that reopens this risk>,open|closed

skilldrop_cli/data/packs/grc/skills/soc2-evidence-map/SKILL.md

@@ -0,0 +1,117 @@
+---
+name: soc2-evidence-map
+description: Map an organisation's controls to the SOC 2 Trust Services Criteria in scope (Security always, plus Availability, Confidentiality, Processing Integrity or Privacy if chosen), and for each control list the evidence an auditor will ask for, the system it lives in, the owner, how often it is produced, and the gaps — distinguishing Type I (designed and in place at a date) from Type II (operating over a period, sampled from a full population) — as a table and a CSV the team can work from. Use when the user is preparing for a SOC 2 audit or readiness assessment, says "SOC 2 evidence", "map our controls to the TSC", "what will the auditor ask for", "SOC 2 gap analysis".
+---
+
+# soc2-evidence-map
+
+You turn a controls list, or a description of how the company runs its systems, into the
+working document a SOC 2 project runs on: each control mapped to the criteria it addresses,
+the exact evidence the auditor will request, where that evidence comes from, who produces
+it, how often, and what is missing. The output is a Markdown summary and a CSV. You prepare
+material for the company's compliance lead and its auditor to review; it is not audit
+advice, and only the service auditor decides what evidence is sufficient.
+
+## How to respond
+
+1. **Ask once for what is missing, in one message.** Take what is already given. Ask for at
+   most two things, and say what you will assume for the rest:
+   - **Scope:** which Trust Services Categories (Security is always in scope), the system
+     or product being reported on, and **Type I or Type II** with the date or period.
+     *Default: Security only, Type II, 12-month period* `[assumption]`.
+   - **Controls and systems:** the controls list if one exists, or the tools they run on
+     (identity provider, cloud, HR system, ticketing, code hosting, monitoring).
+
+   Owners and system names come from the user. A missing owner is a gap to fill, not a
+   name to guess.
+
+2. **Draft controls where none exist.** If the user has no controls list, propose the
+   minimum set for the categories in scope from [`reference.md`](reference.md), each
+   written as *who does what, how often, with what record*:
+   ✅ "Engineering managers review production access quarterly in Okta; removals are
+   ticketed in Jira." ❌ "Access is managed appropriately." Mark proposed controls
+   `proposed` so nobody mistakes them for existing ones.
+
+3. **Map each control to criteria.** Use criteria IDs (for example CC6.2) only where
+   [`reference.md`](reference.md) gives the ID; for anything else, name the area in words
+   ("Privacy: notice to data subjects"). One control usually maps to one to three criteria.
+   Then invert the map: every criterion in scope has at least one control, or it is a gap.
+
+4. **Name the evidence for each control, by report type.**
+   - **Type I** (point in time): show the control is designed and in place on the report
+     date. The policy or procedure, the system configuration (export or screenshot with
+     the date visible), and one example of it happening.
+   - **Type II** (over the period): show it operated throughout. The auditor asks for the
+     **complete population** of occurrences in the period from the system of record (all
+     joiners, all leavers, all production changes, all quarterly reviews) and then picks
+     samples; for each sample you produce the record. Name the population and its source.
+   ✅ "Population: Workday termination report for the period. Per sample: Okta deactivation
+   timestamp within 24 hours of the termination date." ❌ "Evidence: offboarding docs."
+
+5. **Record where it lives, who owns it, and how often.** System is the tool the evidence
+   is exported from, not the team. Owner is a person or a role a person holds. Frequency is
+   how often the control runs (per event, daily, quarterly, annually) because that sets the
+   sample size the auditor draws.
+
+6. **Mark status and gaps honestly.** Each control is `in place`, `partial` (runs but leaves
+   no record, or doesn't cover every system) or `gap` (doesn't exist or doesn't run). For
+   Type II, a control that started mid-period is `partial` for this period. Every non-`in
+   place` row gets a remediation and a date.
+
+7. **Call out shared responsibility.** Controls a subservice organisation runs (the cloud
+   provider's data centre security) are covered by its own SOC report: list the vendor
+   reports to collect and the complementary controls the company must run itself. Note
+   the controls the company expects its customers to run.
+
+8. **Emit both outputs:**
+   - the Markdown summary: scope line, a coverage table (criterion → controls → status),
+     the evidence map table, the gap list ordered by audit risk, and the vendor SOC reports
+     to collect;
+   - the CSV in the columns of [`templates/evidence-map.csv`](templates/evidence-map.csv),
+     one row per control-criterion pair, so the team can filter by owner or by criterion.
+
+**Non-interactive runs** (subagent, CI, headless): missing scope becomes Security only,
+Type II, 12 months, tagged `[assumption]` at the top. If there are no controls and no
+description of the systems to draft from, emit
+`BLOCKED: need the controls list, or the systems the company runs (identity, cloud, HR, ticketing, code hosting)`.
+
+## Useful references in this skill
+
+- [`reference.md`](reference.md): the Trust Services Criteria structure, the criteria IDs this skill uses, baseline controls per area, Type I vs Type II evidence, populations and sampling, and subservice organisations
+- [`templates/evidence-map.csv`](templates/evidence-map.csv): the CSV columns with one annotated row
+- [`examples/northwind-type2-security.md`](examples/northwind-type2-security.md): worked example, a fictional SaaS company preparing for its first Type II
+
+## Quality bar
+
+- **Every criterion in scope has a control or is listed as a gap.** The coverage table shows it.
+- **Every control is written as who, what, how often, with what record.** No adjectives in place of a mechanism.
+- **Evidence is specific to the report type:** Type I names design evidence; Type II names the population, its source system, and the per-sample record.
+- **Criteria IDs appear only where reference.md gives them;** anything else is described in words.
+- **System, owner and frequency are filled for every row,** or the blank is itself a gap.
+- **Status is honest:** a control with no record, or one that started mid-period, is not `in place`.
+- **Proposed controls are marked `proposed`,** never presented as existing.
+
+## When to use this skill
+
+- ✅ Getting ready for a first SOC 2 Type I or Type II audit, or a readiness assessment
+- ✅ Turning a controls spreadsheet into an evidence request list per owner
+- ✅ Moving from Type I to Type II and working out what has to be recorded over the period
+- ✅ Adding a category (Availability, Confidentiality) to an existing SOC 2 scope
+
+## When NOT to use this skill
+
+- ❌ Finding security threats in a system design: use `threat-model`
+- ❌ Scoring business risks for a risk committee: use `risk-register`; SOC 2's risk assessment criteria expect one, and this map can point to it
+- ❌ A GDPR assessment of one processing activity: use `dpia`
+- ❌ Writing the security or reliability targets for a service: use `nfr-spec`
+- ❌ A policy for staff use of AI tools: use `ai-usage-policy`
+
+## Anti-patterns to avoid
+
+- ❌ **Evidence named as a document type.** "Access review docs" tells the owner nothing. Name the export, the system and what each sample must show.
+- ❌ **Type I evidence for a Type II audit.** One screenshot proves the setting existed on one day, not for twelve months.
+- ❌ **Invented criteria numbers.** If you're not sure of the ID, describe the area; a wrong ID in an auditor-facing map costs credibility.
+- ❌ **Owner "Engineering".** A team can't be chased for a missing export; name the role.
+- ❌ **Policies as controls.** "We have an access control policy" is evidence of design, not a control that operates.
+- ❌ **Ignoring the cloud provider.** Physical security and data centre controls are carved out to its SOC report; the map should say so and list the complementary controls.
+- ❌ **Marking a mid-period control `in place`.** For Type II, the auditor tests the whole period; a control that began in month seven is a gap for months one to six.

skilldrop_cli/data/packs/grc/skills/soc2-evidence-map/evals/eval_queries.json

@@ -0,0 +1,34 @@
+[
+  {
+    "query": "Map our controls to the SOC 2 Trust Services Criteria and tell me what evidence the auditor will ask for",
+    "should_trigger": true
+  },
+  {
+    "query": "We're moving from SOC 2 Type I to Type II, what do we need to start recording?",
+    "should_trigger": true
+  },
+  {
+    "query": "Build a SOC 2 gap analysis spreadsheet with owners and systems for each control",
+    "should_trigger": true
+  },
+  {
+    "query": "What evidence do we need for CC6.2 and CC8.1 in our SOC 2 audit?",
+    "should_trigger": true
+  },
+  {
+    "query": "Build a STRIDE threat model for our new data pipeline",
+    "should_trigger": false
+  },
+  {
+    "query": "Create a risk register for the company with a heat map",
+    "should_trigger": false
+  },
+  {
+    "query": "Write the non-functional requirements for availability and security of the billing service",
+    "should_trigger": false
+  },
+  {
+    "query": "Draft a DPIA for our customer analytics feature",
+    "should_trigger": false
+  }
+]

skilldrop_cli/data/packs/grc/skills/soc2-evidence-map/evals/evals.json

@@ -0,0 +1,19 @@
+{
+  "skill_name": "soc2-evidence-map",
+  "evals": [
+    {
+      "id": 1,
+      "prompt": "Acme Payments is going for SOC 2 Type II, Security and Availability, for 1 April to 30 September 2027. Controls today: Google Workspace SSO with MFA, joiners requested in Linear and approved by the hiring manager, leavers removed by IT 'usually the same day' with no ticket, GitHub PR reviews required on main, GCP Cloud SQL backups nightly, an uptime status page, PagerDuty on-call run by Priya Nair (SRE lead). Map our controls to the criteria, list the evidence the auditor will want, and show the gaps as a table and a CSV.",
+      "assertions": [
+        "Every common criterion and every Availability criterion in scope is either mapped to a control or listed as a gap",
+        "Each control is written as who does what, how often, and where it is recorded",
+        "Type II evidence names the full population, the system it is exported from, and what each sampled item must show",
+        "The leaver process with no ticket is marked partial or gap, not in place, because it leaves no per-sample record",
+        "Criteria IDs used are real AICPA TSC IDs (for example CC6.2, A1.2); areas without a confident ID are described in words",
+        "System, owner and frequency are given for every row, and owners not in the prompt are marked to confirm rather than invented",
+        "GCP is treated as a subservice organisation with its SOC report to collect",
+        "A CSV with one row per control-criterion pair is provided alongside the table"
+      ]
+    }
+  ]
+}

skilldrop_cli/data/packs/grc/skills/soc2-evidence-map/examples/northwind-evidence-map.csv

@@ -0,0 +1,17 @@
+control_id,control,criteria,category,type1_evidence,type2_population,type2_sample_record,system,owner,frequency,status,gap,remediation,due_date
+GOV-01,Head of Security has the security policy set approved by the CEO each January; staff acknowledge at hire and annually in BambooHR,CC1.1,Security,Approved policy set with approval date; acknowledgement report,All active staff during the period,Acknowledgement date for each sampled person within 30 days of hire or of the annual cycle,BambooHR,Head of Security (Sam Ito),annually,partial,Policies approved in 2025 but no annual acknowledgement cycle has run,Run acknowledgement cycle before the period starts,2026-12-15
+GOV-01,Head of Security has the security policy set approved by the CEO each January; staff acknowledge at hire and annually in BambooHR,CC5.3,Security,Approved policy set with approval date,All active staff during the period,Acknowledgement date for each sampled person,BambooHR,Head of Security (Sam Ito),annually,partial,As above,As above,2026-12-15
+HR-01,People team runs background checks before each start date and tracks security training completion within 30 days of hire,CC1.4,Security,Background check procedure; training course configuration,All hires in the period from BambooHR,Background check completion date before start; training completion within 30 days,BambooHR; Certn; KnowBe4,People Ops Lead (Ola Brandt),per event,in place,,,
+RISK-01,Head of Security runs an annual risk assessment and the leadership team reviews the register,CC3.2,Security,Risk assessment procedure; current risk register,The annual assessment in the period,Dated register and leadership meeting minutes showing review,Google Drive,Head of Security (Sam Ito),annually,gap,No risk assessment has been done,Run first risk assessment (see risk-register) and minute the review,2027-01-31
+VEN-01,Head of Security assesses critical vendors at onboarding and reviews their SOC reports annually,CC9.2,Security,Vendor management procedure; vendor inventory,All critical vendors and all vendors onboarded in the period,Completed assessment or SOC report review per sampled vendor,Vanta,Head of Security (Sam Ito),annually,partial,Vendor inventory exists; no review records,Collect current SOC 2 reports for AWS and Okta and record reviews,2026-12-31
+AC-01,Engineering managers grant access by Jira ticket with manager approval and role-based Okta groups,CC6.2,Security,Access procedure; Okta group-to-role mapping export; one approved ticket,All Okta accounts created in the period,Approved Jira ticket dated on or before account creation,Okta; Jira,IT Lead (Dev Rao),per event,in place,,,
+AC-01,Engineering managers grant access by Jira ticket with manager approval and role-based Okta groups,CC6.3,Security,Okta group-to-role mapping export,All Okta accounts created in the period,Groups assigned match the role in the ticket,Okta; Jira,IT Lead (Dev Rao),per event,in place,,,
+AC-02,IT removes all access within 24 hours of termination; BambooHR termination triggers Okta deactivation,CC6.2,Security,Offboarding procedure; BambooHR-Okta integration config; one example,All terminations in the period from BambooHR,Okta deactivation timestamp within 24 hours of termination date,BambooHR; Okta,IT Lead (Dev Rao),per event,in place,,,
+AC-03,Engineering managers review AWS and GitHub admin access quarterly and record removals in Jira,CC6.3,Security,Review procedure; one completed review,The quarterly reviews in the period,Signed-off review list and Jira tickets for each removal,Jira; AWS IAM Identity Center; GitHub,VP Engineering (Kim Novak),quarterly,gap,Reviews happen ad hoc with no record,Schedule quarterly review ticket; first review before period start,2026-12-15
+AC-04,IT enforces SSO with MFA for all workforce accounts in Okta,CC6.1,Security,Okta MFA policy export dated on the report date,Okta sign-on policy change log for the period,No policy change disabled MFA; MFA enrolment report at period end,Okta,IT Lead (Dev Rao),continuous,in place,,,
+EP-01,IT manages all laptops in Kandji with disk encryption and malware protection enforced,CC6.8,Security,Kandji blueprint export; device compliance report,Device compliance reports for the period,Sampled devices show encryption and protection active,Kandji,IT Lead (Dev Rao) [to confirm],continuous,partial,Four contractor laptops are not enrolled,Enrol or replace contractor devices,2026-11-30
+VM-01,Platform team scans production weekly with Snyk and fixes critical findings within 14 days and high within 30,CC7.1,Security,Scan configuration; remediation SLA in the vulnerability procedure,All critical and high findings opened in the period,Fix date within SLA or an approved exception,Snyk; Jira,Platform Lead (Rui Costa),weekly,in place,,,
+MON-01,Platform team routes Datadog security alerts to the PagerDuty on-call rotation,CC7.2,Security,Alert routing configuration; on-call schedule,All security alerts in the period,Each sampled alert acknowledged and triaged in PagerDuty,Datadog; PagerDuty,Platform Lead (Rui Costa) [to confirm],continuous,in place,,,
+IR-01,Head of Security maintains an incident response plan tested annually by tabletop; incidents are ticketed with a post-incident review,CC7.4,Security,Approved IR plan; tabletop record,All security incidents in the period and the annual tabletop,Incident ticket with timeline and post-incident review,Jira; Google Drive,Head of Security (Sam Ito),per event,partial,Plan exists; never tested,Run a tabletop exercise in the period,2027-03-31
+CHG-01,Engineers deploy to production only through GitHub pull requests with one approval from someone other than the author and passing CI,CC8.1,Security,Branch protection settings export; one merged pull request,All production deployments in the period from GitHub Actions,Pull request with a non-author approval and green checks,GitHub,VP Engineering (Kim Novak),per event,partial,Two admins can bypass branch protection,Remove bypass rights or log and review each bypass,2026-11-15
+BC-01,Platform team runs automated RDS backups daily and tests a restore every six months,CC7.5,Security,Backup configuration; restore test procedure,The restore tests in the period,Restore test record with date and outcome,AWS RDS; Jira,Platform Lead (Rui Costa) [to confirm],semi-annually,proposed,Backups run; no restore test has been done or recorded,Schedule and record restore tests,2027-01-31