Agent skill · data analytics · alirezarezvani
iso27001-audit-prep
Use for /compliance-os:iso27001-audit-prep, or before an ISO 27001 internal, surveillance or stage 1 audit.
Why this skill is useful
Adds executable scripts for ISO 27001 audit preparation that automate scheduling, readiness checks, and cross-framework mapping.
What it needs
Requires python installed locally. About 3k tokens when loaded. Last updated 2026-08-05. 23,939 stars on the source repository.
What this skill does
/compliance-os:iso27001-audit-prep — ISO 27001 ISMS Audit Forcing Questions Command: /compliance-os:iso27001-audit-prep <scope> The ISO 27001 ISMS auditor pressure-tests any ISMS work. Six sample-driven questions before any internal audit, stage 1 readiness, or surveillance audit. When to Run Before annual Clause 9.2 internal audit Before stage 1 / stage 2 ISO 27001 certification audit Before surveillance audit (year 2 / year 3) After material change to ISMS scope (new business unit, new product line, new SaaS adoption) Post-incident (breach triggers ad-hoc ISMS audit) Quarterly during high-growth phase The Six ISMS Questions 1. What's the audit scope, and is rolling 3-year coverage on track? No 3-year coverage discipline, no defensible programme. Every Clause 4-10 + every applicable Annex A control must be audited at least once per 3-year cycle Run ismsauditscheduler.py in ${CLAUDEPLUGINROOT}/vendor/ra-qm-team/isms-audit-expert/ Confirm auditor independence — no self-audit on any sample 2. When was the risk register last refreshed, and are treatments linked to Annex A controls? Stale risk register = certification finding. Quarterly refresh expected; annual minimum Every high/critical risk must link to ≥ 1 Annex A control treating it Residual risk acceptance documented + signed Review against iso27001auditplaybook.md for stage 1 expectations 3. Show me the access review records — quarterly cadence, the last 4 quarters. Most-cited finding area. Annex A.5.15 + A.8.2 + A.8.3 access controls Sample real records pulled from Okta / IAM, not curated audit-prep packs For each terminated employee in last 90 days: deprovisioning evidence within 24-hour SLA Privileged access reviewed at finer granularity 4. What's the supplier inventory + last review evidence? Second-most-cited finding area. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills alirezarezvani/iso27001-audit-prep--e9a7c1