Agent skill · security · borghei
isms-audit-expert
ISMS auditing for ISO 27001 compliance, control assessment, and certification support. Use for ISMS audit programs, internal/external ISO 27001 audits, ISO 27002 Annex A control testing, and Stage 1/Stage 2 certification audits.
Why this skill is useful
Provides specific workflows and templates for ISO 27001 audits that the AI wouldn't reliably generate on its own.
What it needs
About 11k tokens when loaded. Last updated 2026-07-21. 462 stars on the source repository.
What this skill does
ISMS Audit Expert Internal and external ISMS audit management for ISO 27001 compliance verification, security control assessment, and certification support. --- Clarify First Before planning or executing the audit, confirm these inputs. If any is unknown or vague, ASK — do not assume: [ ] Audit type — internal annual, Stage 1, Stage 2, surveillance, or recertification (sets the scope and checklist depth) [ ] Controls in scope — which Annex A controls / SoA coverage for this engagement (drives the schedule and testing) [ ] Risk ratings and prior findings — per-control risk and outstanding nonconformities (picks audit frequency and sample size) Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the audit plan. Audit Program Management Risk-Based Audit Schedule Risk Level Audit Frequency Examples ------------ ----------------- ---------- Critical Quarterly Privileged access, vulnerability management, logging High Semi-annual Access control, incident response, encryption Medium Annual Policies, awareness training, physical security Low Annual Documentation, asset inventory Workflow: Annual Audit Planning 1. Review prior audit results -- analyze previous findings, open items, and risk assessment outputs from the most recent cycle. 2. Identify high-risk controls -- flag controls involved in recent security incidents or with outstanding nonconformities. 3. Determine audit scope -- define ISMS boundaries, confirm Statement of Applicability (SoA) coverage for the certification cycle. 4. Assign auditors -- ensure independence from audited areas; verify auditor competency (ISO 27001 Lead Auditor certification preferred). 5. Create audit schedule -- allocate resources, assign dates, and distribute across the year by risk priority. 6. Obtain management approval for the finalized audit plan. 7. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills borghei/isms-audit-expert