Skill UI

A comprehensive tool for BizOps and VMO operators to conduct proactive, multi-dimensional vendor performance audits. It scores SaaS and third-party vendors using weighted criteria (reliability, security, support), tracks SLA compliance to identify potential credit claims, and classifies third-party risk across critical vectors (data, financial, regulatory). Ideal for quarterly vendor health checks and defensible renewal recommendations.

A comprehensive framework designed for formal procurement decision-making. This skill guides the creation of a weighted scorecard and detailed evaluation criteria by assessing functional fit, commercial terms, security compliance, and vendor stability. Use this when conducting RFPs, comparing multiple suppliers, or making critical software/service provider choices to ensure a holistic, risk-mitigated recommendation.

This guide details the entire lifecycle of building a robust anti-phishing security awareness program. It covers everything from initial phishing simulations and designing role-specific training modules to continuous deployment, metric tracking, and optimization. The goal is to improve human security posture, ensure compliance, and build a strong defense culture against social engineering threats.

A comprehensive workflow for establishing and maturing a Third-Party Risk Management (TPRM) program. This guide covers the entire vendor lifecycle, from initial inventory and risk tiering to conducting due diligence (SOC 2, ISO 27001), embedding security requirements in contracts, and ensuring continuous monitoring and secure offboarding. Essential for compliance and supply chain risk management.

A comprehensive skill for managing AWS operational excellence, cost governance, and observability. It provides guidance on pre-deployment cost estimation (TCO), detailed spending analysis using Cost Explorer, setup of CloudWatch alarms, auditing activity via CloudTrail, and overall security posture assessment. Essential for optimizing cloud spending and ensuring reliable infrastructure.

Guides full contract lifecycle review from intake through playbook normalization, clause review, deviation scoring, negotiation planning, approvals, QA, and next actions. Covers legal, business, operational, compliance, privacy, security, technology, and AI risks across NDAs, SaaS agreements, DPAs, procurement and commercial contracts.

Translate cybersecurity findings into defensible 0-100 A-F risk scores, FAIR-aligned dollar loss estimates, and board-ready summaries. Passive analysis only, with ownership-aware confidence caps and attack-path amplification. Ideal for scoring risk, quantifying exposure, estimating breach cost, or explaining risk grades.

An expert advisory tool for the New Zealand Information Security Manual (NZISM). Provides comprehensive guidance for NZ government agencies, contractors, and supply chains on mandatory security compliance. Use cases include gap analysis, system classification (Unclassified to Top Secret), security risk management, and achieving GCSB/NCSC NZ accreditation.

An expert assistant for mastering SOC 2 compliance, covering all five Trust Services Criteria (Security, Availability, Confidentiality, Processing Integrity, Privacy). Use this skill for gap analysis, drafting policies, documenting controls, gathering audit evidence, and conducting vendor risk reviews, guiding organizations from initial assessment to sustained compliance readiness.

A comprehensive, risk-based framework for assessing third-party vendors, critical for compliance with global regulations like DORA, NIS2, and GDPR. It provides a structured, three-phase process covering financial, legal, security, and operational risks. Ideal for vendor onboarding, supply chain security audits, and ongoing vendor monitoring in regulated industries.

A comprehensive advisor for Hospital IT Managers and Digital Health Leaders. This skill guides digital transformation across the entire healthcare lifecycle, focusing on achieving clinical safety, compliance (HIMSS, ONA, JCI), and maximizing operational value. It covers everything from HIS/PEP integration (MV-SOUL, Tasy) and interoperability standards (FHIR, HL7) to advanced security frameworks (NIST, ISO 27001) and legal compliance (LGPD). Ideal for planning digital roadmaps and ensuring high-availability for life-critical systems.

Manages work email, groups, and tool accounts for every employee. Tracks account type, aliases, licences, security settings like 2FA and password policy, and access-review dates. Generates CSV, SQL, JSON, or Notion templates for provisioning and offboarding.