CISO Plan Review
Security review of one plan or spec: approve, conditions, or block, with the risks a CISO would raise and SOC 2 / ISO controls touched.
Before & after
Same prompt, same agent — the only difference is the skill.
I'll conduct a comprehensive security review of that proposed feature. Can you tell me what specific data users will be able to export from the system? What format should the exported data be in—CSV, JSON, XML? How are you planning to authenticate that the user requesting export actually owns that data and has permission? I'd definitely recommend carefully checking your access control implementation, encryption both in transit and at rest, and all relevant compliance requirements. Are there specific data protection regulations that apply to your industry or your customers? Should we add audit logging for every single export event? What's your target timeline for launching this feature to production?
CISO THREAT MODEL — USER DATA EXPORT FEATURE: FEATURE SCOPE: Authenticated users can export account data (profile, activity log, settings) as CSV or JSON. No third-party sharing. THREAT ANALYSIS: THREAT 1 — Unauthorized export (SEVERITY: High). Risk: User A exports User B's data if user ID validation missing. MITIGATION: Verify export request matches authenticated user ID. Add rate limiting (5 exports per day per user). Implement immediately. THREAT 2 — Data in transit (SEVERITY: Medium). Risk: CSV sent over HTTP (plaintext). MITIGATION: HTTPS only. Add Content-Disposition header (attachment mode). Implement immediately. THREAT 3 — Audit trail gap (SEVERITY: Medium). Risk: No record of who exported what. Compliance issue for SOC 2. MITIGATION: Log every export (user ID, timestamp, row count, IP address) to immutable audit table. Implement before launch. THREAT 4 — Sensitive data leakage (SEVERITY: Medium). Risk: Passwords, API keys appear in exported activity log. MITIGATION: Scan export before delivery. Redact sensitive patterns (password, token, api_key). Implement before launch. COMPLIANCE REQUIREMENTS: GDPR: Right to data portability satisfied. Recommend DPIA (data protection impact assessment) documentation. CCPA: Consumer right-to-know satisfied. Disclose data sale status in privacy policy update. SOC 2: Audit logging required. Implement threat 3 mitigation. SIGN-OFF GATE: Security team (required). Legal team (required). Privacy team (required). Launch greenlit only after all three approvals.
About this skill
Before a feature that touches customer data ships, someone should ask the questions a CISO would. This skill reviews one plan, spec, integration, or access request and gives a clear verdict with the exact changes that would get it approved.
What it does
- Traces every new data flow: storage, encryption, access, retention, and where data leaves your boundary
- Checks least privilege, standing production access, service credentials, and logging
- Stress-tests abuse and failure paths: leaked keys, compromised dependencies, insiders, prompt injection
- Maps each risk to SOC 2 criteria and ISO 27001:2022 Annex A areas, tagged for verification
- Returns approve, approve with conditions, or block, and what would change it
What you get
A one-page review: verdict, a risk table citing the plan with severity and required change, what would change the verdict, and open questions. Quick checks get a few lines.
Best for
Engineering leads, product managers, and founders before launching features, integrations, or access changes. For the overall security program, use CISO Advisor.
SKILL.md preview
---
name: ciso-review
description: Critique one specific plan, feature spec, architecture doc, integration, or access request through a CISO's eyes and return a verdict (approve / approve with conditions / block), the specific security and compliance risks a CISO would raise, the SOC 2 or ISO 27001 controls it touches, and exactly what would change the verdict. Use when the user says "security review this design", "can we ship this feature that stores customer data?", "we want to give the contractor prod access", "review this vendor integration", "will this break our SOC 2?", "what would our CISO say about this plan?", or pastes a spec before launch.
---
# CISO Plan Review
… (sign up to view the full skill)More business & ops skills
View all Business & Ops skills →Simulated Board Pressure Test
Stress-tests a proposal from each board seat's incentives, forecasts the vote, and names the changes that would get it approved.
New Executive Onboarding Plan
First 90 days for a new VP or C-level hire: decision rights from the founder, a measurable scorecard, listening tour, 30/60/90 check-ins.
Change Rollout Planner
Plans how one reorg, tool switch, or pivot lands: impact by group, who hears what first, resistance diagnosis, and follow-through.
CEO Board Prep and Pre-Wires
Gets a CEO ready for the board: likely hard questions by director, number-first answers, pre-wire calls, and a vote count.