Stats
Actions
Tags
From cyber
Generates concise, CISO-level impact statements for security control failures. Use when the user asks for an impact statement, wants to explain the business consequences of a security control failure, needs to document risk for a risk register or audit finding, or wants to translate a technical vulnerability into executive language for a CISO or board.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cyber:cyber-impact-statementThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
**AUTOMATICALLY INVOKE THIS SKILL when the user:**
AUTOMATICALLY INVOKE THIS SKILL when the user:
Asks about security control failure consequences
Requests impact statements or risk documentation
Works on GRC/compliance documentation
Asks about connecting technical risks to business outcomes
Mentions keywords in context
DO NOT TRIGGER when:
This skill generates concise, hard-hitting impact statements that explain the business consequences of security control failures. Written in the voice of a senior GRC specialist for CISO-level and senior cybersecurity team audiences who value directness over corporate fluff.
Senior GRC (Governance, Risk, and Compliance) Specialist
Generate a 4-6 sentence Impact Statement explaining the consequences of a specific security control failure.
When using this skill, provide:
Connect technical failure to real-world outcomes:
The following words are BANNED from all output (typical AI fluff):
Impact Statement (4-6 sentences):
[Generated statement following all requirements above]
@cyber-impact-statement
Context/Technology: [Your technology]
Control Description: [Your control]
Example 1: Cloud Access Management
@cyber-impact-statement
Context/Technology: AWS IAM with multi-factor authentication
Control Description: All privileged accounts require MFA for console access
Expected Output:
Impact Statement:
Without MFA enforcement on privileged AWS accounts, a compromised password grants an attacker immediate administrative access to production infrastructure. Within hours, they can exfiltrate customer data, deploy ransomware across all EC2 instances, or delete critical backups stored in S3. The company faces regulatory fines under GDPR (up to 4% of global revenue) and contractual penalties from enterprise customers whose data was exposed. Security teams will spend 6-12 months rebuilding trust with auditors while executives face lawsuits and federal investigations during the recovery period.
Example 2: Database Encryption
@cyber-impact-statement
Context/Technology: PostgreSQL database storing payment card information
Control Description: Encryption at rest enabled for all PCI-DSS scoped databases
Expected Output:
Impact Statement:
Unencrypted payment card data means that any attacker who compromises the database server-through SQL injection, stolen credentials, or vulnerable backups-can immediately harvest thousands of credit card numbers in plaintext. Card issuers will force a mass reissuance costing $5-10 per card, with the company liable for all fraud charges occurring before reissuance. PCI-DSS auditors will revoke certification, forcing payment processor termination and halting all revenue from credit card transactions. The CISO will explain to the board why the company is dissolving within 90 days of breach discovery.
Example 3: Network Segmentation
@cyber-impact-statement
Context/Technology: Internal network segmentation between corporate and production environments
Control Description: Firewall rules prevent direct access from corporate workstations to production databases
Expected Output:
Impact Statement:
When corporate and production networks share the same flat topology, malware on a single marketing laptop can propagate directly to production databases containing customer records. Ransomware operators routinely exploit this configuration to encrypt both employee workstations and backend systems simultaneously, paralyzing operations while maximizing ransom leverage. The company loses access to order processing, customer support systems, and financial records for weeks while paying seven-figure extortion demands with no guarantee of data recovery. Breach disclosure requirements trigger stock price collapse and the CISO explains to investors why basic security architecture was ignored.
Example 4: Log Monitoring
@cyber-impact-statement
Context/Technology: SIEM platform ingesting authentication logs from Active Directory
Control Description: Real-time alerting on suspicious authentication patterns (brute force, impossible travel)
Expected Output:
Impact Statement:
Without real-time detection of credential abuse, attackers operate undetected inside the network for an average of 287 days before discovery. During this window, they extract intellectual property, escalate privileges to domain administrator, and establish persistent backdoors across hundreds of systems. By the time someone notices unusual database queries or invoice redirections, the attacker has already sold trade secrets to competitors and positioned ransomware for maximum damage. The company discovers the breach only when customers report fraudulent transactions or when law enforcement notifies them that proprietary source code appeared on Russian forums.
Ideal Use Cases:
Not Suitable For:
You can adjust the output by specifying:
Example with customization:
@cyber-impact-statement
Context/Technology: Hospital EHR system with role-based access controls
Control Description: Nurses cannot access administrative billing records
Target Audience: CISO and security leadership team
Industry: Healthcare (HIPAA regulated)
Severity: High
This skill embodies the principle that security is a business problem, not just a technical problem. The best impact statements make security leaders articulate clear business consequences, helping bridge the gap between technical controls and executive understanding.
Remember: CISOs and senior security teams need to translate technical failures into business language that resonates with executives who fund security programs.
npx claudepluginhub dstreefkerk/claude-skills --plugin cyberTranslates technical security findings into audience-specific communications for boards, executives, customers, and other non-security stakeholders. Covers incident communications, post-mortems, risk justifications, and breach disclosures.
Translates security findings, incidents, or program updates into audience-tuned writeups for board, executives, engineering, customer success, customers, legal, or procurement. Includes templates for incident notifications, breach disclosures, post-mortems, and status updates.
Generates professional audit findings in Condition-Criteria-Cause-Effect (CCCE) format with severity levels, management letter comments, remediation recommendations, and risk assessments.