cyber

CYBER — Cybersecurity

Capability overview

Code: CYBER Full name: Cybersecurity Description: Advisory across security strategy, ISO 27001 readiness, threat modeling, secure-by-design reviews, and security operations maturity.

---

Skills index

#	Skill	Command	Purpose
1	Maturity Assessment	/cps-cyber:maturity-assess	Score the client's security capabilities against NIST CSF / ISO 27001 controls.
2	ISO 27001 Gap	/cps-cyber:iso27001-gap	Map current controls to ISO 27001 Annex A; produce a gap register and remediation plan.
3	Threat Modeling	/cps-cyber:threat-model	Run STRIDE / PASTA on a target system; produce threat register + mitigations.
4	Secure-by-Design Review	/cps-cyber:secure-by-design	Architectural review for new systems against secure-by-design principles.
5	Incident Runbook	/cps-cyber:incident-runbook	Author / refresh incident response runbooks with severity tiers and playbooks.
6	Vendor Risk Assessment	/cps-cyber:vendor-risk	Score third-party vendors on security posture using CAIQ / SIG Lite.

---

Skill 1: Maturity Assessment

Command: /cps-cyber:maturity-assess

Purpose

Score the client's security capabilities against NIST CSF / ISO 27001 controls.

Inputs required

client:
  name: "Client Name"
  industry: "Industry"
context:
  scope: "in-scope description"
  constraints: ["constraint 1", "constraint 2"]
references:
  - "Prior deliverable / document name"
  - "External benchmark / source"

Methodology

1. Frame. Translate client request into a structured problem statement and hypotheses.
2. Gather. Pull data from engagement brain, client documents, and external sources.
3. Analyze. Apply the Maturity Assessment method using domain frameworks (see Frameworks section of the agent).
4. Synthesize. Produce primary deliverable with recommendations, evidence, and risks.
5. Validate. Run /cps:verify-quality and pass through Every control gap mapped to a CIS Critical Security Control or ISO 27001 Annex A clause.

Output shape

A CPS-branded Maturity Assessment deliverable in 05_Deliverables_Final/. Pyramid-Principle structured, sourced, and reviewed.

Quality checklist

• Every control gap mapped to a CIS Critical Security Control or ISO 27001 Annex A clause
• Threat models name explicit assets, threat actors, and attack vectors
• Vendor risk scores cite the questionnaire (CAIQ row, SIG Lite section) used to derive them

---

Skill 2: ISO 27001 Gap

Command: /cps-cyber:iso27001-gap

Purpose

Map current controls to ISO 27001 Annex A; produce a gap register and remediation plan.

Inputs required

client:
  name: "Client Name"
  industry: "Industry"
context:
  scope: "in-scope description"
  constraints: ["constraint 1", "constraint 2"]
references:
  - "Prior deliverable / document name"
  - "External benchmark / source"

Methodology

1. Frame. Translate client request into a structured problem statement and hypotheses.
2. Gather. Pull data from engagement brain, client documents, and external sources.
3. Analyze. Apply the ISO 27001 Gap method using domain frameworks (see Frameworks section of the agent).
4. Synthesize. Produce primary deliverable with recommendations, evidence, and risks.
5. Validate. Run /cps:verify-quality and pass through Every control gap mapped to a CIS Critical Security Control or ISO 27001 Annex A clause.

Output shape

A CPS-branded ISO 27001 Gap deliverable in 05_Deliverables_Final/. Pyramid-Principle structured, sourced, and reviewed.

Quality checklist

• Every control gap mapped to a CIS Critical Security Control or ISO 27001 Annex A clause
• Threat models name explicit assets, threat actors, and attack vectors
• Vendor risk scores cite the questionnaire (CAIQ row, SIG Lite section) used to derive them

---

Skill 3: Threat Modeling

Command: /cps-cyber:threat-model

Purpose

Run STRIDE / PASTA on a target system; produce threat register + mitigations.

Inputs required

client:
  name: "Client Name"
  industry: "Industry"
context:
  scope: "in-scope description"
  constraints: ["constraint 1", "constraint 2"]
references:
  - "Prior deliverable / document name"
  - "External benchmark / source"

Methodology

1. Frame. Translate client request into a structured problem statement and hypotheses.
2. Gather. Pull data from engagement brain, client documents, and external sources.
3. Analyze. Apply the Threat Modeling method using domain frameworks (see Frameworks section of the agent).
4. Synthesize. Produce primary deliverable with recommendations, evidence, and risks.
5. Validate. Run /cps:verify-quality and pass through Every control gap mapped to a CIS Critical Security Control or ISO 27001 Annex A clause.

Output shape

A CPS-branded Threat Modeling deliverable in 05_Deliverables_Final/. Pyramid-Principle structured, sourced, and reviewed.

Quality checklist

• Every control gap mapped to a CIS Critical Security Control or ISO 27001 Annex A clause
• Threat models name explicit assets, threat actors, and attack vectors
• Vendor risk scores cite the questionnaire (CAIQ row, SIG Lite section) used to derive them

---

Skill 4: Secure-by-Design Review

Command: /cps-cyber:secure-by-design

Purpose

Architectural review for new systems against secure-by-design principles.

Inputs required

client:
  name: "Client Name"
  industry: "Industry"
context:
  scope: "in-scope description"
  constraints: ["constraint 1", "constraint 2"]
references:
  - "Prior deliverable / document name"
  - "External benchmark / source"

Methodology

1. Frame. Translate client request into a structured problem statement and hypotheses.
2. Gather. Pull data from engagement brain, client documents, and external sources.
3. Analyze. Apply the Secure-by-Design Review method using domain frameworks (see Frameworks section of the agent).
4. Synthesize. Produce primary deliverable with recommendations, evidence, and risks.
5. Validate. Run /cps:verify-quality and pass through Every control gap mapped to a CIS Critical Security Control or ISO 27001 Annex A clause.

Output shape

A CPS-branded Secure-by-Design Review deliverable in 05_Deliverables_Final/. Pyramid-Principle structured, sourced, and reviewed.

Quality checklist

• Every control gap mapped to a CIS Critical Security Control or ISO 27001 Annex A clause
• Threat models name explicit assets, threat actors, and attack vectors
• Vendor risk scores cite the questionnaire (CAIQ row, SIG Lite section) used to derive them

---

Skill 5: Incident Runbook

Command: /cps-cyber:incident-runbook

Purpose

Author / refresh incident response runbooks with severity tiers and playbooks.

Inputs required

client:
  name: "Client Name"
  industry: "Industry"
context:
  scope: "in-scope description"
  constraints: ["constraint 1", "constraint 2"]
references:
  - "Prior deliverable / document name"
  - "External benchmark / source"

Methodology

1. Frame. Translate client request into a structured problem statement and hypotheses.
2. Gather. Pull data from engagement brain, client documents, and external sources.
3. Analyze. Apply the Incident Runbook method using domain frameworks (see Frameworks section of the agent).
4. Synthesize. Produce primary deliverable with recommendations, evidence, and risks.
5. Validate. Run /cps:verify-quality and pass through Every control gap mapped to a CIS Critical Security Control or ISO 27001 Annex A clause.

Output shape

A CPS-branded Incident Runbook deliverable in 05_Deliverables_Final/. Pyramid-Principle structured, sourced, and reviewed.

Quality checklist

• Every control gap mapped to a CIS Critical Security Control or ISO 27001 Annex A clause
• Threat models name explicit assets, threat actors, and attack vectors
• Vendor risk scores cite the questionnaire (CAIQ row, SIG Lite section) used to derive them

---

Skill 6: Vendor Risk Assessment

Command: /cps-cyber:vendor-risk

Purpose

Score third-party vendors on security posture using CAIQ / SIG Lite.

Inputs required

client:
  name: "Client Name"
  industry: "Industry"
context:
  scope: "in-scope description"
  constraints: ["constraint 1", "constraint 2"]
references:
  - "Prior deliverable / document name"
  - "External benchmark / source"

Methodology

1. Frame. Translate client request into a structured problem statement and hypotheses.
2. Gather. Pull data from engagement brain, client documents, and external sources.
3. Analyze. Apply the Vendor Risk Assessment method using domain frameworks (see Frameworks section of the agent).
4. Synthesize. Produce primary deliverable with recommendations, evidence, and risks.
5. Validate. Run /cps:verify-quality and pass through Every control gap mapped to a CIS Critical Security Control or ISO 27001 Annex A clause.

Output shape

A CPS-branded Vendor Risk Assessment deliverable in 05_Deliverables_Final/. Pyramid-Principle structured, sourced, and reviewed.

Quality checklist

• Every control gap mapped to a CIS Critical Security Control or ISO 27001 Annex A clause
• Threat models name explicit assets, threat actors, and attack vectors
• Vendor risk scores cite the questionnaire (CAIQ row, SIG Lite section) used to derive them

---

Cross-skill workflows

Discovery → /cps-cyber:maturity-assess → /cps-cyber:iso27001-gap → Recommendations

Integration with other CPS plugins

Plugin	Integration point
cps-iso	Joint ISO 27001 + ISO 9001/42001 readiness work
cps-risk	Map cyber risks into the enterprise risk register
cps-aig	AI governance security control overlay (ISO 42001 + 27001)

Templates & artifacts

All deliverables use standard CPS branding via:

• /doc-gen for document generation
• assets/cps-branding.json for styling
• scripts/cps-document-generator.js for automation

Skill	Primary artifact	Format
/cps-cyber:maturity-assess	Maturity Assessment Report	DOCX/PDF
/cps-cyber:iso27001-gap	ISO 27001 Gap Report	DOCX/PDF
/cps-cyber:threat-model	Threat Modeling Report	DOCX/PDF
/cps-cyber:secure-by-design	Secure-by-Design Review Report	DOCX/PDF
/cps-cyber:incident-runbook	Incident Runbook Report	DOCX/PDF
/cps-cyber:vendor-risk	Vendor Risk Assessment Report	DOCX/PDF