scope-statement-drafting
From the author
Use this skill when a team must define what its management system covers before a certification project, or its current scope is one vague sentence, and asks "write our ISMS scope", "what should be in scope", "can we exclude the sales office", "scope for the certificate", "draw the boundary of our management system" or "the auditor says our scope is unclear". Drafts the scope statement with boundaries, interfaces, dependencies and justified exclusions, for a security, privacy or AI management system, and writes a statement file plus a boundary table of open questions.
Install
npx skills add better-isms/grcskills --skill scope-statement-drafting -a claude-code
Installs to .claude/skills/scope-statement-drafting/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
No warnings.
Why 82
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- ai-management-system-scopebetter-isms/grcskillsUse this skill when a company that already runs a security management system wants to add an AI management system, or is preparing for an AI governance certification, and asks "scope our AI management system", "what should the AIMS cover", "AI governance roles", "who owns AI governance", "extend our ISMS to AI" or "write the AI management system scope statement". Decides which AI systems, roles, teams and lifecycle stages are in, maps interfaces and dependencies, reuses the processes the security system already runs, assigns roles with a RACI, and writes the scope statement, the roles file and the open questions for leadership.Security★ 51
- security-policy-draftingbetter-isms/grcskillsUse this skill when a company needs its information security policy set written or rebuilt, or asks "write our security policies", "draft the information security policy", "we need policies for the audit", "policy pack for a startup", "our template policies are 40 documents nobody reads" or "which policies do we actually need". Maps the policy set to the company's size and owners, drafts the top-level policy and the topic policies in testable language that reflects what the company does, flags commitments that need a decision, and prepares the approval and communication record for leadership.Security★ 51
- risk-method-draftingbetter-isms/grcskillsUse this skill when a company needs a written risk assessment method before it builds or rescores a register, or when the current method produces registers where everything scores 3. Triggers: "write our risk methodology", "define likelihood and impact scales", "what is our risk appetite", "risk acceptance criteria", "who can accept a risk", "our auditor says the method is not repeatable", "risk matrix for our ISMS". Drafts a short method with likelihood and impact anchors in the company's own money, hours and records, a scoring rule, an acceptance threshold with an authority ladder, reassessment triggers, and a calibration test on five sample risks.Testing★ 51
- incident-response-plan-draftingbetter-isms/grcskillsUse this skill when a company has no incident response plan, has one copied from a template that names teams it does not have, or an auditor, customer or insurer asks for it, and the team says "write our incident response plan", "IR plan", "security incident procedure", "who does what in an incident", "incident playbooks", "contact tree for incidents" or "our plan failed in the last incident". Drafts a plan sized to the company with roles and deputies, a severity scale, a contact tree with an out-of-band channel, one-page playbooks for the likely scenarios, evidence handling and a notification decision step, plus a one-page quick reference card.Planning★ 51
- requirements-scopingproyecto26/system-design-skillsThis skill should be used when the user needs to "clarify requirements", separate "functional vs non-functional requirements", "scope the problem", figure out "what questions should I ask", state the "requirements for <X>", or otherwise pin down a vague design prompt before building. It turns an ambiguous ask into functional requirements, non-functional constraints, and an explicit out-of-scope. Use it whenever a prompt is broad or under-specified ("design Twitter", "build a chat app") even if the user doesn't say "requirements".Planning★ 97
- soa-first-draftbetter-isms/grcskillsUse this skill when a company has a risk assessment and treatment plan and now needs its first statement of applicability, and asks "build our SoA", "draft the statement of applicability", "which controls apply to us", "SoA from the risk treatment plan", "justify inclusions and exclusions" or "our SoA says implemented everywhere". Drafts one row per control of the reader's framework with the inclusion decision, the risk or obligation behind it, an implementation status taken from records, an evidence pointer and an owner role, and writes a CSV statement plus notes of open decisions.Data★ 51
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in