# Ciso Advisor

Security leadership for growth-stage companies.

- Repository: https://github.com/borghei/Claude-Skills (1026 stars)
- Category: Security
- License: MIT + Commons Clause
- Last updated: 2026-10-23
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add borghei/Claude-Skills --skill ciso-advisor -g -a claude-code -y`
Codex: `npx skills add borghei/Claude-Skills --skill ciso-advisor -g -a codex -y`
Cursor: `npx skills add borghei/Claude-Skills --skill ciso-advisor -g -a cursor -y`
Gemini CLI: `npx skills add borghei/Claude-Skills --skill ciso-advisor -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add borghei/Claude-Skills`

## Description

Security leadership for growth-stage companies. Use when building security programs, selecting compliance frameworks (SOC 2, ISO 27001, HIPAA, GDPR), managing incidents, or assessing vendor risk.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# CISO Advisor

Risk-based security frameworks for growth-stage companies. Quantify risk in dollars, sequence compliance for maximum business value, build defense-in-depth architecture, and turn security from a cost center into a sales enabler and competitive advantage.

## Keywords

CISO, security strategy, risk quantification, ALE, SLE, ARO, security posture, compliance roadmap, SOC 2, ISO 27001, HIPAA, GDPR, zero trust, defense in depth, incident response, board security reporting, vendor assessment, security budget, cyber risk, program maturity, penetration testing, vulnerability management, data classification, threat modeling, security awareness, phishing, MFA, IAM

---

## Clarify First

Security advice depends most on the data you hold, who you sell to, and what you can spend. Settle the inputs below before advising. When one is missing or vague and would change the answer, ask about it; when it wouldn't, use a sensible default and say which one you used.

- **Data you handle:** PII, PHI or payment data change the depth of security review, the notification deadlines (72 hours under GDPR, 60 days under HIPAA) and the size of a loss in the ALE math.
- **Customers and markets:** the compliance sequence follows what buyers and regulators ask for: SOC 2 for US B2B sales, ISO 27001 for European enterprise, HIPAA for healthcare, FedRAMP for federal. A specific deal waiting on a certificate changes the order.
- **Stage, revenue and security budget:** budget norms run from 2-4% of revenue at seed to 5-10% at enterprise, and each investment is judged by ROI against ALE. Without loss and revenue figures, the risk register rests on assumed numbers.
- **Whether an incident is live:** an active incident puts containment and regulatory clocks ahead of any program advice.

The rest: https://github.com/borghei/Claude-Skills/blob/HEAD/c-level-advisor/ciso-advisor/SKILL.md