New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Implementing Iso 27001 Information Security Management

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Guides implementation of an ISO/IEC 27001:2022 Information Security Management System (ISMS) end to end: gap analysis and scoping, risk assessment methodology, Annex A control selection, Statement…

Apache-2.0Auto-check passedLegal & Compliance

Install Implementing Iso 27001 Information Security Management

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-iso-27001-information-security-management -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills implementing-iso-27001-information-security-management --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/implementing-iso-27001-information-security-management .claude/skills/implementing-iso-27001-information-security-management && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
implementing-iso-27001-information-security-management
GitHub stars
34k
Token cost
~2k tokens
SKILL.md length
880 words
Files
8 (incl. scripts, references, assets)
Skills in repo
644
Repo updated
First seen
Licence
Apache-2.0

At a glance

Guides implementation of an ISO/IEC 27001:2022 Information Security Management System (ISMS) end to end: gap analysis and scoping, risk assessment methodology, Annex A control selection, Statement…

  • Works in 7 steps: Gap Analysis and Scoping (Weeks 1-4) → Risk Assessment (Weeks 5-10) → Control Selection and SoA (Weeks 11-14) → …
  • Scoping a new ISMS
  • SKILL.md covers Overview, When to Use, Prerequisites and Core Concepts, plus 5 more sections
  • Runs Python scripts from its folder

What it does

Implementing Iso 27001 Information Security Management is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Guides implementation of an ISO/IEC 27001:2022 Information Security Management System (ISMS) end to end: gap analysis and scoping, risk assessment methodology, Annex A control selection, Statement of Applicability (SoA) creation, and continuous improvement. Use when scoping a new ISMS, preparing for ISO 27001 certification or audit, or selecting and documenting Annex A controls for a compliance program.

Its SKILL.md is about 2k tokens, which your agent loads only when the skill is triggered. The skill folder holds 10 other files, including scripts, reference files and assets (for example `assets/template.md`, `references/api-reference.md` and `references/standards.md`).

It sits in Legal & Compliance, covering SOC 2 and security compliance and Regulatory compliance. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Scoping a new ISMS
  • Preparing for ISO 27001 certification
  • Selecting and documenting Annex A controls for a compliance program

Example prompts

  • “Use the implementing-iso-27001-information-security-management skill to guide implementation of an ISO/IEC 27001:2022 Information Security…”
  • “/implementing-iso-27001-information-security-management”

Requirements

  • Python 3

Workflow steps

7 steps, taken from the step headings in SKILL.md.

  1. Gap Analysis and Scoping (Weeks 1-4)
  2. Risk Assessment (Weeks 5-10)
  3. Control Selection and SoA (Weeks 11-14)
  4. Implementation (Weeks 15-30)
  5. Internal Audit and Management Review (Weeks 31-36)
  6. Certification Audit (Weeks 37-42)
  7. Continual Improvement (Ongoing)

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 2 files in scripts/ (Python), which the agent can run.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • isms.online
    • itgovernance.co.uk

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Implementing Iso 27001 Information Security Management loads about 2k tokens when it runs, and up to ~6k if it reads all its reference files. Until then it costs about 115 tokens; SKILL.md has 880 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~115
When it runs · the whole SKILL.md, loaded when a task matches
~2k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~6k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 880 words, ~2,025 tokens.

Download SKILL.mdSave it as .claude/skills/implementing-iso-27001-information-security-management/SKILL.md (or your agent's skills folder). This skill also uses 7 other files; get the full folder from GitHub.
name
implementing-iso-27001-information-security-management
description
Guides implementation of an ISO/IEC 27001:2022 Information Security Management System (ISMS) end to end: gap analysis and scoping, risk assessment methodology, Annex A control selection, Statement of Applicability (SoA) creation, and continuous improvement. Use when scoping a new ISMS, preparing for ISO 27001 certification or audit, or selecting and documenting Annex A controls for a compliance program.
domain
cybersecurity
subdomain
compliance-governance
tags
compliance, governance, iso27001, isms, risk-management, certification
nist_csf
GV.OC-01, GV.RM-01, GV.PO-01, ID.RA-01, PR.DS-01
version
1.0
author
mahipal
license
Apache-2.0
mitre_attack
T1078, T1530, T1685.002

Implementing ISO 27001 Information Security Management

Overview

ISO/IEC 27001:2022 is the international standard for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). This skill covers the complete lifecycle from scoping through certification, including Annex A control selection, risk assessment methodology, Statement of Applicability (SoA) creation, and continuous improvement processes.

When to Use

  • When deploying or configuring implementing iso 27001 information security management capabilities in your environment
  • When establishing security controls aligned to compliance requirements
  • When building or improving security architecture for this domain
  • When conducting security assessments that require this implementation

Prerequisites

  • Understanding of information security principles and risk management concepts
  • Familiarity with organizational governance structures and business processes
  • Knowledge of IT infrastructure, network architecture, and data flows
  • Access to ISO/IEC 27001:2022 and ISO/IEC 27002:2022 standards documents

Core Concepts

ISMS Clauses (4-10)

The management system requirements define what must be done:

  • Clause 4 - Context of the Organization: Define scope, interested parties, and internal/external issues
  • Clause 5 - Leadership: Top management commitment, information security policy, roles and responsibilities
  • Clause 6 - Planning: Risk assessment process, risk treatment plan, information security objectives
  • Clause 7 - Support: Resources, competence, awareness, communication, documented information
  • Clause 8 - Operation: Operational planning, risk assessment execution, risk treatment implementation
  • Clause 9 - Performance Evaluation: Monitoring, measurement, internal audit, management review
  • Clause 10 - Improvement: Nonconformities, corrective actions, continual improvement
Annex A Controls (2022 Edition)

The 2022 revision restructured 93 controls into four categories:

CategoryControlsExamples
Organizational (A.5)37 controlsPolicies, roles, threat intelligence, cloud security
People (A.6)8 controlsScreening, awareness, remote working, reporting
Physical (A.7)14 controlsPerimeters, entry controls, equipment security
Technological (A.8)34 controlsAccess control, cryptography, logging, secure development
New Controls in 2022 Edition

11 new controls were added:

  1. A.5.7 - Threat Intelligence
  2. A.5.23 - Information Security for Cloud Services
  3. A.5.30 - ICT Readiness for Business Continuity
  4. A.7.4 - Physical Security Monitoring
  5. A.8.9 - Configuration Management
  6. A.8.10 - Information Deletion
  7. A.8.11 - Data Masking
  8. A.8.12 - Data Leakage Prevention
  9. A.8.16 - Monitoring Activities
  10. A.8.23 - Web Filtering
  11. A.8.28 - Secure Coding

Workflow

Phase 1: Gap Analysis and Scoping (Weeks 1-4)
  1. Define ISMS scope boundaries (locations, business units, systems)
  2. Identify interested parties and their requirements
  3. Perform gap analysis against ISO 27001:2022 requirements
  4. Document internal and external context (PESTLE, SWOT)
  5. Obtain top management commitment and allocate budget
Phase 2: Risk Assessment (Weeks 5-10)
  1. Define risk assessment methodology (asset-based, scenario-based, or hybrid)
  2. Create asset inventory covering information, people, processes, technology
  3. Identify threats and vulnerabilities for each asset
  4. Assess risk likelihood and impact using defined criteria
  5. Calculate risk levels and determine risk treatment options (mitigate, accept, transfer, avoid)
  6. Develop Risk Treatment Plan (RTP)
Phase 3: Control Selection and SoA (Weeks 11-14)
  1. Map risk treatments to Annex A controls
  2. Create Statement of Applicability (SoA) documenting:
    • Which controls are applicable and justification
    • Which controls are excluded and justification
    • Implementation status of each control
  3. Design control implementation plans with owners and timelines
Show full SKILL.md (385 more words)Show less
Phase 4: Implementation (Weeks 15-30)
  1. Develop and approve information security policy
  2. Implement selected Annex A controls
  3. Create mandatory documented procedures:
    • Information Security Policy (A.5.1)
    • Risk Assessment Process (Clause 6.1.2)
    • Risk Treatment Process (Clause 6.1.3)
    • Internal Audit Programme (Clause 9.2)
    • Management Review Process (Clause 9.3)
    • Corrective Action Procedure (Clause 10.1)
  4. Deploy technical controls and security tooling
  5. Conduct security awareness training for all personnel
Phase 5: Internal Audit and Management Review (Weeks 31-36)
  1. Plan and execute internal audit programme covering all clauses and applicable controls
  2. Document audit findings and nonconformities
  3. Implement corrective actions with root cause analysis
  4. Conduct management review covering:
    • Status of previous actions
    • Changes in internal/external issues
    • Information security performance metrics
    • Audit results and risk assessment outcomes
    • Opportunities for improvement
Phase 6: Certification Audit (Weeks 37-42)
  1. Stage 1 Audit: Documentation review, readiness assessment
  2. Address Stage 1 findings
  3. Stage 2 Audit: On-site assessment of ISMS effectiveness
  4. Resolve any nonconformities (major NCRs require re-audit)
  5. Receive ISO 27001 certification (valid for 3 years)
Phase 7: Continual Improvement (Ongoing)
  1. Annual surveillance audits (Years 1 and 2)
  2. Recertification audit (Year 3)
  3. Regular risk reassessment and control effectiveness reviews
  4. Incident-driven improvements and lessons learned integration

Key Artifacts

  • ISMS Scope Document
  • Information Security Policy
  • Risk Assessment Methodology
  • Risk Register and Risk Treatment Plan
  • Statement of Applicability (SoA)
  • Internal Audit Reports
  • Management Review Minutes
  • Corrective Action Register
  • Metrics and KPI Dashboard

Common Pitfalls

  • Scope too broad or too narrow, leading to audit complications
  • Treating ISO 27001 as a checkbox exercise rather than embedding into business processes
  • Insufficient top management involvement and commitment
  • Failing to maintain documented evidence of control operation
  • Not performing regular risk reassessments as the threat landscape changes
  • Ignoring the 11 new controls in the 2022 edition during transition

Integration Points

  • ISO 27002:2022: Detailed implementation guidance for Annex A controls
  • ISO 27005: Information security risk management methodology
  • ISO 27017: Cloud security controls
  • ISO 27018: Protection of PII in cloud services
  • ISO 27701: Privacy Information Management System (PIMS) extension
  • NIST CSF 2.0: Cross-mapping for dual compliance
  • SOC 2: Overlapping trust service criteria

References

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 7 other files (scripts, references, assets) in skills/implementing-iso-27001-information-security-management of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Implementing Iso 27001 Information Security Management next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Implementing Iso 27001 Information Security Management compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Implementing Iso 27001 Information Security Management this skillmukul975/Anthropic-Cybersecurity-Skills34k—~2kAutomated safety check: PassApache-2.0
Policy OpaAgentSecOps/SecOpsAgentKit2201 repos~3.5kAutomated safety check: PassCustom licence
Implementing Complianceancoleman/ai-design-components525—~4kAutomated safety check: PassMIT
Security Compliance Compliance Checkaiskillstore/marketplace4338 repos~600Automated safety check: PassNone
Ra Qm Skillsalirezarezvani/claude-skills28k—~833Automated safety check: PassMIT
Compliance Testingproffesor-for-testing/agentic-qe495—~1.8kAutomated safety check: PassMIT

Similar skills

  • Policy Opa

    AgentSecOps/SecOpsAgentKit

    Policy-as-code enforcement and compliance validation using Open Policy Agent (OPA).

    220 GitHub starsUsed in 1 repo~3.5k tokens
    Legal & ComplianceAuto-check passed

  • Implementing Compliance

    ancoleman/ai-design-components

    Implement and maintain compliance with SOC 2, HIPAA, PCI-DSS, and GDPR using unified control mapping, policy-as-code enforcement, and automated evidence collection.

    525 GitHub stars~4k tokensUpdated 10 mo ago
    Legal & ComplianceAuto-check passed

  • Security Compliance Compliance Check

    aiskillstore/marketplace

    You are a compliance expert specializing in regulatory requirements for software systems including GDPR, HIPAA, SOC2, PCI-DSS, and other industry standards.

    433 GitHub starsUsed in 8 repos~600 tokens
    Legal & ComplianceAuto-check passed

  • Ra Qm Skills

    alirezarezvani/claude-skills

    Router/index for the 15 regulatory & quality-management skills bundled in this plugin (ISO 13485 QMS, EU MDR 2017/745, FDA submissions under QMSR, ISO 14971 risk, CAPA, document control, ISO…

    28k GitHub stars~833 tokensUpdated 1 mo ago
    Legal & ComplianceAuto-check passed

  • Compliance Testing

    proffesor-for-testing/agentic-qe

    Regulatory compliance testing for GDPR, CCPA, HIPAA, SOC2, PCI-DSS and industry-specific regulations.

    495 GitHub stars~1.8k tokensUpdated yesterday
    Legal & ComplianceAuto-check passed

  • Openrouter Compliance Review

    jeremylongshore/tons-of-skills-marketplace

    Review OpenRouter integration for regulatory compliance (SOC2, GDPR, HIPAA).

    2.8k GitHub stars~2.3k tokensUpdated yesterday
    Legal & ComplianceAuto-check: notes

More from mukul975/Anthropic-Cybersecurity-Skills

All 644 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Categories

Questions about Implementing Iso 27001 Information Security Management

What does Implementing Iso 27001 Information Security Management do?

Guides implementation of an ISO/IEC 27001:2022 Information Security Management System (ISMS) end to end: gap analysis and scoping, risk assessment methodology, Annex A control selection, Statement…. Implementing Iso 27001 Information Security Management is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Guides implementation of an ISO/IEC 27001:2022 Information Security Management System (ISMS) end to end: gap analysis and scoping, risk assessment methodology, Annex A control selection, Statement of Applicability (SoA) creation, and continuous improvement.

When should I use Implementing Iso 27001 Information Security Management?

Implementing Iso 27001 Information Security Management fits situations like: scoping a new ISMS; preparing for ISO 27001 certification; selecting and documenting Annex A controls for a compliance program.

How do I install Implementing Iso 27001 Information Security Management in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-iso-27001-information-security-management -a claude-code`. Or copy the skill folder (skills/implementing-iso-27001-information-security-management in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/implementing-iso-27001-information-security-management in your project. Claude Code loads it when a task matches its description.

How do I install Implementing Iso 27001 Information Security Management in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-iso-27001-information-security-management -a codex`. Or copy the skill folder (skills/implementing-iso-27001-information-security-management in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/implementing-iso-27001-information-security-management in your project. Codex loads it when a task matches its description.

Can I use Implementing Iso 27001 Information Security Management in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-iso-27001-information-security-management -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/implementing-iso-27001-information-security-management, .gemini/skills/implementing-iso-27001-information-security-management, .github/skills/implementing-iso-27001-information-security-management and .opencode/skills/implementing-iso-27001-information-security-management in your project.

What does Implementing Iso 27001 Information Security Management need to run?

Going by SKILL.md and its folder, Implementing Iso 27001 Information Security Management needs Python for the scripts in its folder. Our summary lists: Python 3.

Does Implementing Iso 27001 Information Security Management access the network?

SKILL.md names 2 domains. As links in the text: isms.online and itgovernance.co.uk. This is read from the text; nothing was executed.

Is Implementing Iso 27001 Information Security Management safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Implementing Iso 27001 Information Security Management use?

Implementing Iso 27001 Information Security Management is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Implementing Iso 27001 Information Security Management use?

About 2k tokens (SKILL.md is roughly 8.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 3.9k tokens, read only when the agent opens those files.

What are the alternatives to Implementing Iso 27001 Information Security Management?

Skills that share tags, products or a category with Implementing Iso 27001 Information Security Management: Policy Opa (AgentSecOps/SecOpsAgentKit, 220 stars), Implementing Compliance (ancoleman/ai-design-components, 525 stars), Security Compliance Compliance Check (aiskillstore/marketplace, 433 stars) and Ra Qm Skills (alirezarezvani/claude-skills, 28k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Implementing Iso 27001 Information Security Management?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 34,116 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.