mcpField
E
enterprise-security-exception-review

enterprise-security-exception-review

github.com/sylphxaiSecurity135 installsUpdated today
Repository

About enterprise-security-exception-review

A skill for reviewing enterprise security exceptions, customer requirements, compensating controls, and remediation. It produces a decision artifact with evidence, approval ownership, expiry, and customer communication.

Key features

  1. 01Exception type classification
  2. 02Control gap and risk review
  3. 03Compensating control planning
  4. 04Approval, evidence, and expiry definition
  5. 05Remediation and customer response planning

Use cases

  1. 01Assess a customer-specific security requirement
  2. 02Review a proposed risk acceptance
  3. 03Set expiry and remediation for an exception

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/sylphxai/skills --skill enterprise-security-exception-review

After installing, type/enterprise-security-exception-reviewin Claude Code to confirm it loaded.

Bundled filesagents/openai.yamlreferences/enterprise-security-exception-patterns.md

Details

From the project README

Enterprise Security Exception Review

Use this skill to convert enterprise security exception, compensating control, customer requirement, risk acceptance, expiry, and remediation questions into a concrete artifact with owners, gates, metrics, and recovery paths.

Workflow

  1. Identify customer request, control requirement, current standard, gap, affected data, contract impact, compensating controls, owner, expiry need, and remediation feasibility.
  2. Read references/enterprise-security-exception-patterns.md.
  3. Classify exception as no-exception-needed, documentation gap, customer-specific config, compensating control, risk acceptance, roadmap request, contract redline, or non-acceptable risk.
  4. Define approval owner, evidence, compensating control, customer communication, expiry, renewal review, remediation plan, and support/runbook impact.
  5. Produce exception review, state machine, decision table, event schema, risk checklist, and customer response plan.

When not to use

  • Do not use for generic advice the base model already handles without this skill's specific artifact contract.

Guardrails

  • Do not grant indefinite customer-specific security exceptions without owner, expiry, and renewal review.
  • Do not let sales promise security controls, certifications, encryption, residency, logging, SSO, or retention exceptions without evidence.
  • Do not accept exceptions that silently weaken other customers, shared infrastructure, or regulatory commitments.
  • Do not confuse roadmap intent with currently operating compensating controls.

Output format

Security exception context:
Audience / source of truth / risk boundary:

Exception decision plan:
| Area | Decision | Evidence | Risk | Owner |
| --- | --- | --- | --- | --- |

Compensating controls, expiry, and remediation:
- <trigger> -> <policy, metric, edge case, support note>

Comments

Markdown supported