Imported from Ck1sap/borghei-Claude-Skills (c-level-advisor/ciso-advisor/SKILL.md). Install upstream with npx skills add Ck1sap/borghei-Claude-Skills --skill ciso-advisor. Copyright stays with the author (MIT + Commons Clause).

CISO Advisor

Risk-based security frameworks for growth-stage companies. Quantify risk in dollars, sequence compliance for maximum business value, build defense-in-depth architecture, and turn security from a cost center into a sales enabler and competitive advantage.

Keywords

CISO, security strategy, risk quantification, ALE, SLE, ARO, security posture, compliance roadmap, SOC 2, ISO 27001, HIPAA, GDPR, zero trust, defense in depth, incident response, board security reporting, vendor assessment, security budget, cyber risk, program maturity, penetration testing, vulnerability management, data classification, threat modeling, security awareness, phishing, MFA, IAM

Risk Quantification Framework

Every security investment must be justified in business terms. "We need better security" is not a business case. "$800K expected annual loss from this unmitigated risk" is.

Core Formula

ALE = SLE x ARO

ALE  = Annual Loss Expectancy (expected cost per year)
SLE  = Single Loss Expectancy (cost if the event occurs once)
ARO  = Annual Rate of Occurrence (probability of occurrence per year)

Risk Register Template

Risk Prioritization Decision Tree

START: New risk identified
  |
  v
[Calculate ALE]
  |
  +-- ALE > $200K/yr --> CRITICAL: Board-level reporting, immediate mitigation
  |
  +-- ALE $50K-$200K --> HIGH: Quarterly review, funded mitigation plan
  |
  +-- ALE $10K-$50K --> MEDIUM: Annual review, budget if ROI > 1.5x
  |
  +-- ALE < $10K --> LOW: Accept risk, document decision, monitor

SLE Component Breakdown

Compliance Roadmap

Sequencing for Maximum Business Value

Phase 1: Foundation (Months 1-3)
  Basic hygiene: MFA, endpoint protection, access controls, backups
  Cost: $20-50K   Impact: Blocks 80% of common attacks

Phase 2: SOC 2 Type I (Months 3-6)
  Policies, procedures, controls documentation
  Cost: $50-100K  Impact: Unlocks mid-market enterprise sales

Phase 3: SOC 2 Type II (Months 6-12)
  Sustained controls operation + audit
  Cost: $80-150K  Impact: Required by most enterprise buyers

Phase 4: Specialized (Months 12-18)
  ISO 27001, HIPAA, or GDPR based on market requirements
  Cost: $100-250K Impact: Market-specific requirement fulfillment

Compliance Framework Comparison

Framework Overlap Matrix

Key insight: SOC 2 + ISO 27001 share approximately 70% of controls. Do SOC 2 first, then extend to ISO 27001 with ~30% incremental effort.

Security Architecture Strategy

Zero Trust Maturity Model

Security Architecture Decision Tree

START: New system or feature being designed
  |
  v
[Does it handle sensitive data?]
  |
  +-- YES --> [What classification level?]
  |            |
  |            +-- PII/PHI --> Full security review + threat model
  |            +-- Business-critical --> Standard security review
  |            +-- Internal --> Lightweight checklist
  |
  +-- NO  --> [Is it internet-facing?]
              |
              +-- YES --> Standard security review + pen test
              +-- NO  --> Security checklist only

Defense-in-Depth Layers

Incident Response Protocol

Severity Classification

Incident Response Workflow

DETECT --> CONTAIN --> ERADICATE --> RECOVER --> LEARN

Phase 1: DETECT (Minutes)
  - Identify the scope and nature of the incident
  - Classify severity (P0-P3)
  - Activate response team based on severity

Phase 2: CONTAIN (Hours)
  - Isolate affected systems
  - Preserve evidence (forensic images)
  - Prevent lateral movement
  - Communicate to stakeholders per severity matrix

Phase 3: ERADICATE (Hours-Days)
  - Remove threat actor/malware
  - Patch vulnerability that enabled the incident
  - Verify eradication is complete

Phase 4: RECOVER (Days)
  - Restore from clean backups
  - Verify system integrity
  - Monitor for re-compromise
  - Return to normal operations

Phase 5: LEARN (Days-Weeks)
  - Root cause analysis (blameless)
  - Timeline reconstruction
  - Control gap identification
  - Remediation plan with owners and deadlines

Regulatory Notification Timelines

Vendor Security Assessment

Vendor Tiering

Vendor Assessment Checklist (Tier 1)

Security Metrics Dashboard

Board-Level Metrics (Quarterly)

Operational Metrics (Monthly)

Security Budget Framework

Budget as Percentage of Revenue/IT Spend

Budget Allocation by Category

Budget Justification Formula

For each security investment:

Investment ROI = (ALE_before - ALE_after) / Investment_cost

If ROI > 1.5x --> Strong business case, approve
If ROI 1.0-1.5x --> Moderate case, consider alternatives
If ROI < 1.0x --> Weak case, re-evaluate or accept the risk

Red Flags

• Security budget justified by "industry benchmarks" instead of risk analysis -- budget will be wrong
• Pursuing certifications before basic hygiene (MFA, patching, backups) -- checkbox without substance
• No documented asset inventory -- protecting unknown assets is impossible
• IR plan exists but never tested (no tabletop exercise) -- plan will fail when needed
• Security team reports to IT, not executive level -- misaligned incentives, budget competition
• Single vendor for identity + endpoint + email -- vendor compromise = total compromise
• Security questionnaire backlog > 30 days -- silently losing enterprise deals
• No security champion program in engineering -- security becomes a bottleneck
• Pen test findings unresolved after 90 days -- testing without fixing is theater
• No data classification scheme -- everything treated the same = nothing protected properly

Integration with C-Suite

Proactive Triggers

• No security audit in 12+ months -- schedule before a customer or regulator asks
• Enterprise deal requires SOC 2 but no certification exists -- compliance roadmap urgently needed
• New market expansion planned -- check data residency, privacy requirements, local regulations
• Key system has no access logging -- compliance gap and forensic blind spot
• Vendor with access to sensitive data not assessed -- vendor risk assessment required
• Critical vulnerability disclosed in a dependency -- patch assessment within 24 hours
• Employee termination without access revocation SOP -- immediate security gap

Output Artifacts

Tool Reference

security_posture_scorer.py

Scores security posture across NIST CSF 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover) and CISA Zero Trust Maturity Model pillars (Identity, Devices, Networks, Applications, Data). Produces board-ready security health reports.

# Run with demo data (realistic Series B company)
python scripts/security_posture_scorer.py

# From JSON with control assessments (0-4 maturity per control)
python scripts/security_posture_scorer.py --input controls.json

# JSON output
python scripts/security_posture_scorer.py --json

risk_register_manager.py

Manages cyber risk register with ALE (SLE x ARO) calculations, mitigation ROI, and board-ready risk reports.

# Run with demo risk register
python scripts/risk_register_manager.py

# From JSON risk register
python scripts/risk_register_manager.py --input risks.json

# Sort by ROI (best investments first)
python scripts/risk_register_manager.py --sort-by roi

# JSON output
python scripts/risk_register_manager.py --json

compliance_tracker.py

Tracks progress across SOC 2 Type I/II, ISO 27001, HIPAA, and GDPR. Calculates gap analysis, framework overlaps, and effort estimates.

# Track SOC 2 readiness (default)
python scripts/compliance_tracker.py

# Track multiple frameworks
python scripts/compliance_tracker.py --frameworks soc2_type1 iso27001 gdpr

# List available frameworks
python scripts/compliance_tracker.py --list-frameworks

# From JSON
python scripts/compliance_tracker.py --input compliance.json

# JSON output
python scripts/compliance_tracker.py --json

Troubleshooting

Success Criteria

• Security posture score above 70/100 on NIST CSF assessment (measured annually via security_posture_scorer.py)
• ALE coverage above 80% -- quantified risk exposure has funded mitigations (tracked in risk register)
• Mean time to detect (MTTD) under 24 hours for all severity levels
• Mean time to respond (MTTR) under 4 hours for P0/P1 incidents
• Zero critical vulnerabilities open longer than 7 days (measured weekly)
• SOC 2 Type II certification maintained current with zero control exceptions
• Phishing click rate below 5% across quarterly simulation campaigns

Scope & Limitations

In Scope: Risk quantification (ALE/SLE/ARO), compliance roadmapping, Zero Trust maturity assessment, NIST CSF 2.0 scoring, incident response protocol, vendor security assessment, security budget justification, board-level security reporting.

Out of Scope: Penetration testing execution, malware analysis, SOC operations, firewall configuration, code review, forensic investigation execution, security tool procurement.

Limitations: Security posture scorer uses self-assessed maturity levels which may overstate actual capability. Risk register ALE calculations are estimates based on industry data -- actual losses vary significantly. Compliance tracker measures control implementation, not control effectiveness. Zero Trust scoring uses binary (implemented/not) which oversimplifies partial implementations.

Integration Points