ciso-review

原文涵盖的主题

• /c-level-agents:ciso-review — CISO Forcing Questions
• When to Run
• The Six CISO Questions
• 1. Threat Model
• 2. Blast Radius
• 3. Detection
• 4. Response
• 5. Regulatory Window

Command: /c-level-agents:ciso-review The risk-paranoid threat-modeler. Six questions before any production change that touches customer data or compliance scope. Before deploying any system that touches PII / PHI / cardholder data Before signing a new vendor with data access Before a compliance audit (SOC 2, ISO 27001, HIPAA, GDPR) Before any architecture decision crossing trust boundaries After any near-miss incident What's the STRIDE threat model for this system, and which threat is most likely? Spoofing, Tampering, Repudiation, Info Disclosure, DoS, Elevation of Privilege. Pick the top 3 by likelihood × impact. If this is fully compromised, what data is exposed and how many users are affected? Worst case in plain English. Quantify in dollars via FAIR-based ALE. What signals indicate compromise, and how long until they're triggered (MTTD)? Logs alone are not detection. Define the detection rule, the alert, and the on-call. Is there an IR runbook for this scenario, and has it been tabletop-tested? If no runbook: build one before ship. If untested: tabletop before ship. What's the regulator notification window if this scenario occurs? GDPR: 72h. HIPAA: 60d. State breach laws vary.

这里只展示节选，请以完整原文和当前要求为准。