[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADK2J4G8HSNS2WD9AZ8QRA":3,"skill-same:01M6ADK2J4G8HSNS2WD9AZ8QRA":110},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":63,"commitSha":64,"skillDirectory":65,"forksCount":66,"repositoryHtmlUrl":67,"repositoryHomepageUrl":68,"ownerHtmlUrl":69,"ownerBlogUrl":70,"ownerDescription":71,"updatedAt":72,"install":73,"resources":86},"01M6ADK2J4G8HSNS2WD9AZ8QRA","achieving-cmmc-level-2-compliance",null,"Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment Methodology, manage a compliant POA&M, and ready the organization for a C3PAO assessment. Use when an organization handles Controlled Unclassified Information (CUI) under a DoD contract, when a contract carries DFARS clause 252.204-7012\u002F7019\u002F7020\u002F7021, when preparing for or responding to a CMMC assessment, when computing or improving an SPRS score, when building a System Security Plan or POA&M for 800-171, or when scoping which systems are in the CUI boundary. Keywords: CMMC, CMMC Level 2, NIST 800-171, SP 800-171 Rev 2, CUI, FCI, SPRS, DFARS 7012, C3PAO, POA&M, System Security Plan, DoD Assessment Methodology, 110 controls, defense industrial base, DIB, FedRAMP equivalency.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fachieving-cmmc-level-2-compliance\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"achieving cmmc level 2 compliance","nist-800-171","defense-industrial-base","compliance","poam","c3pao","dfars","sprs","cui","security","cmmc","assessment","pr","governance","prepare","implement","cybersecurity","2026-11-10 10:12:30",false,"---\nname: achieving-cmmc-level-2-compliance\ndescription: >-\n  Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI\n  and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14\n  families, compute the SPRS score with the DoD Assessment Methodology, manage a\n  compliant POA&M, and ready the organization for a C3PAO assessment. Use when an\n  organization handles Controlled Unclassified Information (CUI) under a DoD contract,\n  when a contract carries DFARS clause 252.204-7012\u002F7019\u002F7020\u002F7021, when preparing for\n  or responding to a CMMC assessment, when computing or improving an SPRS score, when\n  building a System Security Plan or POA&M for 800-171, or when scoping which systems\n  are in the CUI boundary. Keywords: CMMC, CMMC Level 2, NIST 800-171, SP 800-171 Rev 2,\n  CUI, FCI, SPRS, DFARS 7012, C3PAO, POA&M, System Security Plan, DoD Assessment\n  Methodology, 110 controls, defense industrial base, DIB, FedRAMP equivalency.\ndomain: cybersecurity\nsubdomain: compliance-governance\ntags:\n- cmmc\n- nist-800-171\n- cui\n- sprs\n- dfars\n- c3pao\n- poam\n- compliance\n- governance\n- defense-industrial-base\nversion: \"1.0\"\nauthor: andrewibrah\nlicense: Apache-2.0\nnist_csf:\n- GV.OC-03\n- GV.SC-01\n- ID.AM-08\n- ID.RA-05\n- PR.AA-01\n- PR.DS-01\nmitre_attack:\n- T1078\n- T1190\n- T1041\n- T1048\n- T1567\n---\n\n# Achieving CMMC Level 2 Compliance\n\n## When to Use\n\n- When an organization in the **Defense Industrial Base (DIB)** stores, processes, or transmits **Controlled Unclassified Information (CUI)** under a DoD contract.\n- When a contract includes **DFARS 252.204-7012** (safeguarding\u002Fincident reporting), **-7019\u002F-7020** (NIST 800-171 self-assessment + SPRS), or the new **-7021** (CMMC requirement).\n- When preparing for a **C3PAO** third-party assessment or a DoD-led assessment.\n- When you must **compute, post, or improve an SPRS score** based on the NIST SP 800-171 DoD Assessment Methodology.\n- When authoring or remediating a **System Security Plan (SSP)** and **POA&M** for the 110 requirements.\n- When **scoping** which assets fall inside the CUI\u002FFCI boundary (CUI assets, security-protection assets, contractor risk-managed assets, out-of-scope).\n\n## Prerequisites\n\n- Knowledge of **which contracts carry CUI** and the CUI categories involved (check the contract and the DoD CUI Registry).\n- An asset inventory and network diagram so you can define the **CMMC assessment scope** before assessing controls.\n- The **NIST SP 800-171 Rev 2** requirements and the **DoD Assessment Methodology** scoring weights.\n- A documented **SSP** (its absence is itself a failed requirement — 3.12.4).\n- Identification of any **External Service Providers (ESPs)** \u002F cloud services touching CUI, and whether they meet **FedRAMP Moderate (or equivalency)**.\n\n## Workflow\n\n### 1. Determine applicability and CUI categories\nConfirm the contract requires CMMC Level 2 (CUI present, not just FCI). FCI-only contracts are **Level 1** (the 15 FAR 52.204-21 requirements). Identify CUI categories from the contract and the DoD CUI Registry.\n\n### 2. Scope the environment\nClassify every asset into one of the CMMC scoping categories:\n- **CUI Assets** — process\u002Fstore\u002Ftransmit CUI (in scope, assessed against all applicable controls).\n- **Security Protection Assets** — provide security to the CUI environment (in scope).\n- **Contractor Risk Managed Assets** — could but are not intended to handle CUI; managed by policy.\n- **Specialized Assets** (IoT\u002FOT, GFE, test equipment) — documented, limited assessment.\n- **Out-of-Scope** — physically\u002Flogically isolated from CUI.\n\nMinimize scope deliberately — a smaller, well-segmented CUI enclave is far cheaper to certify than a flat network.\n\n### 3. Implement the 110 requirements (NIST SP 800-171 Rev 2)\nWork the **14 families** (3.1–3.14). For each requirement, implement, then write the **how** in the SSP. High-leverage early wins: MFA (3.5.3), FIPS-validated cryptography (3.13.11), audit logging (3.3.x), access control + least privilege (3.1.x), and incident response (3.6.x).\n\n### 4. Score with the DoD Assessment Methodology (SPRS)\nStart at **110** and subtract the weighted value (**1, 3, or 5 points**) of each **unmet** requirement; partial credit applies to a small number of controls (e.g., MFA, FIPS crypto). The result is the **SPRS score** (maximum 110; the methodology floor is −203). Post the score, the SSP date, and the assessment scope to **SPRS** (or eMASS for higher assessments).\n\n### 5. Build a compliant POA&M\nDocument every unmet requirement with owner, remediation, and milestone. **Constraints under the CMMC rule:** a **Conditional** status requires a score of at least **80%** (≥ 88 of 110), only **POA&M-eligible** requirements may be deferred (the highest-weighted security requirements must be fully met — verify eligibility against 32 CFR Part 170), and all POA&M items must be **closed within 180 days** to convert Conditional → **Final**.\n\n### 6. Assess (self or C3PAO)\n- **Level 1** and a subset of Level 2 = annual **self-assessment** with an affirmation in SPRS.\n- **Level 2 (most CUI contracts)** = triennial **C3PAO** certification assessment.\n- **Level 3** = DoD (DIBCAC) assessment on top of Level 2, adding SP 800-172 enhanced requirements.\nAssessors evaluate each objective as **MET \u002F NOT MET \u002F N\u002FA** with evidence (examine\u002Finterview\u002Ftest). A senior official files the **annual affirmation** of continued compliance.\n\n### 7. Maintain certification\nCertification is valid **three years** with **annual affirmations**. Maintain the SSP, re-score on change, keep evidence current, and feed significant changes back into the assessment.\n\n## Key Concepts\n\n| Concept | Definition |\n|---|---|\n| FCI | Federal Contract Information — Level 1 protects it (FAR 52.204-21). |\n| CUI | Controlled Unclassified Information — Level 2 protects it (NIST 800-171). |\n| 110 requirements | The SP 800-171 Rev 2 security requirements across 14 families. |\n| SPRS | Supplier Performance Risk System — where the 800-171 score is posted. |\n| DoD Assessment Methodology | The 1\u002F3\u002F5-point weighting used to compute the score from 110. |\n| C3PAO | CMMC Third-Party Assessment Organization — performs Level 2 certification. |\n| POA&M | Plan of Action & Milestones — limited, must close in 180 days for Final status. |\n| Conditional vs Final | Conditional = open POA&M (score ≥ 80%); Final = all controls met. |\n| ESP | External Service Provider — must meet FedRAMP Moderate \u002F equivalency for CUI. |\n| Scoping categories | CUI \u002F Security Protection \u002F Contractor Risk Managed \u002F Specialized \u002F Out-of-Scope. |\n\n## Tools & Systems\n\n- **NIST SP 800-171 Rev 2** — the 110 requirements (and 800-171A for assessment objectives).\n- **DoD NIST SP 800-171 Assessment Methodology** — the scoring weights.\n- **32 CFR Part 170** (CMMC Program rule) and **48 CFR \u002F DFARS 252.204-7021** (acquisition rule).\n- **SPRS** — score posting; **SAM.gov** for registration.\n- **SP 800-172 \u002F 800-172A** — enhanced requirements for Level 3.\n- **GRC \u002F compliance tooling** — to manage the SSP, POA&M, and evidence (e.g., Xacta, RegScale, FutureFeed-style trackers).\n\n## Common Scenarios\n\n- **Prime flows CUI to a sub.** The sub needs its own Level 2 scope, SSP, SPRS score, and (most likely) C3PAO certification.\n- **Score is below 88.** Prioritize the highest-weighted unmet requirements (5-point, then 3-point) to clear the conditional threshold and shrink the POA&M.\n- **Cloud holds CUI.** Confirm the service is FedRAMP Moderate authorized or meets equivalency; document the responsibility split.\n- **Flat network.** Re-scope into a segmented CUI enclave to cut the assessment surface before spending on controls.\n- **Annual affirmation due.** A senior official affirms continued compliance in SPRS; let it lapse and you risk contract eligibility.\n\n## Output Format\n\nProduce a **CMMC Level 2 Readiness Report** using `assets\u002Ftemplate.md`, containing:\n\n1. **Applicability & CUI categories** — why Level 2 applies.\n2. **Scope** — assets by scoping category and the CUI boundary diagram reference.\n3. **Control status by family** — met \u002F not met \u002F N\u002FA across the 14 families.\n4. **SPRS score** — computed score, deductions, and the gap to 110 and to the 88 threshold.\n5. **POA&M** — unmet requirements, eligibility check, owners, 180-day milestones.\n6. **Assessment path** — self vs C3PAO, target date, affirmation owner.\n7. **Remediation roadmap** — sequenced by point value and effort.\n\nUse `scripts\u002Fprocess.py` to compute the SPRS score from a control-status JSON, flag POA&M-eligibility concerns, and report the gap to the conditional-certification threshold.\n","# Achieving CMMC Level 2 Compliance\n\n## When to Use\n\n- When an organization in the **Defense Industrial Base (DIB)** stores, processes, or transmits **Controlled Unclassified Information (CUI)** under a DoD contract.\n- When a contract includes **DFARS 252.204-7012** (safeguarding\u002Fincident reporting), **-7019\u002F-7020** (NIST 800-171 self-assessment + SPRS), or the new **-7021** (CMMC requirement).\n- When preparing for a **C3PAO** third-party assessment or a DoD-led assessment.\n- When you must **compute, post, or improve an SPRS score** based on the NIST SP 800-171 DoD Assessment Methodology.\n- When authoring or remediating a **System Security Plan (SSP)** and **POA&M** for the 110 requirements.\n- When **scoping** which assets fall inside the CUI\u002FFCI boundary (CUI assets, security-protection assets, contractor risk-managed assets, out-of-scope).\n\n## Prerequisites\n\n- Knowledge of **which contracts carry CUI** and the CUI categories involved (check the contract and the DoD CUI Registry).\n- An asset inventory and network diagram so you can define the **CMMC assessment scope** before assessing controls.\n- The **NIST SP 800-171 Rev 2** requirements and the **DoD Assessment Methodology** scoring weights.\n- A documented **SSP** (its absence is itself a failed requirement — 3.12.4).\n- Identification of any **External Service Providers (ESPs)** \u002F cloud services touching CUI, and whether they meet **FedRAMP Moderate (or equivalency)**.\n\n## Workflow\n\n### 1. Determine applicability and CUI categories\nConfirm the contract requires CMMC Level 2 (CUI present, not just FCI). FCI-only contracts are **Level 1** (the 15 FAR 52.204-21 requirements). Identify CUI categories from the contract and the DoD CUI Registry.\n\n### 2. Scope the environment\nClassify every asset into one of the CMMC scoping categories:\n- **CUI Assets** — process\u002Fstore\u002Ftransmit CUI (in scope, assessed against all applicable controls).\n- **Security Protection Assets** — provide security to the CUI environment (in scope).\n- **Contractor Risk Managed Assets** — could but are not intended to handle CUI; managed by policy.\n- **Specialized Assets** (IoT\u002FOT, GFE, test equipment) — documented, limited assessment.\n- **Out-of-Scope** — physically\u002Flogically isolated from CUI.\n\nMinimize scope deliberately — a smaller, well-segmented CUI enclave is far cheaper to certify than a flat network.\n\n### 3. Implement the 110 requirements (NIST SP 800-171 Rev 2)\nWork the **14 families** (3.1–3.14). For each requirement, implement, then write the **how** in the SSP. High-leverage early wins: MFA (3.5.3), FIPS-validated cryptography (3.13.11), audit logging (3.3.x), access control + least privilege (3.1.x), and incident response (3.6.x).\n\n### 4. Score with the DoD Assessment Methodology (SPRS)\nStart at **110** and subtract the weighted value (**1, 3, or 5 points**) of each **unmet** requirement; partial credit applies to a small number of controls (e.g., MFA, FIPS crypto). The result is the **SPRS score** (maximum 110; the methodology floor is −203). Post the score, the SSP date, and the assessment scope to **SPRS** (or eMASS for higher assessments).\n\n### 5. Build a compliant POA&M\nDocument every unmet requirement with owner, remediation, and milestone. **Constraints under the CMMC rule:** a **Conditional** status requires a score of at least **80%** (≥ 88 of 110), only **POA&M-eligible** requirements may be deferred (the highest-weighted security requirements must be fully met — verify eligibility against 32 CFR Part 170), and all POA&M items must be **closed within 180 days** to convert Conditional → **Final**.\n\n### 6. Assess (self or C3PAO)\n- **Level 1** and a subset of Level 2 = annual **self-assessment** with an affirmation in SPRS.\n- **Level 2 (most CUI contracts)** = triennial **C3PAO** certification assessment.\n- **Level 3** = DoD (DIBCAC) assessment on top of Level 2, adding SP 800-172 enhanced requirements.\nAssessors evaluate each objective as **MET \u002F NOT MET \u002F N\u002FA** with evidence (examine\u002Finterview\u002Ftest). A senior official files the **annual affirmation** of continued compliance.\n\n### 7. Maintain certification\nCertification is valid **three years** with **annual affirmations**. Maintain the SSP, re-score on change, keep evidence current, and feed significant changes back into the assessment.\n\n## Key Concepts\n\n| Concept | Definition |\n|---|---|\n| FCI | Federal Contract Information — Level 1 protects it (FAR 52.204-21). |\n| CUI | Controlled Unclassified Information — Level 2 protects it (NIST 800-171). |\n| 110 requirements | The SP 800-171 Rev 2 security requirements across 14 families. |\n| SPRS | Supplier Performance Risk System — where the 800-171 score is posted. |\n| DoD Assessment Methodology | The 1\u002F3\u002F5-point weighting used to compute the score from 110. |\n| C3PAO | CMMC Third-Party Assessment Organization — performs Level 2 certification. |\n| POA&M | Plan of Action & Milestones — limited, must close in 180 days for Final status. |\n| Conditional vs Final | Conditional = open POA&M (score ≥ 80%); Final = all controls met. |\n| ESP | External Service Provider — must meet FedRAMP Moderate \u002F equivalency for CUI. |\n| Scoping categories | CUI \u002F Security Protection \u002F Contractor Risk Managed \u002F Specialized \u002F Out-of-Scope. |\n\n## Tools & Systems\n\n- **NIST SP 800-171 Rev 2** — the 110 requirements (and 800-171A for assessment objectives).\n- **DoD NIST SP 800-171 Assessment Methodology** — the scoring weights.\n- **32 CFR Part 170** (CMMC Program rule) and **48 CFR \u002F DFARS 252.204-7021** (acquisition rule).\n- **SPRS** — score posting; **SAM.gov** for registration.\n- **SP 800-172 \u002F 800-172A** — enhanced requirements for Level 3.\n- **GRC \u002F compliance tooling** — to manage the SSP, POA&M, and evidence (e.g., Xacta, RegScale, FutureFeed-style trackers).\n\n## Common Scenarios\n\n- **Prime flows CUI to a sub.** The sub needs its own Level 2 scope, SSP, SPRS score, and (most likely) C3PAO certification.\n- **Score is below 88.** Prioritize the highest-weighted unmet requirements (5-point, then 3-point) to clear the conditional threshold and shrink the POA&M.\n- **Cloud holds CUI.** Confirm the service is FedRAMP Moderate authorized or meets equivalency; document the responsibility split.\n- **Flat network.** Re-scope into a segmented CUI enclave to cut the assessment surface before spending on controls.\n- **Annual affirmation due.** A senior official affirms continued compliance in SPRS; let it lapse and you risk contract eligibility.\n\n## Output Format\n\nProduce a **CMMC Level 2 Readiness Report** using `assets\u002Ftemplate.md`, containing:\n\n1. **Applicability & CUI categories** — why Level 2 applies.\n2. **Scope** — assets by scoping category and the CUI boundary diagram reference.\n3. **Control status by family** — met \u002F not met \u002F N\u002FA across the 14 families.\n4. **SPRS score** — computed score, deductions, and the gap to 110 and to the 88 threshold.\n5. **POA&M** — unmet requirements, eligibility check, owners, 180-day milestones.\n6. **Assessment path** — self vs C3PAO, target date, affirmation owner.\n7. **Remediation roadmap** — sequenced by point value and effort.\n\nUse `scripts\u002Fprocess.py` to compute the SPRS score from a control-status JSON, flag POA&M-eligibility concerns, and report the gap to the conditional-certification threshold.\n",{"name":5,"tags":46,"author":47,"domain":40,"license":15,"version":48,"nist_csf":49,"subdomain":56,"description":7,"mitre_attack":57},[34,25,32,31,30,29,28,27,37,26],"andrewibrah","1.0",[50,51,52,53,54,55],"GV.OC-03","GV.SC-01","ID.AM-08","ID.RA-05","PR.AA-01","PR.DS-01","compliance-governance",[58,59,60,61,62],"T1078","T1190","T1041","T1048","T1567","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fachieving-cmmc-level-2-compliance",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":85},[75,78,81],{"tool":76,"command":77},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill achieving-cmmc-level-2-compliance",{"tool":79,"command":80},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill achieving-cmmc-level-2-compliance",{"tool":82,"command":83},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill achieving-cmmc-level-2-compliance","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fachieving-cmmc-level-2-compliance\u002FSKILL.md",true,[87,93,98,104],{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"assets\u002Ftemplate.md","ASSET","资产文件",3801,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fachieving-cmmc-level-2-compliance\u002Fassets\u002Ftemplate.md",{"path":94,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fachieving-cmmc-level-2-compliance\u002FLICENSE",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"references\u002Fstandards.md","REFERENCE","参考文档",4882,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fachieving-cmmc-level-2-compliance\u002Freferences\u002Fstandards.md",{"path":105,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"scripts\u002Fprocess.py","SCRIPT","脚本",7774,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fachieving-cmmc-level-2-compliance\u002Fscripts\u002Fprocess.py",[111,140,164,191,217,244],{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":122,"publishedAt":41},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[117],{"categoryNo":118,"categoryName":119,"taxonomyType":120,"taxonomyTypeDesc":121},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[123,124,125,126,33,40,127,128,36,129,130,131,132,133,134,135,136,137,138,139],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":147,"publishedAt":41},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[146],{"categoryNo":118,"categoryName":119,"taxonomyType":120,"taxonomyTypeDesc":121},[148,136,149,150,33,151,40,36,152,153,154,155,156,157,158,159,160,161,162,163],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":174,"publishedAt":41},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[170,173],{"categoryNo":171,"categoryName":172,"taxonomyType":120,"taxonomyTypeDesc":121},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":118,"categoryName":119,"taxonomyType":120,"taxonomyTypeDesc":121},[158,175,176,177,178,40,179,180,152,27,181,182,183,184,185,186,187,188,189,190],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":192,"name":193,"nameZh":6,"description":194,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":195,"categories":196,"keywords":198,"publishedAt":41},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[197],{"categoryNo":118,"categoryName":119,"taxonomyType":120,"taxonomyTypeDesc":121},[199,200,201,40,202,203,204,205,206,207,208,209,210,211,212,213,155,214,215,216],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":218,"name":219,"nameZh":6,"description":220,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":221,"categories":222,"keywords":224,"publishedAt":41},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[223],{"categoryNo":118,"categoryName":119,"taxonomyType":120,"taxonomyTypeDesc":121},[225,226,227,40,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":245,"name":246,"nameZh":6,"description":247,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":248,"categories":249,"keywords":251,"publishedAt":41},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[250],{"categoryNo":118,"categoryName":119,"taxonomyType":120,"taxonomyTypeDesc":121},[33,252,40,253,254,255,256,257,258,259,260,186,261,187,262,263,264,265,266,267],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]