[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF8RBK7A9DPPY2JGTFVW39":3,"skill-same:01M6AF8RBK7A9DPPY2JGTFVW39":110},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":48,"linkOnly":49,"markdownContent":50,"markdownBody":51,"frontMatter":52,"refName":69,"commitSha":70,"skillDirectory":71,"forksCount":72,"repositoryHtmlUrl":73,"repositoryHomepageUrl":74,"ownerHtmlUrl":75,"ownerBlogUrl":76,"ownerDescription":77,"updatedAt":78,"install":79,"resources":92},"01M6AF8RBK7A9DPPY2JGTFVW39","implementing-nerc-cip-compliance-controls",null,"Implements NERC CIP controls for Bulk Electric System (BES) cyber systems: asset categorization (CIP-002), electronic security perimeters (CIP-005), system security management (CIP-007), configuration management (CIP-010), and supply chain risk (CIP-013), including 2025 MFA updates. Use when a registered entity must achieve or maintain NERC CIP compliance, prepare for a Regional Entity audit, or categorize newly commissioned BES cyber systems.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35884,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-nerc-cip-compliance-controls\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47],"implementing nerc cip compliance controls","compliance","scada","power-grid","nerc-cip","t1195","risk","t1059","t1078","iec62443","industrial-control","security","ics","ot-security","mfa","audit","pr","prepare","cybersecurity","2026-11-10 10:12:30",false,"---\nname: implementing-nerc-cip-compliance-controls\ndescription: 'Implements NERC CIP controls for Bulk Electric System (BES) cyber systems: asset\n  categorization (CIP-002), electronic security perimeters (CIP-005), system security\n  management (CIP-007), configuration management (CIP-010), and supply chain risk\n  (CIP-013), including 2025 MFA updates. Use when a registered entity must achieve\n  or maintain NERC CIP compliance, prepare for a Regional Entity audit, or categorize\n  newly commissioned BES cyber systems.\n\n  '\ndomain: cybersecurity\nsubdomain: ot-ics-security\ntags:\n- ot-security\n- ics\n- scada\n- industrial-control\n- iec62443\n- nerc-cip\n- power-grid\n- compliance\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-05\n- GV.OC-02\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T1195\n- T1554\n---\n\n# Implementing NERC CIP Compliance Controls\n\n## When to Use\n\n- When a registered entity must achieve or maintain NERC CIP compliance for BES cyber systems\n- When preparing for a NERC CIP compliance audit by the Regional Entity\n- When implementing the 2025 CIP standard updates (CIP-003-9, CIP-005-7, CIP-010-4, CIP-013-2)\n- When categorizing BES cyber systems after commissioning new generation, transmission, or control center assets\n- When developing a compliance monitoring and evidence collection program\n\n**Do not use** for non-BES industrial systems (see implementing-iec-62443-security-zones), for general IT compliance frameworks (see auditing-cloud-with-cis-benchmarks), or for physical security of substations without cyber components.\n\n## Prerequisites\n\n- Understanding of NERC CIP standards (CIP-002 through CIP-014)\n- BES cyber system inventory with impact ratings (high, medium, low)\n- Access to Electronic Security Perimeter (ESP) network diagrams and firewall configurations\n- Compliance management system for evidence collection and audit documentation\n- Familiarity with NERC Glossary of Terms (BES Cyber Asset, BES Cyber System, Electronic Access Point)\n\n## Workflow\n\n### Step 1: Categorize BES Cyber Systems (CIP-002-5.1a)\n\nIdentify and categorize all BES cyber systems based on their impact to the reliable operation of the Bulk Electric System.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"NERC CIP BES Cyber System Categorization Tool.\n\nImplements CIP-002-5.1a categorization criteria to classify\nBES cyber systems as high, medium, or low impact.\n\"\"\"\n\nimport json\nimport sys\nfrom dataclasses import dataclass, field, asdict\nfrom datetime import datetime\n\n\n@dataclass\nclass BESCyberSystem:\n    \"\"\"Represents a BES Cyber System for CIP-002 categorization.\"\"\"\n    system_id: str\n    name: str\n    description: str\n    location: str\n    asset_type: str  # control_center, generation, transmission, distribution\n    connected_mw: float = 0\n    transmission_kv: float = 0\n    is_control_center: bool = False\n    is_backup_control_center: bool = False\n    has_cranking_path: bool = False\n    has_blackstart: bool = False\n    is_sps_ras: bool = False  # Special Protection System \u002F Remedial Action Scheme\n    impact_rating: str = \"\"  # high, medium, low\n    categorization_basis: str = \"\"\n    cyber_assets: list = field(default_factory=list)\n\n\nclass CIP002Categorizer:\n    \"\"\"NERC CIP-002-5.1a BES Cyber System categorization engine.\"\"\"\n\n    def __init__(self):\n        self.systems = []\n        self.categorization_date = datetime.now().isoformat()\n\n    def add_system(self, system: BESCyberSystem):\n        self.systems.append(system)\n\n    def categorize_all(self):\n        \"\"\"Apply CIP-002 Attachment 1 criteria to all systems.\"\"\"\n        for system in self.systems:\n            self._categorize_system(system)\n\n    def _categorize_system(self, sys):\n        \"\"\"Apply high, medium, low impact criteria per CIP-002 Attachment 1.\"\"\"\n\n        # HIGH IMPACT criteria (CIP-002 Attachment 1, Criterion 1)\n        if sys.is_control_center and sys.asset_type == \"control_center\":\n            # Control Centers that perform the functional obligations\n            # of a Reliability Coordinator, Balancing Authority, or TOP\n            sys.impact_rating = \"high\"\n            sys.categorization_basis = (\n                \"CIP-002 Att.1 Criterion 1.1: Control Center performing \"\n                \"RC\u002FBA\u002FTOP functional obligations\"\n            )\n            return\n\n        if sys.is_backup_control_center and sys.asset_type == \"control_center\":\n            sys.impact_rating = \"high\"\n            sys.categorization_basis = (\n                \"CIP-002 Att.1 Criterion 1.2: Backup Control Center performing \"\n                \"RC\u002FBA\u002FTOP functional obligations\"\n            )\n            return\n\n        if sys.connected_mw >= 3000:\n            sys.impact_rating = \"high\"\n            sys.categorization_basis = (\n                f\"CIP-002 Att.1 Criterion 1.3: Generation >= 3000 MW \"\n                f\"(actual: {sys.connected_mw} MW)\"\n            )\n            return\n\n        # MEDIUM IMPACT criteria (CIP-002 Attachment 1, Criterion 2)\n        if sys.connected_mw >= 1500 and sys.asset_type == \"generation\":\n            sys.impact_rating = \"medium\"\n            sys.categorization_basis = (\n                f\"CIP-002 Att.1 Criterion 2.1: Generation >= 1500 MW \"\n                f\"(actual: {sys.connected_mw} MW)\"\n            )\n            return\n\n        if sys.transmission_kv >= 500:\n            sys.impact_rating = \"medium\"\n            sys.categorization_basis = (\n                f\"CIP-002 Att.1 Criterion 2.5: Transmission >= 500 kV \"\n                f\"(actual: {sys.transmission_kv} kV)\"\n            )\n            return\n\n        if sys.has_cranking_path:\n            sys.impact_rating = \"medium\"\n            sys.categorization_basis = (\n                \"CIP-002 Att.1 Criterion 2.6: Cranking path element\"\n            )\n            return\n\n        if sys.has_blackstart:\n            sys.impact_rating = \"medium\"\n            sys.categorization_basis = (\n                \"CIP-002 Att.1 Criterion 2.7: Blackstart resource\"\n            )\n            return\n\n        if sys.is_sps_ras:\n            sys.impact_rating = \"medium\"\n            sys.categorization_basis = (\n                \"CIP-002 Att.1 Criterion 2.9: SPS\u002FRAS component\"\n            )\n            return\n\n        if sys.is_control_center and sys.asset_type == \"generation\":\n            sys.impact_rating = \"medium\"\n            sys.categorization_basis = (\n                \"CIP-002 Att.1 Criterion 2.11: Generation control center \"\n                \"for medium impact generation\"\n            )\n            return\n\n        # LOW IMPACT - all other BES Cyber Systems\n        sys.impact_rating = \"low\"\n        sys.categorization_basis = (\n            \"CIP-002 Att.1 Criterion 3: BES Cyber System not meeting \"\n            \"high or medium impact criteria\"\n        )\n\n    def generate_report(self):\n        \"\"\"Generate CIP-002 categorization report.\"\"\"\n        high = [s for s in self.systems if s.impact_rating == \"high\"]\n        medium = [s for s in self.systems if s.impact_rating == \"medium\"]\n        low = [s for s in self.systems if s.impact_rating == \"low\"]\n\n        report = []\n        report.append(\"=\" * 70)\n        report.append(\"NERC CIP-002-5.1a BES CYBER SYSTEM CATEGORIZATION\")\n        report.append(f\"Date: {self.categorization_date}\")\n        report.append(\"=\" * 70)\n        report.append(f\"\\nTotal BES Cyber Systems: {len(self.systems)}\")\n        report.append(f\"  High Impact: {len(high)}\")\n        report.append(f\"  Medium Impact: {len(medium)}\")\n        report.append(f\"  Low Impact: {len(low)}\")\n\n        for category, systems in [(\"HIGH\", high), (\"MEDIUM\", medium), (\"LOW\", low)]:\n            if systems:\n                report.append(f\"\\n--- {category} IMPACT SYSTEMS ---\")\n                for s in systems:\n                    report.append(f\"  [{s.system_id}] {s.name}\")\n                    report.append(f\"    Location: {s.location}\")\n                    report.append(f\"    Type: {s.asset_type}\")\n                    report.append(f\"    Basis: {s.categorization_basis}\")\n                    report.append(f\"    Cyber Assets: {len(s.cyber_assets)}\")\n\n        return \"\\n\".join(report)\n\n    def export_json(self, output_file):\n        \"\"\"Export categorization to JSON for compliance evidence.\"\"\"\n        data = {\n            \"categorization_date\": self.categorization_date,\n            \"standard\": \"CIP-002-5.1a\",\n            \"systems\": [asdict(s) for s in self.systems],\n        }\n        with open(output_file, \"w\") as f:\n            json.dump(data, f, indent=2)\n\n\nif __name__ == \"__main__\":\n    categorizer = CIP002Categorizer()\n\n    # Example BES Cyber Systems\n    categorizer.add_system(BESCyberSystem(\n        system_id=\"BCS-001\", name=\"Main Energy Control Center EMS\",\n        description=\"Energy Management System for BA operations\",\n        location=\"Control Center Alpha\", asset_type=\"control_center\",\n        is_control_center=True))\n\n    categorizer.add_system(BESCyberSystem(\n        system_id=\"BCS-002\", name=\"Wind Farm SCADA\",\n        description=\"SCADA for 500MW wind generation facility\",\n        location=\"Wind Farm Delta\", asset_type=\"generation\",\n        connected_mw=500))\n\n    categorizer.add_system(BESCyberSystem(\n        system_id=\"BCS-003\", name=\"Substation Alpha RTU\",\n        description=\"345kV transmission substation\",\n        location=\"Substation Alpha\", asset_type=\"transmission\",\n        transmission_kv=345))\n\n    categorizer.categorize_all()\n    print(categorizer.generate_report())\n```\n\n### Step 2: Implement Electronic Security Perimeters (CIP-005-7)\n\nDefine and enforce Electronic Security Perimeters (ESP) around high and medium impact BES cyber systems with Electronic Access Points (EAP) at all boundary crossing points.\n\n```bash\n# Electronic Security Perimeter - Firewall Configuration\n# CIP-005-7 R1: Electronic Security Perimeter\n\n# Define ESP boundary for Control Center EMS (High Impact)\n# All BES Cyber Assets within the ESP boundary\n\n# Palo Alto PA-3260 - ESP Boundary Firewall\n\n# Inbound rules - strictly limit what enters the ESP\n# CIP-005-7 R1.3: All inbound\u002Foutbound access permissions documented\n\n# Allow ICCP (Inter-Control Center Communications Protocol) from neighbor BA\nset rulebase security rules ICCP-Inbound from Corporate-Zone to ESP-Zone\nset rulebase security rules ICCP-Inbound source 192.168.100.10\nset rulebase security rules ICCP-Inbound destination 10.20.1.50\nset rulebase security rules ICCP-Inbound application iccp\nset rulebase security rules ICCP-Inbound service application-default\nset rulebase security rules ICCP-Inbound action allow\nset rulebase security rules ICCP-Inbound log-setting CIP-Audit-Log\n\n# Allow NTP for time synchronization (CIP-007 R5.7)\nset rulebase security rules NTP-Inbound from Corporate-Zone to ESP-Zone\nset rulebase security rules NTP-Inbound source 192.168.100.1\nset rulebase security rules NTP-Inbound destination 10.20.1.1\nset rulebase security rules NTP-Inbound application ntp\nset rulebase security rules NTP-Inbound action allow\n\n# CIP-005-7 R2: Remote Access Management\n# Require Intermediate System for all remote access sessions\n# CIP-005-7 R2.4: Multi-factor authentication required (2025 update)\n\nset rulebase security rules RemoteAccess from External to DMZ-Zone\nset rulebase security rules RemoteAccess destination 172.16.1.10\nset rulebase security rules RemoteAccess application ssl-vpn\nset rulebase security rules RemoteAccess action allow\n# MFA enforced on Intermediate System (jump server)\n\n# Default deny all other traffic\nset rulebase security rules ESP-Default-Deny from any to ESP-Zone\nset rulebase security rules ESP-Default-Deny action deny\nset rulebase security rules ESP-Default-Deny log-setting CIP-Audit-Log\n```\n\n### Step 3: Implement System Security Management (CIP-007-6)\n\nConfigure security controls for BES cyber assets including port management, security patching, malicious code prevention, and security event monitoring.\n\n```yaml\n# CIP-007-6 Implementation Checklist\n\ncip_007_controls:\n  R1_ports_services:\n    description: \"Ports and Services Management\"\n    requirements:\n      - \"Disable or restrict all unnecessary physical ports (USB, serial)\"\n      - \"Disable all unnecessary logical ports and services\"\n      - \"Document all enabled ports\u002Fservices with business justification\"\n    implementation:\n      windows_servers: |\n        # Disable unnecessary services on Windows BES Cyber Assets\n        Set-Service -Name \"RemoteRegistry\" -StartupType Disabled\n        Set-Service -Name \"WinRM\" -StartupType Disabled\n        Set-Service -Name \"Spooler\" -StartupType Disabled\n        # Disable USB storage via Group Policy\n        # Computer Config > Admin Templates > System > Removable Storage Access\n      linux_servers: |\n        # Disable unnecessary services\n        systemctl disable cups bluetooth avahi-daemon\n        systemctl mask cups bluetooth avahi-daemon\n        # Disable USB storage\n        echo \"blacklist usb-storage\" > \u002Fetc\u002Fmodprobe.d\u002Fdisable-usb.conf\n\n  R2_security_patches:\n    description: \"Security Patch Management\"\n    requirements:\n      - \"Track security patches for all BES Cyber Systems\"\n      - \"Evaluate patches within 35 days of availability\"\n      - \"Apply patches or document mitigation plan\"\n      - \"Test patches in non-production before deployment\"\n    implementation:\n      tracking: \"Use WSUS\u002FSCCM for Windows; yum\u002Fdnf for Linux\"\n      testing: \"Maintain staging environment mirroring production\"\n      evidence: \"Document patch evaluation in compliance tracking system\"\n\n  R3_malicious_code:\n    description: \"Malicious Code Prevention\"\n    requirements:\n      - \"Deploy anti-malware on all applicable BES Cyber Assets\"\n      - \"Update signatures or use application allowlisting\"\n      - \"Mitigate threats from transient cyber assets\"\n    implementation:\n      servers: \"CrowdFalcon or Carbon Black with OT-optimized policy\"\n      hmi_stations: \"Application allowlisting (Carbon Black App Control)\"\n      transient_devices: \"Scan all removable media before connection to BCA\"\n\n  R4_security_event_monitoring:\n    description: \"Security Event Monitoring\"\n    requirements:\n      - \"Log security events on all high\u002Fmedium impact BCS\"\n      - \"Generate alerts for detected security events\"\n      - \"Retain logs for minimum 90 days (CIP-007-6 R4.3)\"\n      - \"Review logs at minimum every 15 days\"\n    implementation:\n      siem: \"Splunk Enterprise Security with CIP content pack\"\n      log_sources:\n        - \"ESP boundary firewall logs\"\n        - \"EAP authentication logs\"\n        - \"BES Cyber Asset authentication success\u002Ffailure\"\n        - \"Remote access session logs\"\n        - \"Malicious code detection events\"\n      retention: \"90 days online, 3 years archived\"\n\n  R5_system_access:\n    description: \"System Access Control\"\n    requirements:\n      - \"Enforce authentication for all interactive access\"\n      - \"Implement least-privilege access control\"\n      - \"Change default passwords\"\n      - \"Enforce password complexity (CIP-007-6 R5.5)\"\n      - \"Limit unsuccessful login attempts\"\n    implementation:\n      password_policy:\n        min_length: 8\n        complexity: \"Mixed case + numbers + special characters\"\n        max_age_days: 365\n        lockout_threshold: 5\n        lockout_duration_minutes: 30\n      shared_accounts: \"Document all shared\u002Fservice accounts with authorization\"\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| BES Cyber System | Group of one or more BES Cyber Assets that perform a reliability function for the Bulk Electric System |\n| Electronic Security Perimeter (ESP) | Logical border surrounding a network containing BES Cyber Systems, with all traffic flowing through Electronic Access Points |\n| Electronic Access Point (EAP) | Interface on the ESP boundary that controls traffic flowing in and out of the ESP |\n| Intermediate System | System used for remote access that prevents direct connectivity to BES Cyber Assets (jump server) |\n| Transient Cyber Asset | Device that is directly connected to a BES Cyber System for less than 30 consecutive calendar days (laptops, USB drives) |\n| NERC Glossary | Official definitions used in CIP standards; precise terminology required for compliance |\n\n## Tools & Systems\n\n- **Tripwire Enterprise**: Configuration compliance monitoring and file integrity monitoring for CIP-010 baseline management\n- **Splunk with CIP Content Pack**: SIEM with pre-built CIP-007 security event monitoring dashboards and alerts\n- **Carbon Black App Control**: Application allowlisting for HMI stations and BES cyber assets (CIP-007 R3)\n- **Trellix\u002FMcAfee ePO**: Endpoint protection with OT-optimized scanning policies for BES cyber assets\n\n## Output Format\n\n```\nNERC CIP Compliance Assessment Report\n=======================================\nEntity: [Registered Entity Name]\nDate: YYYY-MM-DD\nStandards: CIP-002 through CIP-014\n\nBES CYBER SYSTEM CATEGORIZATION:\n  High Impact: [N] systems\n  Medium Impact: [N] systems\n  Low Impact: [N] systems\n\nCOMPLIANCE STATUS BY STANDARD:\n  CIP-002: [Compliant\u002FPartial\u002FNon-Compliant]\n  CIP-005: [Status] - [N] gaps identified\n  CIP-007: [Status] - [N] gaps identified\n  CIP-010: [Status] - [N] gaps identified\n  CIP-013: [Status] - [N] gaps identified\n```\n","# Implementing NERC CIP Compliance Controls\n\n## When to Use\n\n- When a registered entity must achieve or maintain NERC CIP compliance for BES cyber systems\n- When preparing for a NERC CIP compliance audit by the Regional Entity\n- When implementing the 2025 CIP standard updates (CIP-003-9, CIP-005-7, CIP-010-4, CIP-013-2)\n- When categorizing BES cyber systems after commissioning new generation, transmission, or control center assets\n- When developing a compliance monitoring and evidence collection program\n\n**Do not use** for non-BES industrial systems (see implementing-iec-62443-security-zones), for general IT compliance frameworks (see auditing-cloud-with-cis-benchmarks), or for physical security of substations without cyber components.\n\n## Prerequisites\n\n- Understanding of NERC CIP standards (CIP-002 through CIP-014)\n- BES cyber system inventory with impact ratings (high, medium, low)\n- Access to Electronic Security Perimeter (ESP) network diagrams and firewall configurations\n- Compliance management system for evidence collection and audit documentation\n- Familiarity with NERC Glossary of Terms (BES Cyber Asset, BES Cyber System, Electronic Access Point)\n\n## Workflow\n\n### Step 1: Categorize BES Cyber Systems (CIP-002-5.1a)\n\nIdentify and categorize all BES cyber systems based on their impact to the reliable operation of the Bulk Electric System.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"NERC CIP BES Cyber System Categorization Tool.\n\nImplements CIP-002-5.1a categorization criteria to classify\nBES cyber systems as high, medium, or low impact.\n\"\"\"\n\nimport json\nimport sys\nfrom dataclasses import dataclass, field, asdict\nfrom datetime import datetime\n\n\n@dataclass\nclass BESCyberSystem:\n    \"\"\"Represents a BES Cyber System for CIP-002 categorization.\"\"\"\n    system_id: str\n    name: str\n    description: str\n    location: str\n    asset_type: str  # control_center, generation, transmission, distribution\n    connected_mw: float = 0\n    transmission_kv: float = 0\n    is_control_center: bool = False\n    is_backup_control_center: bool = False\n    has_cranking_path: bool = False\n    has_blackstart: bool = False\n    is_sps_ras: bool = False  # Special Protection System \u002F Remedial Action Scheme\n    impact_rating: str = \"\"  # high, medium, low\n    categorization_basis: str = \"\"\n    cyber_assets: list = field(default_factory=list)\n\n\nclass CIP002Categorizer:\n    \"\"\"NERC CIP-002-5.1a BES Cyber System categorization engine.\"\"\"\n\n    def __init__(self):\n        self.systems = []\n        self.categorization_date = datetime.now().isoformat()\n\n    def add_system(self, system: BESCyberSystem):\n        self.systems.append(system)\n\n    def categorize_all(self):\n        \"\"\"Apply CIP-002 Attachment 1 criteria to all systems.\"\"\"\n        for system in self.systems:\n            self._categorize_system(system)\n\n    def _categorize_system(self, sys):\n        \"\"\"Apply high, medium, low impact criteria per CIP-002 Attachment 1.\"\"\"\n\n        # HIGH IMPACT criteria (CIP-002 Attachment 1, Criterion 1)\n        if sys.is_control_center and sys.asset_type == \"control_center\":\n            # Control Centers that perform the functional obligations\n            # of a Reliability Coordinator, Balancing Authority, or TOP\n            sys.impact_rating = \"high\"\n            sys.categorization_basis = (\n                \"CIP-002 Att.1 Criterion 1.1: Control Center performing \"\n                \"RC\u002FBA\u002FTOP functional obligations\"\n            )\n            return\n\n        if sys.is_backup_control_center and sys.asset_type == \"control_center\":\n            sys.impact_rating = \"high\"\n            sys.categorization_basis = (\n                \"CIP-002 Att.1 Criterion 1.2: Backup Control Center performing \"\n                \"RC\u002FBA\u002FTOP functional obligations\"\n            )\n            return\n\n        if sys.connected_mw >= 3000:\n            sys.impact_rating = \"high\"\n            sys.categorization_basis = (\n                f\"CIP-002 Att.1 Criterion 1.3: Generation >= 3000 MW \"\n                f\"(actual: {sys.connected_mw} MW)\"\n            )\n            return\n\n        # MEDIUM IMPACT criteria (CIP-002 Attachment 1, Criterion 2)\n        if sys.connected_mw >= 1500 and sys.asset_type == \"generation\":\n            sys.impact_rating = \"medium\"\n            sys.categorization_basis = (\n                f\"CIP-002 Att.1 Criterion 2.1: Generation >= 1500 MW \"\n                f\"(actual: {sys.connected_mw} MW)\"\n            )\n            return\n\n        if sys.transmission_kv >= 500:\n            sys.impact_rating = \"medium\"\n            sys.categorization_basis = (\n                f\"CIP-002 Att.1 Criterion 2.5: Transmission >= 500 kV \"\n                f\"(actual: {sys.transmission_kv} kV)\"\n            )\n            return\n\n        if sys.has_cranking_path:\n            sys.impact_rating = \"medium\"\n            sys.categorization_basis = (\n                \"CIP-002 Att.1 Criterion 2.6: Cranking path element\"\n            )\n            return\n\n        if sys.has_blackstart:\n            sys.impact_rating = \"medium\"\n            sys.categorization_basis = (\n                \"CIP-002 Att.1 Criterion 2.7: Blackstart resource\"\n            )\n            return\n\n        if sys.is_sps_ras:\n            sys.impact_rating = \"medium\"\n            sys.categorization_basis = (\n                \"CIP-002 Att.1 Criterion 2.9: SPS\u002FRAS component\"\n            )\n            return\n\n        if sys.is_control_center and sys.asset_type == \"generation\":\n            sys.impact_rating = \"medium\"\n            sys.categorization_basis = (\n                \"CIP-002 Att.1 Criterion 2.11: Generation control center \"\n                \"for medium impact generation\"\n            )\n            return\n\n        # LOW IMPACT - all other BES Cyber Systems\n        sys.impact_rating = \"low\"\n        sys.categorization_basis = (\n            \"CIP-002 Att.1 Criterion 3: BES Cyber System not meeting \"\n            \"high or medium impact criteria\"\n        )\n\n    def generate_report(self):\n        \"\"\"Generate CIP-002 categorization report.\"\"\"\n        high = [s for s in self.systems if s.impact_rating == \"high\"]\n        medium = [s for s in self.systems if s.impact_rating == \"medium\"]\n        low = [s for s in self.systems if s.impact_rating == \"low\"]\n\n        report = []\n        report.append(\"=\" * 70)\n        report.append(\"NERC CIP-002-5.1a BES CYBER SYSTEM CATEGORIZATION\")\n        report.append(f\"Date: {self.categorization_date}\")\n        report.append(\"=\" * 70)\n        report.append(f\"\\nTotal BES Cyber Systems: {len(self.systems)}\")\n        report.append(f\"  High Impact: {len(high)}\")\n        report.append(f\"  Medium Impact: {len(medium)}\")\n        report.append(f\"  Low Impact: {len(low)}\")\n\n        for category, systems in [(\"HIGH\", high), (\"MEDIUM\", medium), (\"LOW\", low)]:\n            if systems:\n                report.append(f\"\\n--- {category} IMPACT SYSTEMS ---\")\n                for s in systems:\n                    report.append(f\"  [{s.system_id}] {s.name}\")\n                    report.append(f\"    Location: {s.location}\")\n                    report.append(f\"    Type: {s.asset_type}\")\n                    report.append(f\"    Basis: {s.categorization_basis}\")\n                    report.append(f\"    Cyber Assets: {len(s.cyber_assets)}\")\n\n        return \"\\n\".join(report)\n\n    def export_json(self, output_file):\n        \"\"\"Export categorization to JSON for compliance evidence.\"\"\"\n        data = {\n            \"categorization_date\": self.categorization_date,\n            \"standard\": \"CIP-002-5.1a\",\n            \"systems\": [asdict(s) for s in self.systems],\n        }\n        with open(output_file, \"w\") as f:\n            json.dump(data, f, indent=2)\n\n\nif __name__ == \"__main__\":\n    categorizer = CIP002Categorizer()\n\n    # Example BES Cyber Systems\n    categorizer.add_system(BESCyberSystem(\n        system_id=\"BCS-001\", name=\"Main Energy Control Center EMS\",\n        description=\"Energy Management System for BA operations\",\n        location=\"Control Center Alpha\", asset_type=\"control_center\",\n        is_control_center=True))\n\n    categorizer.add_system(BESCyberSystem(\n        system_id=\"BCS-002\", name=\"Wind Farm SCADA\",\n        description=\"SCADA for 500MW wind generation facility\",\n        location=\"Wind Farm Delta\", asset_type=\"generation\",\n        connected_mw=500))\n\n    categorizer.add_system(BESCyberSystem(\n        system_id=\"BCS-003\", name=\"Substation Alpha RTU\",\n        description=\"345kV transmission substation\",\n        location=\"Substation Alpha\", asset_type=\"transmission\",\n        transmission_kv=345))\n\n    categorizer.categorize_all()\n    print(categorizer.generate_report())\n```\n\n### Step 2: Implement Electronic Security Perimeters (CIP-005-7)\n\nDefine and enforce Electronic Security Perimeters (ESP) around high and medium impact BES cyber systems with Electronic Access Points (EAP) at all boundary crossing points.\n\n```bash\n# Electronic Security Perimeter - Firewall Configuration\n# CIP-005-7 R1: Electronic Security Perimeter\n\n# Define ESP boundary for Control Center EMS (High Impact)\n# All BES Cyber Assets within the ESP boundary\n\n# Palo Alto PA-3260 - ESP Boundary Firewall\n\n# Inbound rules - strictly limit what enters the ESP\n# CIP-005-7 R1.3: All inbound\u002Foutbound access permissions documented\n\n# Allow ICCP (Inter-Control Center Communications Protocol) from neighbor BA\nset rulebase security rules ICCP-Inbound from Corporate-Zone to ESP-Zone\nset rulebase security rules ICCP-Inbound source 192.168.100.10\nset rulebase security rules ICCP-Inbound destination 10.20.1.50\nset rulebase security rules ICCP-Inbound application iccp\nset rulebase security rules ICCP-Inbound service application-default\nset rulebase security rules ICCP-Inbound action allow\nset rulebase security rules ICCP-Inbound log-setting CIP-Audit-Log\n\n# Allow NTP for time synchronization (CIP-007 R5.7)\nset rulebase security rules NTP-Inbound from Corporate-Zone to ESP-Zone\nset rulebase security rules NTP-Inbound source 192.168.100.1\nset rulebase security rules NTP-Inbound destination 10.20.1.1\nset rulebase security rules NTP-Inbound application ntp\nset rulebase security rules NTP-Inbound action allow\n\n# CIP-005-7 R2: Remote Access Management\n# Require Intermediate System for all remote access sessions\n# CIP-005-7 R2.4: Multi-factor authentication required (2025 update)\n\nset rulebase security rules RemoteAccess from External to DMZ-Zone\nset rulebase security rules RemoteAccess destination 172.16.1.10\nset rulebase security rules RemoteAccess application ssl-vpn\nset rulebase security rules RemoteAccess action allow\n# MFA enforced on Intermediate System (jump server)\n\n# Default deny all other traffic\nset rulebase security rules ESP-Default-Deny from any to ESP-Zone\nset rulebase security rules ESP-Default-Deny action deny\nset rulebase security rules ESP-Default-Deny log-setting CIP-Audit-Log\n```\n\n### Step 3: Implement System Security Management (CIP-007-6)\n\nConfigure security controls for BES cyber assets including port management, security patching, malicious code prevention, and security event monitoring.\n\n```yaml\n# CIP-007-6 Implementation Checklist\n\ncip_007_controls:\n  R1_ports_services:\n    description: \"Ports and Services Management\"\n    requirements:\n      - \"Disable or restrict all unnecessary physical ports (USB, serial)\"\n      - \"Disable all unnecessary logical ports and services\"\n      - \"Document all enabled ports\u002Fservices with business justification\"\n    implementation:\n      windows_servers: |\n        # Disable unnecessary services on Windows BES Cyber Assets\n        Set-Service -Name \"RemoteRegistry\" -StartupType Disabled\n        Set-Service -Name \"WinRM\" -StartupType Disabled\n        Set-Service -Name \"Spooler\" -StartupType Disabled\n        # Disable USB storage via Group Policy\n        # Computer Config > Admin Templates > System > Removable Storage Access\n      linux_servers: |\n        # Disable unnecessary services\n        systemctl disable cups bluetooth avahi-daemon\n        systemctl mask cups bluetooth avahi-daemon\n        # Disable USB storage\n        echo \"blacklist usb-storage\" > \u002Fetc\u002Fmodprobe.d\u002Fdisable-usb.conf\n\n  R2_security_patches:\n    description: \"Security Patch Management\"\n    requirements:\n      - \"Track security patches for all BES Cyber Systems\"\n      - \"Evaluate patches within 35 days of availability\"\n      - \"Apply patches or document mitigation plan\"\n      - \"Test patches in non-production before deployment\"\n    implementation:\n      tracking: \"Use WSUS\u002FSCCM for Windows; yum\u002Fdnf for Linux\"\n      testing: \"Maintain staging environment mirroring production\"\n      evidence: \"Document patch evaluation in compliance tracking system\"\n\n  R3_malicious_code:\n    description: \"Malicious Code Prevention\"\n    requirements:\n      - \"Deploy anti-malware on all applicable BES Cyber Assets\"\n      - \"Update signatures or use application allowlisting\"\n      - \"Mitigate threats from transient cyber assets\"\n    implementation:\n      servers: \"CrowdFalcon or Carbon Black with OT-optimized policy\"\n      hmi_stations: \"Application allowlisting (Carbon Black App Control)\"\n      transient_devices: \"Scan all removable media before connection to BCA\"\n\n  R4_security_event_monitoring:\n    description: \"Security Event Monitoring\"\n    requirements:\n      - \"Log security events on all high\u002Fmedium impact BCS\"\n      - \"Generate alerts for detected security events\"\n      - \"Retain logs for minimum 90 days (CIP-007-6 R4.3)\"\n      - \"Review logs at minimum every 15 days\"\n    implementation:\n      siem: \"Splunk Enterprise Security with CIP content pack\"\n      log_sources:\n        - \"ESP boundary firewall logs\"\n        - \"EAP authentication logs\"\n        - \"BES Cyber Asset authentication success\u002Ffailure\"\n        - \"Remote access session logs\"\n        - \"Malicious code detection events\"\n      retention: \"90 days online, 3 years archived\"\n\n  R5_system_access:\n    description: \"System Access Control\"\n    requirements:\n      - \"Enforce authentication for all interactive access\"\n      - \"Implement least-privilege access control\"\n      - \"Change default passwords\"\n      - \"Enforce password complexity (CIP-007-6 R5.5)\"\n      - \"Limit unsuccessful login attempts\"\n    implementation:\n      password_policy:\n        min_length: 8\n        complexity: \"Mixed case + numbers + special characters\"\n        max_age_days: 365\n        lockout_threshold: 5\n        lockout_duration_minutes: 30\n      shared_accounts: \"Document all shared\u002Fservice accounts with authorization\"\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| BES Cyber System | Group of one or more BES Cyber Assets that perform a reliability function for the Bulk Electric System |\n| Electronic Security Perimeter (ESP) | Logical border surrounding a network containing BES Cyber Systems, with all traffic flowing through Electronic Access Points |\n| Electronic Access Point (EAP) | Interface on the ESP boundary that controls traffic flowing in and out of the ESP |\n| Intermediate System | System used for remote access that prevents direct connectivity to BES Cyber Assets (jump server) |\n| Transient Cyber Asset | Device that is directly connected to a BES Cyber System for less than 30 consecutive calendar days (laptops, USB drives) |\n| NERC Glossary | Official definitions used in CIP standards; precise terminology required for compliance |\n\n## Tools & Systems\n\n- **Tripwire Enterprise**: Configuration compliance monitoring and file integrity monitoring for CIP-010 baseline management\n- **Splunk with CIP Content Pack**: SIEM with pre-built CIP-007 security event monitoring dashboards and alerts\n- **Carbon Black App Control**: Application allowlisting for HMI stations and BES cyber assets (CIP-007 R3)\n- **Trellix\u002FMcAfee ePO**: Endpoint protection with OT-optimized scanning policies for BES cyber assets\n\n## Output Format\n\n```\nNERC CIP Compliance Assessment Report\n=======================================\nEntity: [Registered Entity Name]\nDate: YYYY-MM-DD\nStandards: CIP-002 through CIP-014\n\nBES CYBER SYSTEM CATEGORIZATION:\n  High Impact: [N] systems\n  Medium Impact: [N] systems\n  Low Impact: [N] systems\n\nCOMPLIANCE STATUS BY STANDARD:\n  CIP-002: [Compliant\u002FPartial\u002FNon-Compliant]\n  CIP-005: [Status] - [N] gaps identified\n  CIP-007: [Status] - [N] gaps identified\n  CIP-010: [Status] - [N] gaps identified\n  CIP-013: [Status] - [N] gaps identified\n```\n",{"name":5,"tags":53,"author":54,"domain":47,"license":15,"version":55,"nist_csf":56,"subdomain":61,"description":62,"mitre_attack":63},[42,41,31,39,38,33,32,30],"mahipal","1.0.0",[57,58,59,60],"PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02","ot-ics-security","Implements NERC CIP controls for Bulk Electric System (BES) cyber systems: asset categorization (CIP-002), electronic security perimeters (CIP-005), system security management (CIP-007), configuration management (CIP-010), and supply chain risk (CIP-013), including 2025 MFA updates. Use when a registered entity must achieve or maintain NERC CIP compliance, prepare for a Regional Entity audit, or categorize newly commissioned BES cyber systems.\n",[64,65,66,67,68],"T1078","T1190","T1059","T1195","T1554","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-nerc-cip-compliance-controls",4379,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":80,"prompt":90,"zipAvailable":91},[81,84,87],{"tool":82,"command":83},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-nerc-cip-compliance-controls",{"tool":85,"command":86},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-nerc-cip-compliance-controls",{"tool":88,"command":89},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-nerc-cip-compliance-controls","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-nerc-cip-compliance-controls\u002FSKILL.md",true,[93,98,104],{"path":94,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-nerc-cip-compliance-controls\u002FLICENSE",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"references\u002Fapi-reference.md","REFERENCE","参考文档",1534,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-nerc-cip-compliance-controls\u002Freferences\u002Fapi-reference.md",{"path":105,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"scripts\u002Fagent.py","SCRIPT","脚本",6654,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-nerc-cip-compliance-controls\u002Fscripts\u002Fagent.py",[111,135,159,185,211,237],{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":118,"publishedAt":48},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[117],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[119,120,121,122,40,47,123,124,45,125,126,127,128,129,130,34,131,132,133,134],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","attestation","code-signing","cosign","keyless",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":142,"publishedAt":48},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[141],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[143,131,144,145,40,146,47,45,147,148,149,150,151,152,153,154,155,156,157,158],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":169,"publishedAt":48},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[165,168],{"categoryNo":166,"categoryName":167,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[153,170,171,172,173,47,174,175,147,30,176,177,178,179,180,37,181,182,183,184],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":192,"publishedAt":48},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[191],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[193,194,195,47,196,197,198,199,200,201,202,203,204,205,206,207,150,208,209,210],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":212,"name":213,"nameZh":6,"description":214,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":215,"categories":216,"keywords":218,"publishedAt":48},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[217],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[219,220,221,47,222,223,224,225,226,227,228,229,230,231,35,232,233,234,235,236],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":238,"name":239,"nameZh":6,"description":240,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":241,"categories":242,"keywords":244,"publishedAt":48},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[243],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[40,245,47,246,247,248,249,250,251,252,253,37,254,181,255,256,257,258,259,260],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]