.

compliance/frameworks/iso27001-compliance/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: iso27001-compliance
+description: Implement ISO 27001 Information Security Management System. Configure ISMS controls and risk management. Use when implementing enterprise security frameworks.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# ISO 27001 Compliance
+
+Implement ISO 27001 Information Security Management System.
+
+## ISMS Framework
+
+```yaml
+plan_do_check_act:
+  plan:
+    - Define scope
+    - Risk assessment
+    - Risk treatment plan
+    - Statement of Applicability
+    
+  do:
+    - Implement controls
+    - Security awareness
+    - Document procedures
+    
+  check:
+    - Internal audits
+    - Management review
+    - Performance measurement
+    
+  act:
+    - Corrective actions
+    - Continual improvement
+```
+
+## Annex A Controls
+
+```yaml
+control_domains:
+  A.5: Information security policies
+  A.6: Organization of information security
+  A.7: Human resource security
+  A.8: Asset management
+  A.9: Access control
+  A.10: Cryptography
+  A.11: Physical security
+  A.12: Operations security
+  A.13: Communications security
+  A.14: System acquisition/development
+  A.15: Supplier relationships
+  A.16: Incident management
+  A.17: Business continuity
+  A.18: Compliance
+```
+
+## Risk Assessment
+
+```yaml
+risk_assessment:
+  identify:
+    - Asset inventory
+    - Threat identification
+    - Vulnerability assessment
+    
+  analyze:
+    - Likelihood rating
+    - Impact rating
+    - Risk calculation
+    
+  evaluate:
+    - Risk acceptance criteria
+    - Prioritization
+    - Treatment options
+```
+
+## Best Practices
+
+- Management commitment
+- Risk-based approach
+- Document everything
+- Regular internal audits
+- Continuous improvement