williamzujkowski/Security Assessment Orchestrator

Purpose & When-To-Use

Primary trigger conditions:

• Pre-production security review required across all layers (app + infra + cloud)
• Compliance audit preparation (NIST CSF 2.0, ISO 27001, SOC 2, FedRAMP)
• Post-incident comprehensive security assessment
• Quarterly security posture review (enterprise practice)
• M&A due diligence security evaluation
• Board/executive request for unified security metrics
• Third-party security questionnaire requiring holistic assessment

When NOT to use this skill:

• Single-domain security check (use specific security- skill directly)
• Real-time vulnerability scanning (use SAST/DAST/SCA tools)
• Penetration testing (requires manual testing, not framework assessment)
• Code-level security review (use security-appsec-validator alone)

Value proposition: Provides unified security posture across 10 security domains, correlates findings to identify attack paths, and prioritizes remediation based on CVSS 4.0 + business context. Organizations using comprehensive security orchestration reduce MTTD (Mean Time To Detect) by 62% and MTTR (Mean Time To Respond) by 74% compared to siloed assessments (IBM Security 2025).

Pre-Checks

Required inputs validation:

python
NOW_ET = "2025-10-26T16:45:00-04:00"

assert assessment_scope in ["application", "infrastructure", "cloud", "full-stack"], "Valid scopes required"
assert target_environment in ["dev", "staging", "production", "all"], "Valid environment required"
assert compliance_requirements in ["nist-csf", "cis", "owasp", "fedramp", "none"]
assert depth_level in ["quick-scan", "standard", "comprehensive"], "Valid depth required"

# Business context validation
if business_context.get("internet_facing") and target_environment == "production":
    warn("Internet-facing production asset: elevating scan depth to comprehensive")

# Scope validation
required_skills = map_scope_to_skills(assessment_scope)
if len(required_skills) > 5 and depth_level == "comprehensive":
    estimate_duration = len(required_skills) * 15  # minutes per skill at T2
    warn(f"Comprehensive scan will invoke {len(required_skills)} skills, ~{estimate_duration} minutes")

Authority checks:

• Read access to target environments (no write/deploy permissions required)
• API/CLI credentials for cloud providers (AWS, Azure, GCP) if cloud scope
• Source code repository access if application scope
• Network scan permissions if infrastructure scope

Source citations (accessed 2025-10-26T16:45:00-04:00):

• NIST CSF 2.0 (CSWP 29): https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
• CVSS v4.0 Specification: https://www.first.org/cvss/v4.0/specification-document
• NIST CSF Assessment Guide: https://securecontrolsframework.com/blog/nist-csf-20-assessment-guide/
• IBM Security X-Force Threat Intelligence Index 2025: Organizations using unified security reduce MTTD by 62%, MTTR by 74%

Procedure

Tier 1 (≤2k tokens): Quick Security Scan

Goal: Identify critical security risks across all domains in <15 minutes.

Steps:

1. Map scope to skills (determine which security- skills to invoke)

• application → security-appsec-validator
• infrastructure → security-network-validator, security-os-validator
• cloud → security-cloud-analyzer, security-iam-reviewer
• full-stack → all 10 security- skills

1. Invoke skills in parallel (T1 tier for each)

• Set check_level: critical-only for all delegated skills
• Collect findings with CVSS ≥7.0 (High/Critical severity only)
• Timeout: 90 seconds per skill invocation

1. Aggregate critical findings

• Deduplicate cross-skill findings (e.g., same IAM issue found by cloud + zerotrust skills)
• Sort by CVSS score descending
• Group by NIST CSF function (Identify, Protect, Detect, Respond, Recover, Govern)

1. Quick risk scoring

• Calculate Critical Risk Index (CRI): (count_critical × 10) + (count_high × 5)
• If CRI >50 → immediate action required
• If CRI 20-50 → standard remediation timeline (30 days)
• If CRI <20 → low priority (90 days)

1. Output quick wins (top 3 highest-impact remediations)

• Example: "Public S3 bucket with PII exposed (CVSS 9.8) → add bucket policy denying public access"
• Example: "Overpermissive IAM role with admin access (CVSS 8.1) → apply principle of least privilege"
• Example: "Unpatched OS vulnerability (CVE-2024-1234, CVSS 7.5) → apply security patch"

Token budget checkpoint: ~1.8k tokens for skill orchestration, aggregation, risk scoring, output formatting.

Tier 2 (≤6k tokens): Comprehensive Security Assessment

Goal: Generate detailed security posture report with NIST CSF 2.0 alignment and prioritized remediation roadmap.

Extends T1 with:

1. Invoke all in-scope skills at T2 depth

• Set check_level: standard for delegated skills
• Collect all findings (CVSS ≥4.0, Medium/High/Critical)
• Enable compliance checks where applicable (CIS Benchmarks, OWASP Top 10, etc.)

Skill invocation matrix:

| Domain | Skill | NIST CSF Functions | Compliance | |--------|-------|-------------------|------------| | Application | security-appsec-validator | Protect (PR.AC, PR.DS) | OWASP Top 10, API Top 10 | | Cloud | security-cloud-analyzer | Identify (ID.AM), Protect (PR.AC) | CIS Benchmarks, Well-Architected | | Container | security-container-validator | Protect (PR.IP) | CIS Docker/K8s | | Cryptography | security-crypto-validator | Protect (PR.DS) | FIPS 140-2 | | IAM | security-iam-reviewer | Protect (PR.AC) | CIS IAM | | Network | security-network-validator | Protect (PR.PT), Detect (DE.CM) | CIS Network | | OS | security-os-validator | Protect (PR.IP) | CIS OS Benchmarks | | Supply Chain | security-supplychain-validator | Identify (ID.SC), Govern (GV.SC) | NIST SSDF, SLSA | | Zero Trust | security-zerotrust-architect | Govern (GV.PO), Protect (PR.AC) | NIST SP 800-207 | | Zero Trust Assess | security-zerotrust-assessor | Identify (ID.RA) | CISA ZT Maturity |

1. Cross-domain finding correlation

• Identify attack paths: chain findings across domains
• Example: "Overpermissive IAM role (security-iam-reviewer) + public S3 bucket (security-cloud-analyzer) + weak encryption (security-crypto-validator) = complete data breach path"
• Calculate attack path exploitability: multiply individual CVSS scores by 0.8 (cumulative risk)
• Flag correlated findings with attack_path_id for tracking

1. NIST CSF 2.0 coverage analysis

• Map findings to CSF Categories and Subcategories
• Calculate function coverage (% of subcategories assessed vs total)
• Generate coverage report:

Govern (GV): 85% coverage (17/20 subcategories) Identify (ID): 90% coverage (27/30 subcategories) Protect (PR): 78% coverage (39/50 subcategories) Detect (DE): 65% coverage (26/40 subcategories) Respond (RS): 45% coverage (18/40 subcategories) ← low coverage, gap Recover (RC): 30% coverage (9/30 subcategories) ← low coverage, gap

1. Security maturity assessment

• Evaluate maturity per NIST CSF function using SCF scoring (Conforms, Significant Deficiency, Material Weakness)
• Assign maturity level (0-10 scale):
• Crawl (0-3): Ad-hoc, reactive, significant gaps
• Walk (4-6): Defined processes, some automation, moderate gaps
• Run (7-10): Optimized, automated, continuous improvement, minimal gaps
• Calculate overall security maturity score: weighted average across 6 functions
• Govern: 20% weight (highest priority in CSF 2.0)
• Identify: 15%
• Protect: 25% (largest function)
• Detect: 15%
• Respond: 15%
• Recover: 10%

1. Contextual risk scoring (CVSS 4.0 + business factors)

• Base CVSS score from vulnerability databases
• Business criticality multiplier (1.0-2.0):
• Mission-critical production asset: 2.0x
• Production asset: 1.5x
• Non-production: 1.0x
• Exploit intelligence modifier (+0.5 to +2.0):
• Active exploits in the wild: +2.0
• PoC exploit available: +1.0
• Theoretical exploit: +0.5
• Data sensitivity modifier (+0.5 to +1.5):
• PII/PHI/financial data: +1.5
• Confidential business data: +1.0
• Public data: +0.5
• Internet exposure modifier (+1.0 if internet-facing)

Final risk score formula: Risk Score = (CVSS × Business Multiplier) + Exploit Modifier + Data Modifier + Exposure Modifier

1. Prioritized remediation roadmap

• Rank findings by ROI (risk reduction / effort):
• Effort scale: Low (1 hour), Medium (1 day), High (1 week), Very High (1 month+)
• ROI = Final Risk Score / Effort Hours
• Group remediation into phases:
• Phase 1 (0-30 days): Critical (CVSS ≥9.0) + High-ROI (ROI >5)
• Phase 2 (31-90 days): High (CVSS 7.0-8.9) + Medium-ROI (ROI 2-5)
• Phase 3 (91-180 days): Medium (CVSS 4.0-6.9) + Low-ROI (ROI <2)
• Accepted Risk: Low (CVSS <4.0) or business justification for deferral
• Assign ownership (AppSec, CloudOps, NetOps, DevOps, Platform) per finding domain

1. Generate comprehensive report

• Executive summary: Overall maturity score, CRI, top 5 risks, estimated remediation timeline
• Detailed findings: Per-domain breakdown with CVSS scores, attack paths, remediation steps
• NIST CSF compliance: Function coverage, maturity scores, gap analysis
• Remediation roadmap: Phased timeline, ownership assignments, effort estimates

Authority sources (accessed 2025-10-26T16:45:00-04:00):

• NIST CSF 2.0 Functions and Categories: https://www.nist.gov/cyberframework/framework
• CVSS v4.0 Base Metrics: https://www.first.org/cvss/v4.0/specification-document
• Secure Controls Framework (SCF) Maturity Model: https://securecontrolsframework.com/
• IBM X-Force 2025: 280,000+ CVEs in NVD, 32% YoY increase in vulnerability submissions

Output: JSON report with sections: executive_summary, findings_by_domain, nist_csf_coverage, security_maturity_assessment, attack_paths, prioritized_roadmap.

Token budget checkpoint: ~5.5k tokens (includes T1 + comprehensive skill orchestration + detailed analysis).

T3: Enterprise Security Governance (≤12k tokens)

Goal: Deep governance alignment, continuous monitoring strategy, and board-level security metrics for organizations with >$100M revenue or regulatory requirements.

Extends T2 with:

1. Continuous monitoring strategy

• Map findings to automated detection rules (SIEM, CSPM, CNAPP)
• Recommend security tool stack (SAST, DAST, SCA, CSPM, CNAPP, EDR, SIEM)
• Define SLA targets per severity: Critical (4h), High (24h), Medium (7d), Low (30d)

1. Regulatory compliance mapping

• Cross-reference findings with specific compliance controls:
• SOC 2 Trust Service Criteria (CC, A, PI, C, P)
• ISO 27001:2022 Annex A controls
• FedRAMP High baseline (NIST SP 800-53 Rev 5)
• PCI-DSS 4.0 requirements
• Generate compliance gap report with remediation-to-compliance mapping

1. Board-level security metrics

• Cyber Risk Quantification (CRQ): Dollar value of risk exposure (ALE = ARO × SLE)
• Security ROI: Cost of remediation vs cost of breach (based on industry breach costs)
• Trend analysis: Compare current vs previous assessment (quarterly tracking)
• Benchmark comparison: Compare maturity vs industry peers (anonymized data)

1. Third-party risk assessment

• Extend assessment to supply chain dependencies (npm, PyPI, Maven, container images)
• Evaluate vendor security questionnaires against NIST CSF alignment
• Recommend vendor security SLA requirements

1. Incident response readiness

• Evaluate Respond (RS) and Recover (RC) function maturity
• Validate incident response plan (IRP) against NIST CSF subcategories
• Recommend tabletop exercise scenarios based on identified attack paths

Authority sources (accessed 2025-10-26T16:45:00-04:00):

• NIST SP 800-61 Rev 3 (Incident Response): https://csrc.nist.gov/pubs/sp/800/61/r3/final
• Cyber Risk Quantification (Factor Analysis): https://www.fairinstitute.org/
• IBM Cost of a Data Breach 2025: Average breach cost $4.88M (+10% from 2024)

Output: Full enterprise security governance package including CRQ analysis, compliance mapping, board metrics, continuous monitoring blueprint, and incident response readiness assessment.

Token budget checkpoint: ~11k tokens (includes T1 + T2 + enterprise-grade governance analysis).

Decision Rules

When to abort:

• No access to target environment → insufficient permissions; emit access requirement checklist
• <3 security skills applicable to scope → use specific security- skill directly, not orchestrator
• Contradictory compliance requirements (e.g., "FedRAMP High + no budget for controls") → document conflicts, request prioritization

Ambiguity thresholds:

• Maturity scoring: If <50% CSF subcategory coverage → report "Insufficient Coverage" instead of maturity score
• Attack path correlation: Only correlate findings if exploitability chain probability >30% (avoid false positives)
• Risk prioritization: If business context missing → use CVSS base score only (no multipliers) and flag as "incomplete risk assessment"

Prioritization logic:

1. Severity-first: Critical (CVSS ≥9.0) always ranked highest, regardless of ROI
2. ROI-based: Within same severity tier, rank by ROI (risk reduction / effort)
3. Compliance-driven: If compliance requirement specified, elevate findings mapped to that framework
4. Internet-facing: Public-facing production assets get +2 priority boost

NIST CSF principle application (accessed 2025-10-26T16:45:00-04:00):

Per NIST CSF 2.0 (https://www.nist.gov/cyberframework):

• "Govern first": Prioritize Govern (GV) function findings, as they cascade to all other functions
• "Continuous improvement": Track maturity scores over time (quarterly assessments recommended)
• "Risk-informed": All recommendations incorporate risk tolerance and business impact

Output Contract

Schema (JSON):

json
{
  "assessment_metadata": {
    "timestamp": "2025-10-26T16:45:00-04:00",
    "scope": "full-stack",
    "environment": "production",
    "depth": "comprehensive",
    "skills_invoked": 10
  },
  "executive_summary": {
    "overall_maturity_score": 6.2,
    "critical_risk_index": 47,
    "total_findings": 142,
    "breakdown": {
      "critical": 3,
      "high": 18,
      "medium": 67,
      "low": 54
    },
    "top_5_risks": [
      {
        "finding_id": "IAM-001",
        "title": "Overpermissive admin role attached to 50+ users",
        "cvss": 8.8,
        "risk_score": 15.8,
        "domain": "iam"
      }
    ],
    "estimated_remediation_timeline": "90 days for all Critical+High findings"
  },
  "findings_by_domain": [
    {
      "domain": "application",
      "skill": "security-appsec-validator",
      "findings_count": 28,
      "findings": [
        {
          "id": "APP-001",
          "title": "SQL injection vulnerability in /api/users endpoint",
          "severity": "critical",
          "cvss": 9.8,
          "risk_score": 19.3,
          "owasp_category": "A03:2021 - Injection",
          "remediation": "Use parameterized queries, ORM with escaping",
          "effort": "medium",
          "owner": "appsec-team"
        }
      ]
    }
  ],
  "nist_csf_coverage": {
    "govern": {"coverage_pct": 85, "maturity_score": 7.2},
    "identify": {"coverage_pct": 90, "maturity_score": 6.8},
    "protect": {"coverage_pct": 78, "maturity_score": 6.1},
    "detect": {"coverage_pct": 65, "maturity_score": 5.5},
    "respond": {"coverage_pct": 45, "maturity_score": 4.2},
    "recover": {"coverage_pct": 30, "maturity_score": 3.8}
  },
  "attack_paths": [
    {
      "path_id": "AP-001",
      "description": "Public S3 bucket → overpermissive IAM → PII data exfiltration",
      "exploitability": "high",
      "combined_risk_score": 17.6,
      "findings": ["CLOUD-012", "IAM-001", "CRYPTO-005"]
    }
  ],
  "prioritized_roadmap": [
    {
      "phase": "Phase 1 (0-30 days)",
      "findings_count": 21,
      "estimated_effort": "120 hours",
      "risk_reduction": 68.5,
      "items": [
        {
          "finding_id": "APP-001",
          "priority": 1,
          "action": "Remediate SQL injection vulnerabilities",
          "owner": "appsec-team",
          "effort": "medium",
          "roi": 12.3
        }
      ]
    }
  ]
}

Required fields: assessment_metadata, executive_summary (with maturity_score, CRI, total_findings), nist_csf_coverage, prioritized_roadmap.

Optional fields: attack_paths (only if correlations found), findings_by_domain (can be filtered by severity).

Examples

yaml
# Example: Full-stack security assessment for production SaaS application
input:
  assessment_scope: full-stack
  target_environment: production
  compliance_requirements: nist-csf
  business_context:
    asset_criticality: mission-critical
    data_sensitivity: pii-phi
    internet_facing: true
  depth_level: comprehensive

output:
  overall_maturity: 6.2 (Walk tier)
  critical_risk_index: 47 (immediate action)
  findings: 142 total (3 critical, 18 high, 67 medium, 54 low)
  top_risks:
    1. SQL injection (CVSS 9.8, risk_score 19.3)
    2. Overpermissive IAM (CVSS 8.8, risk_score 15.8)
    3. Public S3 bucket with PII (CVSS 8.6, risk_score 15.2)
  attack_paths:
    - Public S3 → IAM escalation → PII exfiltration (risk 17.6)
  roadmap:
    Phase 1 (0-30d): 21 items, 120h effort, 68.5 risk reduction
    Phase 2 (31-90d): 45 items, 280h effort, 24.3 risk reduction
    Phase 3 (91-180d): 76 items, 450h effort, 7.2 risk reduction

Quality Gates

Token budgets (enforced):

• T1: ≤2,000 tokens - quick security scan with critical findings only (CVSS ≥7.0)
• T2: ≤6,000 tokens - comprehensive assessment with NIST CSF alignment, maturity scoring, attack path analysis, and prioritized roadmap
• T3: ≤12,000 tokens - enterprise governance with CRQ, compliance mapping, board metrics, continuous monitoring, and incident response readiness

Accuracy requirements:

• CVSS scores must match official NVD/vendor advisories (no estimation)
• Maturity scores validated against NIST CSF 2.0 subcategory criteria
• Attack path correlations verified for logical exploitability chain

Safety constraints:

• Read-only assessment: No modification of production systems, configurations, or data
• Secure finding storage: Encrypt findings at rest, restrict access to security team + executives
• Audit trail: Log all skill invocations with timestamps, scopes, and results

Auditability:

• Cite specific NIST CSF subcategories for each finding
• Document maturity scoring methodology (SCF criteria used)
• Include timestamps and data sources for all CVSS scores

Determinism:

• Same inputs + same environment state → same findings and scores
• Configurable thresholds (CRI limits, maturity boundaries, ROI minimums)

Resources

Official NIST CSF 2.0 documentation:

• NIST Cybersecurity Framework 2.0: https://www.nist.gov/cyberframework
• CSWP 29 (CSF 2.0 Specification): https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
• CSF 2.0 Assessment Resources: https://www.nist.gov/cyberframework/assessment-auditing-resources

Risk scoring and vulnerability management:

• CVSS v4.0 Specification: https://www.first.org/cvss/v4.0/specification-document
• CVSS v4.0 Calculator: https://www.first.org/cvss/calculator/4.0
• NVD (National Vulnerability Database): https://nvd.nist.gov/

Security frameworks and standards:

• CIS Benchmarks: https://www.cisecurity.org/cis-benchmarks
• OWASP Top 10 2021: https://owasp.org/www-project-top-ten/
• OWASP API Security Top 10: https://owasp.org/API-Security/
• NIST SP 800-207 (Zero Trust Architecture): https://csrc.nist.gov/pubs/sp/800/207/final

Compliance and governance:

• Secure Controls Framework (SCF): https://securecontrolsframework.com/
• FedRAMP Baselines: https://www.fedramp.gov/baselines/
• SOC 2 Trust Service Criteria: https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2

Industry research:

• IBM Cost of a Data Breach Report 2025: https://www.ibm.com/security/data-breach
• Verizon Data Breach Investigations Report 2025: https://www.verizon.com/business/resources/reports/dbir/

Related skills:

This meta-skill orchestrates the following specialist skills:

• security-appsec-validator: Application security (OWASP Top 10)
• security-cloud-analyzer: Cloud security posture (AWS, Azure, GCP)
• security-container-validator: Container and Kubernetes security
• security-crypto-validator: Cryptography and encryption validation
• security-iam-reviewer: Identity and access management review
• security-network-validator: Network security and segmentation
• security-os-validator: Operating system hardening
• security-supplychain-validator: Software supply chain security
• security-zerotrust-architect: Zero trust architecture design
• security-zerotrust-assessor: Zero trust maturity assessment

Complementary skills:

• compliance-oscal-validator: OSCAL-formatted compliance validation
• compliance-fedramp-validator: FedRAMP-specific compliance
• compliance-automation-engine: Automated compliance monitoring