Skip to content
Get packs

Guide · Agent skill

How to use the ISO 27001 Audit Prep agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

The iso27001-audit-prep skill is an agent skill that makes your AI agent question your information security management system (ISMS) the way an ISO 27001 auditor would. It is for compliance and security staff who already run or are building an ISMS and want a structured readiness check before an internal, surveillance or stage 1 audit. After reading this guide you will know what the skill does, how to install it, how to trigger it with plain requests, and what limits to respect.

ISO 27001 Audit Prepalirezarezvani/claude-skills · MIT

Quick start

  1. 1Get the skill. Download the ZIP from this page.
  2. 2Install it. Unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
  3. 3Install the dependencies. Make sure Python is available and the compliance-os plugin and the ra-qm-team and compliance-os vendor files referenced via CLAUDE_PLUGIN_ROOT are installed.
  4. 4Prepare your evidence. Gather your policies, risk register, access review records, supplier list, incident records and management review minutes.
  5. 5Run the readiness check. Invoke /compliance-os:iso27001-audit-prep with your scope, or ask the agent in plain language for an ISO 27001 audit readiness check.
  6. 6Work the answers. Review the six question results and the verdict, then act on the top three actions.

What is an agent skill, and what does this one do?

An agent skill is a folder containing a SKILL.md file that tells an AI agent how to handle a specific task. When the skill is installed, you can invoke it with a command or ask for the task in natural language, and the agent follows the instructions in that file.

This skill, named iso27001-audit-prep, makes the agent ask six pointed questions about your ISMS. They cover audit scheduling and three-year coverage, risk register freshness, access review records, supplier reviews, incident response evidence, and management review. It is designed to run before an annual Clause 9.2 internal audit, before a surveillance audit, or before stage 1 certification readiness, and also after a material change to scope or following an incident.

  • Question 1: audit scope and rolling 3-year coverage
  • Question 2: risk register refresh and links to Annex A controls
  • Question 3: access review records for the last four quarters
  • Question 4: supplier inventory and review evidence
  • Question 5: incident response evidence and post-incident reviews
  • Question 6: management review cadence and inputs

How do you install the iso27001-audit-prep skill?

Option 1: download the ZIP file from this page and unzip it into your personal skills folder at ~/.claude/skills/, or into a project's .claude/skills/ folder if you want the skill limited to one project.

Option 2: in the Claude apps, open Settings, go to Capabilities, and upload the skill under Skills.

The skill's source file is SKILL.md. The source does not include install commands beyond these steps, so follow the folder locations above.

What do you need before running it?

The skill is written for Claude Code or a compatible agent with the compliance-os plugin installed. It calls Python scripts named isms_audit_scheduler.py, audit_simulator.py and cross_framework_mapper.py, so Python must be available. The workflow also refers to vendor files in the ra-qm-team and compliance-os packages through CLAUDE_PLUGIN_ROOT. Those files are not included in the SKILL.md you download, so the skill will not work fully on its own.

  • Claude Code or a compatible agent with the compliance-os plugin installed
  • Python, to run the referenced scripts
  • The ra-qm-team and compliance-os vendor files, referenced via CLAUDE_PLUGIN_ROOT
  • Your own ISMS evidence, such as Okta or IAM exports, if you want real sample checks

How do you trigger the skill with a natural request?

You can use the command form, which takes an optional scope argument. The source documents this syntax:

  • Ask for an audit readiness check before your annual internal audit, naming the scope (for example, a business unit or product line).
  • Ask the agent to run ISO 27001 forcing questions before a surveillance audit.
  • Ask for a stage 1 certification readiness review of your ISMS.
  • Ask for an ad-hoc ISMS audit after a material change, such as a new SaaS tool or a new business unit.
/compliance-os:iso27001-audit-prep <scope>

What does the output look like?

The skill produces a markdown readiness report. It includes the decision being made, audit programme status, risk register health, status of high-stakes controls (access control, supplier management, incident response and logging), management review status, cross-framework impact on SOC 2, ISO 42001 and GDPR Article 32, and a verdict.

The verdict is one of three values: green (READY), amber (CLOSE-CRITICALS-FIRST) or red (NOT-READY). The report ends with three concrete next steps, each with an owner and a corrective-action timeline.

  • Verdict: READY, CLOSE-CRITICALS-FIRST or NOT-READY
  • Top 3 actions with owner and corrective-action timeline
  • Pass or fail results for each high-stakes control area, with sample evidence

What safety points should you know about?

The skill runs scripts. The listed scripts are Python programmes that the workflow calls on your files, so review them before running them, and only run them from a trusted installation. The skill's stated network use is none. Be deliberate about the evidence you give the agent: the skill asks for real sample records from systems such as Okta or IAM rather than curated packs, which means access exports may contain sensitive personal data. Handle them under your own data protection rules.

The output is a self-assessment. It does not replace an accredited certification body or a qualified auditor, and it cannot guarantee certification or legal compliance.

  • The skill runs Python scripts; review them before use.
  • Stated network use: none.
  • Real access exports can contain personal data; handle them under your own policies.
  • The report is a self-assessment, not a certification or legal opinion.

Tips for getting useful results

The questions assume you already have policies, a risk register and audit records. If those do not exist yet, build them first. Give the agent a clear scope so the programme-plan and sample checks are meaningful. Keep the referenced playbook files installed alongside the skill, because the workflow depends on them.

Run the skill again after fixes. The source recommends quarterly runs during high-growth phases, and after any material change or incident.

  • Set a clear scope in your request.
  • Keep the referenced playbooks and scripts installed next to the skill.
  • Use real evidence exports where you can.
  • Re-run quarterly during fast growth, and after incidents or scope changes.

What people use it for

  • Preparing for an annual Clause 9.2 internal audit by checking whether every clause and applicable Annex A control is on the three-year schedule.
  • Running a gap check before a first stage 1 certification audit for a small team.
  • Checking access review records and deprovisioning evidence for terminated staff before a surveillance audit.
  • Consultants running the same checklist against each client's ISMS evidence to keep results consistent.

Frequently asked questions

Is the ISO 27001 Audit Prep skill free?

The source file is licensed under MIT, which is stated on this page. Check the repository licence file for the full terms before reuse. The source does not state prices for any part of the workflow.

What do I need to install before using this skill?

You need Claude Code or a compatible agent with the compliance-os plugin, Python to run the referenced scripts, and the ra-qm-team and compliance-os vendor files referenced via CLAUDE_PLUGIN_ROOT. The SKILL.md file alone does not include those vendor files.

Where do I put the skill folder?

Unzip the download into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps you can instead upload it under Settings → Capabilities → Skills.

Can this skill certify my ISMS as ISO 27001 compliant?

No. The output is a self-assessment and does not replace an accredited certification body or a qualified auditor. It is a structured readiness check to find gaps before a real audit.

Why won't the skill run properly after I install it?

The most likely cause is missing dependencies. The workflow calls isms_audit_scheduler.py, audit_simulator.py and cross_framework_mapper.py and refers to vendor files via CLAUDE_PLUGIN_ROOT. If those files or Python are missing, the workflow cannot complete.

How does it compare with other compliance checklists?

The skill is aimed at people already running or preparing an ISMS. It asks six sample-driven questions and produces a verdict with three actions. It is not general security advice, and it links to related skills for SOC 2, ISO 42001 and GDPR audit preparation.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Use this skill if you are a compliance or security professional, a small team preparing for a first ISO 27001 certification, or a consultant who wants a repeatable checklist, and you already have policies, risk records and audit evidence. Pick something else if you have no ISMS yet, want general security advice, or cannot install the Python scripts and vendor playbooks it depends on.

Download the skill

Find exactly what
you're looking for