Security Assessment Orchestrator

## Purpose & When-To-Use

**Primary trigger conditions:**

- Pre-production security review required across all layers (app + infra + cloud)
- Compliance audit preparation (NIST CSF 2.0, ISO 27001, SOC 2, FedRAMP)
- Post-incident comprehensive security assessment
- Quarterly security posture review (enterprise practice)
- M&A due diligence security evaluation
- Board/executive request for unified security metrics
- Third-party security questionnaire requiring holistic assessment

**When NOT to use this skill:**

- Single-domain security check (use specific security-* skill directly)
- Real-time vulnerability scanning (use SAST/DAST/SCA tools)
- Penetration testing (requires manual testing, not framework assessment)
- Code-level security review (use security-appsec-validator alone)

**Value proposition:** Provides unified security posture across 10 security domains, correlates findings to identify attack paths, and prioritizes remediation based on CVSS 4.0 + business context. Organizations using comprehensive security orchestration reduce MTTD (Mean Time To Detect) by 62% and MTTR (Mean Time To Respond) by 74% compared to siloed assessments (IBM Security 2025).

## Pre-Checks

**Required inputs validation:**

```python
NOW_ET = "2025-10-26T16:45:00-04:00"

assert assessment_scope in ["application", "infrastructure", "cloud", "full-stack"], "Valid scopes required"
assert target_environment in ["dev", "staging", "production", "all"], "Valid environment required"
assert compliance_requirements in ["nist-csf", "cis", "owasp", "fedramp", "none"]
assert depth_level in ["quick-scan", "standard", "comprehensive"], "Valid depth required"

# Business context validation
if business_context.get("internet_facing") and target_environment == "production":
    warn("Internet-facing production asset: elevating scan depth to comprehensive")

# Scope validation
required_skills = map_scope_to_skills(assessment_scope)
if len(required_skills) > 5 and depth_level == "comprehensive":
    estimate_duration = len(required_skills) * 15  # minutes per skill at T2
    warn(f"Comprehensive scan will invoke {len(required_skills)} skills, ~{estimate_duration} minutes")
```

**Authority checks:**

- Read access to target environments (no write/deploy permissions required)
- API/CLI credentials for cloud providers (AWS, Azure, GCP) if cloud scope
- Source code repository access if application scope
- Network scan permissions if infrastructure scope

**Source citations (accessed 2025-10-26T16:45:00-04:00):**

- NIST CSF 2.0 (CSWP 29): https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
- CVSS v4.0 Specification: https://www.first.org/cvss/v4.0/specification-document
- NIST CSF Assessment Guide: https://securecontrolsframework.com/blog/nist-csf-20-assessment-guide/
- IBM Security X-Force Threat Intelligence Index 2025: Organizations using unified security reduce MTTD by 62%, MTTR by 74%

## Procedure

### Tier 1 (≤2k tokens): Quick Security Scan

**Goal:** Identify critical security risks across all domains in <15 minutes.

**Steps:**

1. **Map scope to skills** (determine which security-* skills to invoke)
   - `application` → security-appsec-validator
   - `infrastructure` → security-network-validator, security-os-validator
   - `cloud` → security-cloud-analyzer, security-iam-reviewer
   - `full-stack` → all 10 security-* skills

2. **Invoke skills in parallel** (T1 tier for each)
   - Set `check_level: critical-only` for all delegated skills
   - Collect findings with CVSS ≥7.0 (High/Critical severity only)
   - Timeout: 90 seconds per skill invocation

3. **Aggregate critical findings**
   - Deduplicate cross-skill findings (e.g., same IAM issue found by cloud + zerotrust skills)
   - Sort by CVSS score descending
   - Group by NIST CSF function (Identify, Protect, Detect, Respond, Recover, Govern)

4. **Quick risk scoring**
   - Calculate **Critical Risk Index (CRI)**: `(count_critical × 10) + (count_high × 5)`
   - If CRI >50 → **immediate action required**
   - If CRI 20-50 → **standard remediation timeline (30 days)**
   - If CRI <20 → **low priority (90 days)**

5. **Output quick wins** (top 3 highest-impact remediations)
   - Example: "Public S3 bucket with PII exposed (CVSS 9.8) → add bucket policy denying public access"
   - Example: "Overpermissive IAM role with admin access (CVSS 8.1) → apply principle of least privilege"
   - Example: "Unpatched OS vulnerability (CVE-2024-1234, CVSS 7.5) → apply security patch"

**Token budget checkpoint:** ~1.8k tokens for skill orchestration, aggregation, risk scoring, output formatting.

### Tier 2 (≤6k tokens): Comprehensive Security Assessment

**Goal:** Generate detailed security posture report with NIST CSF 2.0 alignment and prioritized remediation roadmap.

**Extends T1 with:**

6. **Invoke all in-scope skills at T2 depth**
   - Set `check_level: standard` for delegated skills
   - Collect all findings (CVSS ≥4.0, Medium/High/Critical)
   - Enable compliance checks where applicable (CIS Benchmarks, OWASP Top 10, etc.)

   **Skill invocation matrix:**

   | Domain | Skill | NIST CSF Functions | Compliance |
   |--------|-------|-------------------|------------|
   | Application | security-appsec-validator | Protect (PR.AC, PR.DS) | OWASP Top 10, API Top 10 |
   | Cloud | security-cloud-analyzer | Identify (ID.AM), Protect (PR.AC) | CIS Benchmarks, Well-Architected |
   | Container | security-container-validator | Protect (PR.IP) | CIS Docker/K8s |
   | Cryptography | security-crypto-validator | Protect (PR.DS) | FIPS 140-2 |
   | IAM | security-iam-reviewer | Protect (PR.AC) | CIS IAM |
   | Network | security-network-validator | Protect (PR.PT), Detect (DE.CM) | CIS Network |
   | OS | security-os-validator | Protect (PR.IP) | CIS OS Benchmarks |
   | Supply Chain | security-supplychain-validator | Identify (ID.SC), Govern (GV.SC) | NIST SSDF, SLSA |
   | Zero Trust | security-zerotrust-architect | Govern (GV.PO), Protect (PR.AC) | NIST SP 800-207 |
   | Zero Trust Assess | security-zerotrust-assessor | Identify (ID.RA) | CISA ZT Maturity |

7. **Cross-domain finding correlation**
   - Identify **attack paths**: chain findings across domains
     - Example: "Overpermissive IAM role (security-iam-reviewer) + public S3 bucket (security-cloud-analyzer) + weak encryption (security-crypto-validator) = complete data breach path"
   - Calculate **attack path exploitability**: multiply individual CVSS scores by 0.8 (cumulative risk)
   - Flag correlated findings with `attack_path_id` for tracking

8. **NIST CSF 2.0 coverage analysis**
   - Map findings to CSF Categories and Subcategories
   - Calculate **function coverage** (% of subcategories assessed vs total)
   - Generate coverage report:
     ```
     Govern (GV): 85% coverage (17/20 subcategories)
     Identify (ID): 90% coverage (27/30 subcategories)
     Protect (PR): 78% coverage (39/50 subcategories)
     Detect (DE): 65% coverage (26/40 subcategories)
     Respond (RS): 45% coverage (18/40 subcategories) ← low coverage, gap
     Recover (RC): 30% coverage (9/30 subcategories) ← low coverage, gap
     ```

9. **Security maturity assessment**
   - Evaluate maturity per NIST CSF function using SCF scoring (Conforms, Significant Deficiency, Material Weakness)
   - Assign maturity level (0-10 scale):
     - **Crawl (0-3)**: Ad-hoc, reactive, significant gaps
     - **Walk (4-6)**: Defined processes, some automation, moderate gaps
     - **Run (7-10)**: Optimized, automated, continuous improvement, minimal gaps
   - Calculate **overall security maturity score**: weighted average across 6 functions
     - Govern: 20% weight (highest priority in CSF 2.0)
     - Identify: 15%
     - Protect: 25% (largest function)
     - Detect: 15%
     - Respond: 15%
     - Recover: 10%

10. **Contextual risk scoring** (CVSS 4.0 + business factors)
    - Base CVSS score from vulnerability databases
    - **Business criticality multiplier** (1.0-2.0):
      - Mission-critical production asset: 2.0x
      - Production asset: 1.5x
      - Non-production: 1.0x
    - **Exploit intelligence modifier** (+0.5 to +2.0):
      - Active exploits in the wild: +2.0
      - PoC exploit available: +1.0
      - Theoretical exploit: +0.5
    - **Data sensitivity modifier** (+0.5 to +1.5):
      - PII/PHI/financial data: +1.5
      - Confidential business data: +1.0
      - Public data: +0.5
    - **Internet exposure modifier** (+1.0 if internet-facing)

    **Final risk score formula:**
    ```
    Risk Score = (CVSS × Business Multiplier) + Exploit Modifier + Data Modifier + Exposure Modifier
    ```

11. **Prioritized remediation roadmap**
    - Rank findings by **ROI** (risk reduction / effort):
      - Effort scale: Low (1 hour), Medium (1 day), High (1 week), Very High (1 month+)
      - ROI = `Final Risk Score / Effort Hours`
    - Group remediation into phases:
      - **Phase 1 (0-30 days)**: Critical (CVSS ≥9.0) + High-ROI (ROI >5)
      - **Phase 2 (31-90 days)**: High (CVSS 7.0-8.9) + Medium-ROI (ROI 2-5)
      - **Phase 3 (91-180 days)**: Medium (CVSS 4.0-6.9) + Low-ROI (ROI <2)
      - **Accepted Risk**: Low (CVSS <4.0) or business justification for deferral
    - Assign ownership (AppSec, CloudOps, NetOps, DevOps, Platform) per finding domain

12. **Generate comprehensive report**
    - **Executive summary**: Overall maturity score, CRI, top 5 risks, estimated remediation timeline
    - **Detailed findings**: Per-domain breakdown with CVSS scores, attack paths, remediation steps
    - **NIST CSF compliance**: Function coverage, maturity scores, gap analysis
    - **Remediation roadmap**: Phased timeline, ownership assignments, effort estimates

**Authority sources (accessed 2025-10-26T16:45:00-04:00):**

- NIST CSF 2.0 Functions and Categories: https://www.nist.gov/cyberframework/framework
- CVSS v4.0 Base Metrics: https://www.first.org/cvss/v4.0/specification-document
- Secure Controls Framework (SCF) Maturity Model: https://securecontrolsframework.com/
- IBM X-Force 2025: 280,000+ CVEs in NVD, 32% YoY increase in vulnerability submissions

**Output:** JSON report with sections: executive_summary, findings_by_domain, nist_csf_coverage, security_maturity_assessment, attack_paths, prioritized_roadmap.

**Token budget checkpoint:** ~5.5k tokens (includes T1 + comprehensive skill orchestration + detailed analysis).

### T3: Enterprise Security Governance (≤12k tokens)

**Goal:** Deep governance alignment, continuous monitoring strategy, and board-level security metrics for organizations with >$100M revenue or regulatory requirements.

**Extends T2 with:**

13. **Continuous monitoring strategy**
    - Map findings to automated detection rules (SIEM, CSPM, CNAPP)
    - Recommend security tool stack (SAST, DAST, SCA, CSPM, CNAPP, EDR, SIEM)
    - Define SLA targets per severity: Critical (4h), High (24h), Medium (7d), Low (30d)

14. **Regulatory compliance mapping**
    - Cross-reference findings with specific compliance controls:
      - SOC 2 Trust Service Criteria (CC, A, PI, C, P)
      - ISO 27001:2022 Annex A controls
      - FedRAMP High baseline (NIST SP 800-53 Rev 5)
      - PCI-DSS 4.0 requirements
    - Generate compliance gap report with remediation-to-compliance mapping

15. **Board-level security metrics**
    - **Cyber Risk Quantification (CRQ):** Dollar value of risk exposure (ALE = ARO × SLE)
    - **Security ROI:** Cost of remediation vs cost of breach (based on industry breach costs)
    - **Trend analysis:** Compare current vs previous assessment (quarterly tracking)
    - **Benchmark comparison:** Compare maturity vs industry peers (anonymized data)

16. **Third-party risk assessment**
    - Extend assessment to supply chain dependencies (npm, PyPI, Maven, container images)
    - Evaluate vendor security questionnaires against NIST CSF alignment
    - Recommend vendor security SLA requirements

17. **Incident response readiness**
    - Evaluate Respond (RS) and Recover (RC) function maturity
    - Validate incident response plan (IRP) against NIST CSF subcategories
    - Recommend tabletop exercise scenarios based on identified attack paths

**Authority sources (accessed 2025-10-26T16:45:00-04:00):**

- NIST SP 800-61 Rev 3 (Incident Response): https://csrc.nist.gov/pubs/sp/800/61/r3/final
- Cyber Risk Quantification (Factor Analysis): https://www.fairinstitute.org/
- IBM Cost of a Data Breach 2025: Average breach cost $4.88M (+10% from 2024)

**Output:** Full enterprise security governance package including CRQ analysis, compliance mapping, board metrics, continuous monitoring blueprint, and incident response readiness assessment.

**Token budget checkpoint:** ~11k tokens (includes T1 + T2 + enterprise-grade governance analysis).

## Decision Rules

**When to abort:**

- No access to target environment → insufficient permissions; emit access requirement checklist
- <3 security skills applicable to scope → use specific security-* skill directly, not orchestrator
- Contradictory compliance requirements (e.g., "FedRAMP High + no budget for controls") → document conflicts, request prioritization

**Ambiguity thresholds:**

- **Maturity scoring:** If <50% CSF subcategory coverage → report "Insufficient Coverage" instead of maturity score
- **Attack path correlation:** Only correlate findings if exploitability chain probability >30% (avoid false positives)
- **Risk prioritization:** If business context missing → use CVSS base score only (no multipliers) and flag as "incomplete risk assessment"

**Prioritization logic:**

1. **Severity-first:** Critical (CVSS ≥9.0) always ranked highest, regardless of ROI
2. **ROI-based:** Within same severity tier, rank by ROI (risk reduction / effort)
3. **Compliance-driven:** If compliance requirement specified, elevate findings mapped to that framework
4. **Internet-facing:** Public-facing production assets get +2 priority boost

**NIST CSF principle application (accessed 2025-10-26T16:45:00-04:00):**

Per NIST CSF 2.0 (https://www.nist.gov/cyberframework):

- **"Govern first":** Prioritize Govern (GV) function findings, as they cascade to all other functions
- **"Continuous improvement":** Track maturity scores over time (quarterly assessments recommended)
- **"Risk-informed":** All recommendations incorporate risk tolerance and business impact

## Output Contract

**Schema (JSON):**

```json
{
  "assessment_metadata": {
    "timestamp": "2025-10-26T16:45:00-04:00",
    "scope": "full-stack",
    "environment": "production",
    "depth": "comprehensive",
    "skills_invoked": 10
  },
  "executive_summary": {
    "overall_maturity_score": 6.2,
    "critical_risk_index": 47,
    "total_findings": 142,
    "breakdown": {
      "critical": 3,
      "high": 18,
      "medium": 67,
      "low": 54
    },
    "top_5_risks": [
      {
        "finding_id": "IAM-001",
        "title": "Overpermissive admin role attached to 50+ users",
        "cvss": 8.8,
        "risk_score": 15.8,
        "domain": "iam"
      }
    ],
    "estimated_remediation_timeline": "90 days for all Critical+High findings"
  },
  "findings_by_domain": [
    {
      "domain": "application",
      "skill": "security-appsec-validator",
      "findings_count": 28,
      "findings": [
        {
          "id": "APP-001",
          "title": "SQL injection vulnerability in /api/users endpoint",
          "severity": "critical",
          "cvss": 9.8,
          "risk_score": 19.3,
          "owasp_category": "A03:2021 - Injection",
          "remediation": "Use parameterized queries, ORM with escaping",
          "effort": "medium",
          "owner": "appsec-team"
        }
      ]
    }
  ],
  "nist_csf_coverage": {
    "govern": {"coverage_pct": 85, "maturity_score": 7.2},
    "identify": {"coverage_pct": 90, "maturity_score": 6.8},
    "protect": {"coverage_pct": 78, "maturity_score": 6.1},
    "detect": {"coverage_pct": 65, "maturity_score": 5.5},
    "respond": {"coverage_pct": 45, "maturity_score": 4.2},
    "recover": {"coverage_pct": 30, "maturity_score": 3.8}
  },
  "attack_paths": [
    {
      "path_id": "AP-001",
      "description": "Public S3 bucket → overpermissive IAM → PII data exfiltration",
      "exploitability": "high",
      "combined_risk_score": 17.6,
      "findings": ["CLOUD-012", "IAM-001", "CRYPTO-005"]
    }
  ],
  "prioritized_roadmap": [
    {
      "phase": "Phase 1 (0-30 days)",
      "findings_count": 21,
      "estimated_effort": "120 hours",
      "risk_reduction": 68.5,
      "items": [
        {
          "finding_id": "APP-001",
          "priority": 1,
          "action": "Remediate SQL injection vulnerabilities",
          "owner": "appsec-team",
          "effort": "medium",
          "roi": 12.3
        }
      ]
    }
  ]
}
```

**Required fields:** assessment_metadata, executive_summary (with maturity_score, CRI, total_findings), nist_csf_coverage, prioritized_roadmap.

**Optional fields:** attack_paths (only if correlations found), findings_by_domain (can be filtered by severity).

## Examples

```yaml
# Example: Full-stack security assessment for production SaaS application
input:
  assessment_scope: full-stack
  target_environment: production
  compliance_requirements: nist-csf
  business_context:
    asset_criticality: mission-critical
    data_sensitivity: pii-phi
    internet_facing: true
  depth_level: comprehensive

output:
  overall_maturity: 6.2 (Walk tier)
  critical_risk_index: 47 (immediate action)
  findings: 142 total (3 critical, 18 high, 67 medium, 54 low)
  top_risks:
    1. SQL injection (CVSS 9.8, risk_score 19.3)
    2. Overpermissive IAM (CVSS 8.8, risk_score 15.8)
    3. Public S3 bucket with PII (CVSS 8.6, risk_score 15.2)
  attack_paths:
    - Public S3 → IAM escalation → PII exfiltration (risk 17.6)
  roadmap:
    Phase 1 (0-30d): 21 items, 120h effort, 68.5 risk reduction
    Phase 2 (31-90d): 45 items, 280h effort, 24.3 risk reduction
    Phase 3 (91-180d): 76 items, 450h effort, 7.2 risk reduction
```

## Quality Gates

**Token budgets (enforced):**
- **T1**: ≤2,000 tokens - quick security scan with critical findings only (CVSS ≥7.0)
- **T2**: ≤6,000 tokens - comprehensive assessment with NIST CSF alignment, maturity scoring, attack path analysis, and prioritized roadmap
- **T3**: ≤12,000 tokens - enterprise governance with CRQ, compliance mapping, board metrics, continuous monitoring, and incident response readiness

**Accuracy requirements:**

- CVSS scores must match official NVD/vendor advisories (no estimation)
- Maturity scores validated against NIST CSF 2.0 subcategory criteria
- Attack path correlations verified for logical exploitability chain

**Safety constraints:**

- **Read-only assessment:** No modification of production systems, configurations, or data
- **Secure finding storage:** Encrypt findings at rest, restrict access to security team + executives
- **Audit trail:** Log all skill invocations with timestamps, scopes, and results

**Auditability:**

- Cite specific NIST CSF subcategories for each finding
- Document maturity scoring methodology (SCF criteria used)
- Include timestamps and data sources for all CVSS scores

**Determinism:**

- Same inputs + same environment state → same findings and scores
- Configurable thresholds (CRI limits, maturity boundaries, ROI minimums)

## Resources

**Official NIST CSF 2.0 documentation:**

- NIST Cybersecurity Framework 2.0: https://www.nist.gov/cyberframework
- CSWP 29 (CSF 2.0 Specification): https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
- CSF 2.0 Assessment Resources: https://www.nist.gov/cyberframework/assessment-auditing-resources

**Risk scoring and vulnerability management:**

- CVSS v4.0 Specification: https://www.first.org/cvss/v4.0/specification-document
- CVSS v4.0 Calculator: https://www.first.org/cvss/calculator/4.0
- NVD (National Vulnerability Database): https://nvd.nist.gov/

**Security frameworks and standards:**

- CIS Benchmarks: https://www.cisecurity.org/cis-benchmarks
- OWASP Top 10 2021: https://owasp.org/www-project-top-ten/
- OWASP API Security Top 10: https://owasp.org/API-Security/
- NIST SP 800-207 (Zero Trust Architecture): https://csrc.nist.gov/pubs/sp/800/207/final

**Compliance and governance:**

- Secure Controls Framework (SCF): https://securecontrolsframework.com/
- FedRAMP Baselines: https://www.fedramp.gov/baselines/
- SOC 2 Trust Service Criteria: https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2

**Industry research:**

- IBM Cost of a Data Breach Report 2025: https://www.ibm.com/security/data-breach
- Verizon Data Breach Investigations Report 2025: https://www.verizon.com/business/resources/reports/dbir/

**Related skills:**

This meta-skill orchestrates the following specialist skills:

- `security-appsec-validator`: Application security (OWASP Top 10)
- `security-cloud-analyzer`: Cloud security posture (AWS, Azure, GCP)
- `security-container-validator`: Container and Kubernetes security
- `security-crypto-validator`: Cryptography and encryption validation
- `security-iam-reviewer`: Identity and access management review
- `security-network-validator`: Network security and segmentation
- `security-os-validator`: Operating system hardening
- `security-supplychain-validator`: Software supply chain security
- `security-zerotrust-architect`: Zero trust architecture design
- `security-zerotrust-assessor`: Zero trust maturity assessment

**Complementary skills:**

- `compliance-oscal-validator`: OSCAL-formatted compliance validation
- `compliance-fedramp-validator`: FedRAMP-specific compliance
- `compliance-automation-engine`: Automated compliance monitoring