---

name: ciso-assistant-basic-risk-assessment description: | Guide users through a basic risk assessment workflow in CISO Assistant, from asset identification to scenario creation. Use when: (1) User wants to start a risk assessment from scratch (2) User mentions "risk assessment", "identify risks", "threat scenarios", or "risk register" (3) User asks about qualitative vs quantitative risk approaches (4) User needs help identifying assets, threats, or creating risk scenarios

Covers: risk approach selection (qualitative/quantitative), organizational context gathering, asset identification (primary/supporting), threat catalog usage, scenario generation from threat-asset combinations, risk assessment/study creation.

CISO Assistant Basic Risk Assessment

Guide users through risk assessment setup using MCP server tools.

Prerequisites

1. Verify MCP server connectivity - Test with get_folders()
2. Backend must be running - CISO Assistant backend at configured URL
3. If MCP tools unavailable - Fall back to direct API calls (see bootstrap skill)

---

Key Principles

Always Pass folder_id for Scoping

When creating objects, always pass folder_id to scope lookups and avoid ambiguity errors when objects with the same name exist in different folders.

Copy# CORRECT - folder_id scopes all lookups to ACME folder
create_risk_scenario(
  name="Ransomware on Customer Data",
  risk_assessment_id="ACME Risk Assessment 2025",
  folder_id="ACME",  # <- Scopes asset/threat lookups
  assets=["Customer Data"],
  threats=["Ransomware"],
  threat_library="urn:intuitem:risk:library:intuitem-common-catalog"
)

Always Use threat_library for Threat Lookups

Threats exist in multiple libraries (intuitem catalog, MITRE ATT&CK, etc.). Always specify the library:

Copythreat_library="urn:intuitem:risk:library:intuitem-common-catalog"

Include Relevance in Scenario Descriptions

Always explain why a scenario matters for this specific organization:

Copy"Ransomware attack encrypting customer data, leading to service disruption.
Relevance: GDPR breach implications with mandatory 72-hour notification
and potential fines up to 4% of annual revenue."

---

Workflow

Step 1: Choose Risk Approach

Ask the user which approach they prefer:

Step 2: Gather Organizational Context

Ask about:

• Industry: healthcare, financial, tech/SaaS, retail, manufacturing, government
• Size: small (1-50), medium (50-500), large (500+)
• Region: for regulatory context (EU → GDPR, US healthcare → HIPAA, etc.)
• Cloud: AWS/Azure/GCP, SaaS-heavy or on-premise
• Compliance: specific requirements (HIPAA, PCI-DSS, GDPR, SOC2, ISO 27001)

Step 3: Create Domain and Perimeter

Copy# 1. Create folder (domain)
create_folder(name="ACME", description="ACME Corp - Tech/SaaS, EU-based")

# 2. Create perimeter (assessment scope)
create_perimeter(name="ACME Platform", folder_id="ACME")

Step 4: Identify and Create Assets

Use references/typical-assets.md to suggest assets based on context.

Primary Assets (PR) - Business value:

• Customer/employee data, financial records, source code, API keys/secrets

Supporting Assets (SP) - Infrastructure:

• Cloud infrastructure, databases, CI/CD pipeline, email, endpoints

Copy# Create assets - always pass folder_id
create_asset(name="Customer Data", description="Customer PII - GDPR relevant",
             asset_type="PR", folder_id="ACME")
create_asset(name="Production Database", description="Primary data storage",
             asset_type="SP", folder_id="ACME")

Step 5: Import Threat Catalog

Copy# Import the intuitem common catalog (23 threats)
import_stored_library("urn:intuitem:risk:library:intuitem-common-catalog")

# Verify threats are available
get_threats(library="urn:intuitem:risk:library:intuitem-common-catalog")

Step 6: Generate Scenario Suggestions

Use the Threat-Asset Relevance Matrix in references/typical-assets.md to suggest the most relevant threat-asset combinations.

Naming convention: [Threat] on [Asset]

• "Ransomware on Customer Data"
• "Phishing targeting Employees"
• "Cloud Misconfiguration"

Present top 10-15 combinations and let user select which to create.

Step 7: Create Assessment Container

For Qualitative:

Copy# Check available matrices
get_risk_matrices()

# Use matrix UUID to avoid ambiguity
create_risk_assessment(
  name="ACME Risk Assessment 2025",
  risk_matrix_id="<matrix-uuid>",  # Use UUID from get_risk_matrices()
  perimeter_id="ACME Platform",
  folder_id="ACME",
  status="in_progress"
)

For Quantitative:

Copycreate_quantitative_risk_study(
  name="ACME Quantitative Risk Study 2025",
  folder_id="ACME",
  distribution_model="lognormal_ci90"
)

Step 8: Create Risk Scenarios

For Qualitative:

Copycreate_risk_scenario(
  name="Ransomware on Customer Data",
  description="Ransomware attack encrypting customer data. Relevance: GDPR breach with 72-hour notification requirement.",
  risk_assessment_id="ACME Risk Assessment 2025",
  folder_id="ACME",  # CRITICAL: scope lookups
  assets=["Customer Data"],
  threats=["Ransomware"],
  threat_library="urn:intuitem:risk:library:intuitem-common-catalog"
)

For Quantitative:

Copycreate_quantitative_risk_scenario(
  name="Ransomware on Customer Data",
  description="Ransomware attack... Relevance: ...",
  quantitative_risk_study_id="ACME Quantitative Risk Study 2025",
  folder_id="ACME",
  assets=["Customer Data"],
  threats=["Ransomware"],
  threat_library="urn:intuitem:risk:library:intuitem-common-catalog"
)

Step 9: Summary and Next Steps

After creating scenarios, summarize and guide on next steps:

For Qualitative:

1. Rate probability and impact for each scenario in the UI
2. Identify and link existing controls
3. Plan additional controls for high-risk scenarios
4. Review risk matrix visualization

For Quantitative:

1. Create hypotheses with probability and impact bounds
2. Run Monte Carlo simulations
3. Set risk tolerance curve
4. Analyze portfolio-level risk

---

Quick Reference

MCP Tools

Common Threat Library URN

Copyurn:intuitem:risk:library:intuitem-common-catalog

Threat Catalog Quick Reference

---

Fallback: Direct API Calls

If MCP tools unavailable:

• POST /api/folders/
• POST /api/perimeters/
• POST /api/assets/
• POST /api/stored-libraries/<urn>/import/
• POST /api/risk-assessments/
• POST /api/risk-scenarios/
• POST /api/crq/quantitative-risk-studies/
• POST /api/crq/quantitative-risk-scenarios/