# How to use these skills

Three prompts, meant to be run in sequence, each one feeding the next:

1. **`01-organisation-risk-discovery-prompt.md`** — Organisation Risk Discovery. Turns a conversation about your organisation into a first-draft, enterprise-level risk list.
2. **`02-control-risk-weighting-maturity-prompt.md`** — Control Weighting & Target Maturity. Turns that risk list into a weighted, prioritised worksheet against MCSS's 10 standards (or your own control set).
3. **`03-business-case-funding-prompt.md`** — Business Case Conversion. Turns that worksheet into a funding case, tailored to whoever actually needs to approve it.

## How to actually run one

1. Open the skill file.
2. Copy the whole file — or at minimum everything between the two `---` markers under "Prompt (copy everything below the line into your assistant)" — and paste it as your first message to an AI assistant (Claude, ChatGPT, Copilot, whatever you have access to).
3. If you want the assistant to understand the bigger picture — why these three skills exist, how they connect, and that you're free to adapt them — paste this README in as well, before or alongside the skill prompt. Tell it plainly: *"read this README for context, then follow the instructions in the prompt below."*
4. Answer its questions as they come. Don't skip ahead, and don't let it skip ahead either.
5. When you're happy with the output, move to the next skill and feed it what the last one produced.

Answer with your own organisation's real information. There's no sample run included here on purpose — the value is in what the assistant reasons out from your actual answers, not in a fictional example you could copy the shape of instead of doing the real discovery work.

## Make this yours — this is a starting point, not a finished tool

These three prompts are deliberately simple and self-contained so they work with nothing but an AI assistant and your own knowledge of your organisation. That also makes them a floor, not a ceiling. Once you've run them once, feel free to:

- **Swap in your own control set.** The default is MCSS's 10 standards. If you actually run against NZISM, ISO 27001, CIS Controls, or an internal framework, tell the assistant to use that instead — Skill 2 already supports it, just say so at Step 0.
- **Adjust the depth.** Ten standards is a coarse floor. If your organisation is large enough to want more resolution — sub-controls, per-business-unit detail, a richer maturity ladder — tell the assistant to go deeper. The prompts describe a method, not a fixed level of granularity.
- **Choose your own metrics.** The talk gave worked examples for five of the ten MCSS standards (patch SLA %, MFA enrolment %, backup restore success rate, and so on) — that's a starting list, not *the* list. Decide what "good" looks like for each control in your own environment and tell the assistant to build the worksheet around those instead.
- **Think about the business case while you're still on Skills 1 and 2.** The point was never "produce a risk register" — it's "produce something that gets funded." Keep Skill 3's three-box structure (problem, quantified position, funded intervention) in mind early, and capture the numbers and language you'll actually need for that case as you go, rather than trying to reconstruct them afterward.
- **Think about sustainability.** A risk assessment done once and filed away is exactly the point-in-time-attestation problem the talk argued against. Decide up front how often you'll re-run this cycle — quarterly, twice a year, aligned to your budget round — and keep every run's output, so the next one can show *movement*, not just a fresh snapshot. A control that moved from Informal to Planned & Tracked over two cycles is worth more in a funding conversation than any single point-in-time number.

None of this needs our permission or our product. Take the method and make it work for your organisation.
