— Risk & Compliance
Assesses a reported incident against your response playbook and policies, assigns the severity band the evidence supports, and returns the matching response plan with the notifications, owners and timelines that band requires.
1–2 hours → ~5 minutes
For one document, brief or record at a time
No coding required
— USE CASES
Assigns a severity band using the organisation’s matrix, accounting for affected services, customer impact and containment. Identifies first-hour priorities and escalation requirements, including mandatory high-severity treatment for a full customer-facing outage.
Assesses the reported data impact and applies mandatory critical or major classification criteria where relevant. Sets out notification recipients and deadlines supported by the organisation’s policies.
Recognises safety risks and regulatory deadlines as grounds for mandatory high-severity classification. Provides a reasoned response overview that makes urgent actions and notification obligations visible.
Distinguishes critical, major, moderate and minor incidents against documented criteria. Explains the assigned band and cites the playbook sections relied on, explicitly identifying an unavailable playbook rather than inventing a procedure.
Incident decisions often depend on incomplete information, competing priorities and policies that are difficult to interpret under pressure. Customer-facing service outage is the typical trigger — assigns a severity band using the organisation’s matrix, accounting for affected services, customer impact and containment. Identifies first-hour priorities and escalation requirements, including mandatory high-severity treatment for a full customer-facing outage. Done properly it is defensible; done at pace it becomes a judgement call nobody can retrace. And "properly" usually means 1–2 hours of manual work.
As a Skill, the work is already sequenced. You bring the evidence, and the run produces impact assessment across service, customer, data, regulatory, financial and reputational dimensions plus severity band from Sev 1 Critical to Sev 4 Minor. The criteria, ordering and review points that make the answer trustworthy are encoded in the Skill itself — which is the difference between a structured method and a prompt someone pastes in. In effect, 1–2 hours of senior time compresses into ~5 minutes — and the output is comparable across clients, quarters and colleagues instead of shaped by whoever ran it.
Incident Severity & Response exports as a structured SKILL.md file and is MCP-ready, so the same method runs in ChatGPT, Claude, Copilot or your own AI products. Adapt it to your methodology, and the intelligence stays yours — not locked to one vendor.
Assesses a data subject access request end to end and returns a governed decision on whether to fulfil it, fulfil it in part, refuse it with reasons or extend the deadline, having verified identity, mapped the request to the systems that actually hold the data and held the outcome for a data protection sign-off before anything is disclosed.
Fans multiple audit or review reports into individual findings, deduplicates repeats, and sorts them by severity into one consolidated register with sources retained.
Pairs a full evidence set against every audit assertion or PBC item to produce a coverage matrix, naming the assertions nothing supports and the documents supporting nothing.
Reads a submitted claim against the policy wording that governs it and returns a coverage assessment showing whether it appears covered, potentially excluded or in need of specialist review, mapped clause by clause and never issued without a handler's sign-off.
Assesses personal-data processing and cross-border transfers against privacy policy and jurisdiction rules, producing a documented approval outcome with conditions, policy evidence and grounds for referral.
Assesses current policies, controls and supporting evidence against regulatory requirements, producing a gap assessment and prioritised remediation plan for reviewer approval.
