CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

cyber-essentials

Expert UK Cyber Essentials and Cyber Essentials Plus advisor — the NCSC-owned, IASME-delivered baseline certification. Covers the current Danzell question set (Requirements for IT Infrastructure v3.3, mandatory for assessment accounts from April 27, 2026) and the Willow transition, the five control themes (firewalls, secure configuration, security update management, user access control, malware protection), scoping rules for cloud services, BYOD and home working, the 14-day critical-update rule, mandatory MFA for cloud services and the new auto-fail questions, CE Plus technical audits, pricing, annual renewal, the included cyber liability insurance, and procurement mandates (PPN 014, MoD Defence Cyber Certification, NHS). Use this skill whenever a user mentions Cyber Essentials, CE Plus, IASME, the UK government cyber certification, Danzell or Willow question sets, UK public-sector or MoD supply-chain security requirements, or wants a readiness gap assessment.

Quality

93%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A strong knowledge-skill body: scheme-specific facts with concrete numbers throughout, well-quarantined version/date information with a 'last verified' stamp, explicit output formats per workflow, and clearly signaled one-level-deep references that all exist. The main weakness is redundancy — pricing, insurance, CE+ and procurement detail appears nearly verbatim in both the body and certification-process.md — plus the absence of an explicit end-to-end engagement sequence in the body itself.

Suggestions

De-duplicate the Certification Mechanics table and Procurement Mandates section against references/certification-process.md: keep the headline facts (price bands exist, insurance exists, DCC deadline) in the body and push full terms (excess amounts, underwriter, PPN scope details) to the reference, trimming roughly a quarter of the body.

Add a short 'Engagement sequence' line to Core Workflows (scope definition → gap assessment → remediation → submission → CE+ within 3 months) so the five workflows have an explicit order for full certification journeys, with the detailed timeline already in certification-process.md.

Add brief evidence examples to the Question-set walkthrough row (e.g., a sample assessor-expected answer for an auto-fail question) so the walkthrough workflow is as concrete as the gap-assessment format.

DimensionReasoningScore

Conciseness

The body is dense with facts Claude cannot reliably know ('max 10 guesses in 5 minutes', 'CVSS v3 base score ≥ 7', '£320…£600', 'turnover < £20m') and properly quarantines time-sensitive version info in a dedicated 'Version status' section with a 'Last verified' date, unlike the penalized inline-date bad example. It falls short of anchor 5 because pricing, insurance terms, CE+ audit detail and the DCC deadline are repeated nearly verbatim in both the body and references/certification-process.md, so not every token earns its place in the bundle.

4 / 5

Actionability

For an instruction-only advisory skill this is fully actionable: every control carries an executable threshold (14-day rule with CVSS ≥7 criterion, PIN ≥6 chars, brute-force limits, MFA-always for cloud, specific scope decision rules), and the Core Workflows table specifies exact output formats ('Table per control theme: requirement | current state | gap | fix | auto-fail risk flag') plus mandatory answer-completeness rules. Anchor 5's 'specific examples cover the common cases' is met — the scoring note confirms absence of code is not penalized when guidance is this concrete.

5 / 5

Workflow Clarity

Each of the five workflows has an unambiguous deliverable specification, and no destructive or batch operation exists that would require validation loops. It stays at anchor 4 rather than 5 because the workflows are presented as task→output mappings with no sequencing for a full engagement (scope → gap assessment → remediation → submission → CE+ audit lives only in a reference file, not the body), which is a minor gap rather than the incoherence of anchor 3.

4 / 5

Progressive Disclosure

The Reference Files section clearly signals three real, one-level-deep files (verified: references/five-controls.md, scope-and-boundaries.md, certification-process.md exist, none reference further files), each with a descriptive one-liner. However, content is not cleanly split — the Certification Mechanics and Procurement Mandates sections duplicate substantial detail from the reference files, which is the 'minor organization gaps' of anchor 4 rather than the 'content appropriately split' of anchor 5.

4 / 5

Total

17

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

An exemplary description: third-person, dense with scheme-specific facts Claude could not infer, with an explicit and comprehensive 'Use this skill whenever…' trigger clause covering both full names and code names. The only minor cost is length, but every clause carries information and the rubric's verbosity penalty targets padding, not density.

DimensionReasoningScore

Specificity

The description enumerates the full capability surface concretely: 'five control themes (firewalls, secure configuration, security update management, user access control, malware protection)', 'scoping rules for cloud services, BYOD and home working', 'CE Plus technical audits, pricing, annual renewal, the included cyber liability insurance, and procurement mandates (PPN 014, MoD Defence Cyber Certification, NHS)', plus the advisory action 'readiness gap assessment'. Coverage is comprehensive with no vague filler; re-reading anchor 4 ('minor gaps in coverage') shows no gap material enough to drop it.

5 / 5

Completeness

It explicitly answers 'what' ('Expert UK Cyber Essentials and Cyber Essentials Plus advisor — the NCSC-owned, IASME-delivered baseline certification. Covers…') and 'when' with a concrete 'Use this skill whenever…' clause listing trigger phrases, matching the anchor-5 exemplar structure exactly. It is not the anchor-4 case because 'when' is explicit and specific rather than merely present.

5 / 5

Trigger Term Quality

'Use this skill whenever a user mentions Cyber Essentials, CE Plus, IASME, the UK government cyber certification, Danzell or Willow question sets, UK public-sector or MoD supply-chain security requirements, or wants a readiness gap assessment' covers the natural phrasings and synonyms users would actually say, including both question-set code names and the body names 'Cyber Essentials Plus' spelled out. Anchor 4 ('a few natural terms missing') does not fit — no meaningful user phrasing is absent.

5 / 5

Distinctiveness Conflict Risk

This is a tightly niched certification scheme with distinct triggers (Cyber Essentials, CE Plus, IASME, Danzell/Willow, PPN 014, MoD DCC); no other plausible skill would collide on these terms. It clearly matches anchor 5 ('clear niche with distinct triggers; minimal conflict risk') rather than anchor 4's 'minor overlap risk with closely related skills'.

5 / 5

Total

20

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

Path

plugins/cyber-essentials/skills/cyber-essentials/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.