Conciseness

Dense with non-derivable, role-specific judgment (metric targets, vendor tier cadences, red flags) and no explanations of concepts Claude already knows. Not 5 because the "Keywords" section duplicates the frontmatter description's trigger terms and "Reasoning Technique: Risk-Based Reasoning" largely restates the Risk Quantification section — tokens that could be trimmed.

Actionability

Concrete, executable guidance throughout: the ALE formula with board phrasing, sequenced compliance timelines ("SOC 2 Type I (3–6 mo) → SOC 2 Type II (12 mo)"), a numeric budget example ($200K program / $2M breach / 40% / $800K expected value), tiered vendor assessment cadences, and copy-paste Quick Start commands. Not 5 because the Quick Start commands reference scripts/risk_quantifier.py and scripts/compliance_tracker.py which are not present in the bundle, leaving the runnable entry point unverifiable.

Workflow Clarity

Clear sequences within sections (identity → network segmentation → data classification; SOC 2 Type I → Type II → ISO/HIPAA), a request→artifact mapping table, and an explicit verification checkpoint pattern ("Self-verify... Peer-verify... Critic pre-screen" plus "Always read company-context.md before responding"). Not 5 because the main advisory flows are never laid out as an end-to-end numbered workflow with recovery guidance; not 3 because checkpoints are explicit, not merely implied.

Progressive Disclosure

Good structure: overview-level body with clearly signaled one-level-deep references ("See `references/security_strategy.md`" inline plus a dedicated "Detailed References" section) and appropriately split detail. Not 5 because none of the referenced files — references/security_strategy.md, references/compliance_roadmap.md, references/incident_response.md, the two scripts, or ../agent-protocol/SKILL.md — exist in the staged bundle, so every pointer dangles and navigation breaks in practice.

Specificity

Lists several specific capabilities with concrete framework names — "Risk quantification in dollars, compliance roadmap (SOC 2/ISO 27001/HIPAA/GDPR), security architecture strategy, incident response leadership, and board-level security reporting". Not 5 because "leadership" and "strategy" are noun-phrase domains rather than crisp concrete actions; not 3 because it clearly enumerates several specific capabilities with named frameworks.

Completeness

Explicitly answers both what (five enumerated capability areas with concrete framework names) and when ("Use when building security programs, justifying security budget, selecting compliance frameworks, managing incidents, assessing vendor risk, or when user mentions CISO...") with concrete trigger phrases — a direct match to the anchor-5 example structure.

Trigger Term Quality

Good natural-phrase coverage: "building security programs, justifying security budget, selecting compliance frameworks, managing incidents, assessing vendor risk" plus "CISO, security strategy, compliance roadmap, zero trust, or board security reporting". Not 5 because common variations users would say — "security audit", "breach", "penetration testing", "cyber insurance" — are missing.

Distinctiveness Conflict Risk

Clear niche (CISO-level security leadership for growth-stage companies) with role-distinct triggers like "CISO", "zero trust", and "board security reporting". Not 5 because "managing incidents" and "compliance roadmap" could overlap with dedicated incident-response or compliance skills in a multi-skill suite.