fractional-cto-toolkit

Plugin fractional-cto-toolkit from marketplace better-toolkits in chimeranext/better-toolkits. Commands read from the repo's manifest — yesterday.

Skills (100)

• architecture-decision-ieee42010

  Records an architecture decision and its rationale in the MADR 4.0.0 shape, traced to the architecture description. Delivers architecture-decision-NNNN-title.md.

• architecture-description-ieee42010

  Writes the M-02 architecture description. Delivers architecture-description.md. Invokes /architecture-evaluation-ieee42030 when M-02 evaluates the architecture.

• architecture-evaluation-ieee42030

  Evaluates the architecture description when M-02 asks for an evaluation. Delivers architecture-evaluation.md under ISO/IEC/IEEE 42030:2019.

• migration

  Provides modernization guidance for legacy systems — assesses current state, defines the target architecture, selects a migration pattern (rehost, replatform, refactor, reiarchitect, replace, strangler fig), and sequences work by risk and value with rollback, for modernizing or moving legacy systems

• stack-evaluation

  Assesses technology stack options objectively against weighted criteria — functional fit, operational cost, risk, talent availability, lock-in, ecosystem health, security — and documents tradeoffs before recommending, for selecting or reviewing a tech stack. Delivers an evaluation scorecard and reco

• automation-triage

  Decides, step by step, how a process should run: human, RPA (robotic process automation), AI agent, or a hybrid. Use this skill when the user mentions "should we automate this", "RPA vs AI", "what can a bot do vs a person", "automation strategy", "can AI do this step", "attended vs unattended", "whe

• business-brain-setup

  Bootstraps or converts a venture's "business brain" — a Git-versioned, Obsidian-compatible Markdown vault that holds all business knowledge (decisions, assumptions, risks, KPIs, procedures, retros) as atomic linked notes. Use this skill when the user mentions "business brain", "set up our business b

• contract-nda

  Genera un Acuerdo de Confidencialidad (NDA) bilingue para firmar antes de cualquier engagement. Usa este skill cuando el usuario mencione "NDA", "acuerdo de confidencialidad", "non-disclosure", "confidentiality agreement", "firmar antes de empezar", "necesito un NDA", "antes de ver el codigo", o cua

• contract-psa

  Genera un Acuerdo de Proyecto (PSA) bilingue con modelo de riesgo compartido. Usa este skill cuando el usuario mencione "contrato de proyecto", "PSA", "project contract", "service agreement", "scope of work", "alcance del trabajo", "formalizar proyecto", "contrato por hitos", "milestone contract", "

• contract-retainer

  Genera un contrato de Retainer mensual o Advisory+Equity para engagement continuo. Usa este skill cuando el usuario mencione "retainer", "contrato mensual", "monthly contract", "engagement continuo", "ongoing engagement", "contrato de CTO fraccional", "fractional CTO contract", "equity", "sweat equi

• document-it

  Alias of `document-this` — decide what KIND of operational document to write (SOP, playbook, or runbook) and route to the matching authoring skill. Use `/document-it` interchangeably with `/document-this` for any "I want to document X" request, or when unsure "SOP or playbook or runbook". Identical

• document-this

  Helps decide what KIND of operational document you should write — SOP, playbook, or runbook — and routes you to the right authoring skill. Use this skill when the user is unsure what to write: "what should this be", "SOP or playbook or runbook", "is this a runbook", "how do I document X", "qué tipo

• argentina

  Provides a preliminary jurisdiction profile for data protection in Argentina (Ley 25.326 and AAIP), marked as to-be-completed; use when a client operates in or serves Argentina and needs an initial compliance orientation.

• ccpa

  Assesses California consumer privacy compliance under the CCPA as amended by CPRA, delivering an applicability determination, rights-handling workflow, and notice inventory; use when a client collects California consumer personal information and meets business thresholds.

• chile

  Provides a preliminary jurisdiction profile for data protection in Chile (Ley 19.628 and the Ley 21.719 reform), marked as to-be-completed; use when a client operates in or serves Chile and needs an initial compliance orientation.

• china-pipl

  Assesses China data and cyber compliance under PIPL, DSL, and CSL, delivering a gap assessment, cross-border transfer route memo, and impact-assessment register; use when a client processes personal data in or from China.

• china-trademarks

  Builds a defensive China trademark strategy for importers using white-label manufacturing, delivering a filing plan, class map, and enforcement playbook; use before a client engages a Chinese factory to prevent the OEM from registering the brand first.

• cis-controls

  Prioritizes cybersecurity improvements using the CIS Critical Security Controls v8 and Implementation Groups, delivering an implementation-group assessment and prioritized control plan; use when a client needs a pragmatic, prioritized security baseline.

• cmmc

  Assesses readiness for DoD CMMC 2.0 certification, delivering a target-level determination, scoping diagram, and POA&M; use when a client handles controlled unclassified information (CUI) in the US defense supply chain.

• colombia

  Provides a preliminary jurisdiction profile for data protection and cyber compliance in Colombia (Ley 1581/2012), marked as to-be-completed; use when a client operates in or serves Colombia and needs an initial compliance orientation.

• costa-rica

  Provides a preliminary jurisdiction profile for data protection and cyber compliance in Costa Rica, marked as to-be-completed; use when a client operates in or serves Costa Rica and needs an initial compliance orientation.

• csrd

  Supports EU CSRD sustainability reporting, delivering a double-materiality assessment, ESRS gap analysis, and reporting roadmap; use when a client is an EU in-scope undertaking that must report under the Corporate Sustainability Reporting Directive.

• cyber-essentials

  Prepares an organization for UK Cyber Essentials (and Plus), delivering questionnaire readiness, control evidence, and a certification checklist; use when a UK client must demonstrate a basic security baseline to government, insurers, or customers.

• dora

  Assesses EU DORA compliance for financial entities, delivering an ICT risk-management gap assessment, third-party register, and incident-reporting workflow; use when a client is an EU financial entity or a critical ICT third-party provider.

• dpdpa

  Assesses India DPDPA 2023 compliance, delivering an applicability check, notice/consent templates, and obligations register; use when a client processes personal data of individuals in India.

• ear

  Assesses US export compliance under the Export Administration Regulations (EAR), delivering an ECCN/EAR99 classification, screening workflow, and compliance manual; use when a client exports or transfers dual-use items, software, or technology.

• el-salvador

  Provides a preliminary jurisdiction profile for data protection in El Salvador (no general data protection law; constitutional habeas data), marked as to-be-completed; use when a client operates in or serves El Salvador and needs an initial compliance orientation.

• eu-ai-act

  Classifies AI systems under the EU AI Act and builds a conformity roadmap, delivering a risk-tier classification, high-risk requirements checklist, and technical documentation; use when a client places AI systems on the EU market or uses AI in the EU.

• fedramp

  Prepares cloud service offerings for FedRAMP authorization, delivering an impact-level determination, control implementation summary, and continuous-monitoring readiness; use when a cloud provider seeks US federal authorization.

• gdpr

  Assesses EU GDPR compliance, delivering a records-of-processing register, DPIA register, and cross-border transfer assessment; use when a client processes personal data of individuals in the EU/EEA.

• guatemala

  Provides a preliminary jurisdiction profile for data protection in Guatemala (no general data protection law; constitutional habeas data), marked as to-be-completed; use when a client operates in or serves Guatemala and needs an initial compliance orientation.

• hipaa

  Assesses US HIPAA compliance for covered entities and business associates, delivering a security risk assessment, safeguards gap, and BAA inventory; use when a client handles protected health information (PHI).

• hong-kong-pdpo

  Assesses Hong Kong PDPO compliance, delivering a data-protection-principles mapping, transfer check, and direct-marketing controls; use when a client processes personal data of individuals in Hong Kong.

• ism

  Assesses cybersecurity posture against the Australian ACSC Information Security Manual, delivering an ISM control mapping and Essential Eight maturity assessment; use when a client operates or bids in Australia.

• iso27001

  Establishes or assesses an Information Security Management System (ISMS) per ISO/IEC 27001, producing a gap assessment, Statement of Applicability, and certification-readiness roadmap; use when a client needs structured information security governance or certification.

• iso27701

  Extends an ISO 27001 ISMS into a Privacy Information Management System (PIMS) per ISO/IEC 27701, delivering a PII inventory, privacy risk treatment, and control mapping; use when a client processes personal data and needs privacy governance atop security.

• iso31000

  Establishes or assesses organizational risk management per ISO 31000:2018 principles, framework, and process, producing a gap assessment and a risk-analysis register shaped for ISO 9001:2015 risk/opportunity thinking. Use when a client needs enterprise risk governance (not a software-project risk ma

• iso42001

  Establishes or assesses an AI Management System per ISO/IEC 42001, delivering an AI inventory, AI risk assessment, and lifecycle governance framework; use when a client builds or deploys AI systems and needs a certifiable management standard.

• itar

  Assesses US defense export compliance under the ITAR, delivering a USML determination, DDTC registration status, and compliance manual; use when a client exports defense articles, services, or technical data.

• japan-appi

  Assesses Japan APPI compliance, delivering a personal-information-handler mapping, transfer compliance note, and handling register; use when a client processes personal data of individuals in Japan.

• lgpd

  Assesses Brazil LGPD compliance, delivering an applicability check, DPO designation, records of processing, and gap analysis; use when a client processes personal data of individuals in Brazil.

• mexico

  Provides a preliminary jurisdiction profile for data protection in Mexico (LFPDPPP and INAI), marked as to-be-completed; use when a client operates in or serves Mexico and needs an initial compliance orientation.

• nis2

  Assesses EU NIS2 compliance, delivering an applicability determination, security-measures gap assessment, and incident-reporting workflow; use when a client is an essential or important entity in an EU member state.

• nist-800-53

  Selects and assesses security and privacy controls from the NIST SP 800-53 catalog (rev. 5), delivering a control baseline, tailoring, and gap assessment; use for federal, FISMA, or high-assurance system control frameworks.

• nist-ai-rmf

  Manages risks of AI systems using the NIST AI RMF 1.0 (Govern, Map, Measure, Manage), delivering an AI risk register and measurement plan; use when a client deploys AI and needs a structured, trustworthy-AI risk process.

• nist-csf

  Applies the NIST Cybersecurity Framework 2.0 to organize and prioritize cybersecurity risk, delivering current and target profiles and a gap-based action plan; use to communicate cyber risk across an organization in business terms.

• nzism

  Assesses cybersecurity posture against the New Zealand Information Security Manual (NZISM), delivering a NZISM control gap assessment and maturity view; use when a client operates in, or serves, the New Zealand government sector.

• panama

  Provides a preliminary jurisdiction profile for data protection in Panama (Ley 81 de 2019 and ANTAI), marked as to-be-completed; use when a client operates in or serves Panama and needs an initial compliance orientation.

• pci-dss

  Scopes and assesses compliance with the PCI DSS (v4.0) for cardholder data environments, delivering a scope diagram, requirement matrix, and evidence pack; use when a client stores, processes, or transmits cardholder data.

• saudi-arabia-grc

  Determines Saudi data protection (PDPL) and cybersecurity (NCA ECC) requirements, delivering an applicability determination and gap assessment; use when a client operates in or serves Saudi Arabia.

• section-508

  Assesses ICT accessibility against US Section 508, delivering conformance testing, a VPAT, and a remediation plan; use when a client sells or provides information and communication technology to the US federal government.

• singapore-pdpa

  Assesses Singapore PDPA compliance, delivering an obligations checklist, data-breach management plan, and transfer assessment; use when a client processes personal data of individuals in Singapore.

• soc2

  Prepares a service organization for an AICPA SOC 2 attestation, delivering a readiness gap assessment and trust-services criteria control matrix; use when a client must show customers that its systems meet trust services criteria.

• south-korea-pipa

  Assesses South Korea PIPA compliance, delivering a processing-principles checklist, DPO appointment, and breach-notification flow; use when a client processes personal data of individuals in South Korea.

• sox-itgc

  Defines and tests IT General Controls (ITGC) for SOX financial reporting, delivering an ITGC matrix, test plan, and evidence log; use when a US public company must support financial statement audit controls.

• swift-csp

  Assesses local SWIFT infrastructure against the SWIFT Customer Security Controls Framework (CSCF), delivering a control self-assessment and remediation plan; use when a client is a SWIFT user and must attest to the Customer Security Programme.

• taiwan-pdpa

  Assesses Taiwan PDPA compliance, delivering a processing checklist, special-category handling, and transfer-restriction check; use when a client processes personal data of individuals in Taiwan.

• tisax

  Prepares an organization for a TISAX assessment, delivering an assessment-level decision, VDA ISA self-assessment, and scope plan; use when a client is in the automotive supply chain and must exchange information securely with OEMs.

• tprm

  Assesses and monitors third-party and supplier risk, delivering a vendor inventory, risk ratings, and contract/exit actions; use when a client's supply chain, SaaS, or outsourced services create security, privacy, or operational risk.

• tsa

  Assesses cybersecurity readiness against TSA security directives and regulations for transportation sectors, delivering a readiness assessment and security plan; use when a client operates in aviation, pipeline, rail, or other TSA-regulated sectors.

• uae-grc

  Determines the applicable UAE data protection and security regime (mainland PDPL vs DIFC/ADGM, plus NESA), delivering an applicable-law determination and gap assessment; use when a client operates in or serves the UAE.

• vietnam-pdpl

  Assesses Vietnam PDPL compliance, delivering a gap analysis, impact-assessment register, and cross-border transfer notes; use when a client processes personal data of individuals in Vietnam.

• wcag

  Audits and remediates web content against WCAG 2.2, delivering a conformance assessment, remediation backlog, and VPAT evidence; use when a client must meet digital accessibility requirements or accessibility regulation.

• handover-architecture-to-principal

  Transfers architecture stewardship to a Principal Architect — ADRs, decisions, constraints, and technical debt — for use when architecture ownership moves to the organization's senior engineer. Delivers a structured handover packet.

• handover-engagement-to-board

  Transfers the overall engagement to the CEO and Board — outcomes, status, open commitments, residual risks, and next steps — for use when the fractional CTO engagement concludes or transitions. Delivers a structured handover packet.

• handover-grc-to-cco

  Transfers GRC compliance posture to a Chief Compliance Officer — frameworks, obligations, evidence, and open items — for use when compliance ownership moves to the organization's compliance function. Delivers a structured handover packet.

• handover-metrics-to-vpeng

  Transfers engineering metrics ownership to a VP Engineering — definitions, dashboards, baselines, and open instrumentation gaps — for use when metrics stewardship leaves the fractional CTO. Delivers a structured handover packet.

• handover-process-to-ops

  Transfers process engineering outputs to Ops and the COO — SOPs, playbooks, runbooks, and ownership assignments — for use when process stewardship moves to operations. Delivers a structured handover packet.

• handover-requirements-to-cpo

  Transfers requirements artifacts to a CPO or Product — PRDs, traceability, acceptance criteria, and backlog implications — for use when product ownership absorbs the requirements workstream. Delivers a structured handover packet.

• handover-risk-to-cro

  Transfers risk and resilience posture to a Chief Risk Officer — current state, open items, owners, and urgencies — for use when the CTO winds down or transitions a risk workstream. Delivers a structured handover packet.

• handover-standards-to-vpeng

  Transfers engineering standards adoption to a VP Engineering — standard set, audit baseline, remediation debt, and ownership — for use when standards stewardship moves to the engineering organization. Delivers a structured handover packet.

• handover-strategy-to-board

  Transfers technology strategy to the CEO and Board — roadmap, portfolio, bets, risks, and investment asks — for use when strategic ownership returns to the executive team. Delivers a structured handover packet.

• maintenance-plan-ieee14764

  Writes the takeover maintenance plan after the project-takeover questionnaire. Delivers maintenance-plan-slug.md under ISO/IEC/IEEE 14764:2022.

• exec-reporting

  Creates executive dashboards and metric narratives that convert engineering metrics into decisions for non-technical stakeholders — a small set of KPI tied to business outcomes, with trends and recommendations — for use in board updates, investor reporting, and executive reviews. Delivers an executi

• reliability

  Defines service-level indicators (SLIs), objectives (SLOs), and availability targets with error budgets, and specifies how reliability is measured and reported, to set reliability expectations for a service or product. Delivers an SLO specification.

• team-health

  Measures team health KPIs — morale and engagement, retention, predictability, quality culture, bus factor, workload balance, review turnaround — combining objective signals with a lightweight periodic health survey, to respond to team stress or churn signals. Delivers a team health scorecard with ac

• velocity

  Analyzes engineering velocity with flow metrics — throughput, cycle time, lead time, WIP, flow efficiency — and identifies bottlenecks in the delivery system, when delivery feels slow or planning keeps missing. Delivers a velocity analysis report with bottleneck findings.

• playbook-authoring
• process-standardization
• audit
• authoring
• project-takeover
• disaster-recovery
• incident-response
• resilience
• runbook-authoring
• software-project-management-plan-authoring-ieee16326
• software-risks-authoring-ieee16085
• sop-authoring
• portfolio
• rnd-alignment
• roadmap
• takeover-assessment
• ai-defense
• mitre-atlas
• mitre-attack
• mitre-d3fend
• owasp-nhi-top10
• owasp-top10
• transition-plan-ieee12207

Slash commands (2)

• /fractional-cto-toolkit:engineering-standards-audit

  Audita un repo del cliente contra los engineering standards (las 32 prácticas del índice SSOT): estructura, orden intra-archivo, barrels, PRs abiertos, branching, trazabilidad QA, PRs 1:1 del OpenSpec store, y FFF (familias × taxonomía interna). Emite hallazgos + remediación incremental (no refactor

• /fractional-cto-toolkit:engineering-standards-setup

  Adopta los engineering standards (las 32 prácticas del índice SSOT) en un repo del cliente: AGENTS.md con punteros, docs/process/, PR template PRDS, guía QT4L, y puntero OST cuando hay OpenSpec store. Setup incremental, nunca refactor masivo.

Hooks (2)

• PreToolUse

  bash ${CLAUDE_PLUGIN_ROOT}/hooks/stderr/adapters/claude-pre-bash.sh

• PreToolUse

  bash ${CLAUDE_PLUGIN_ROOT}/hooks/prds/adapters/claude-pre-bash.sh

Similar plugins