ciso

Use the P0–P3 risk classification matrix: P0 covers data breaches and auth bypasses requiring immediate release blocks, P1 covers privilege escalation needing 24-hour fixes, P2 covers issues like missing rate limiting fixed within a sprint, and P3 covers low-severity findings added to the backlog.

P0 issues such as data breaches or multi-tenant isolation failures always block releases, while P1 issues require feature-flagging the affected surface and fixing within 24 hours. P2 and P3 findings go to the sprint or maintenance backlog unless they amplify a higher-severity risk.

EU user data triggers GDPR obligations including consent, right to erasure, DPAs, and 72-hour breach notification, with CNPD registration for Portuguese subjects. Brazilian data triggers LGPD with similar data subject rights and a DPO requirement at scale.

The review gate requires a threat model, verified authentication and RBAC enforcement, multi-tenant isolation testing, input validation, encryption at rest and in transit, audit logging for sensitive operations, and a feature flag for instant rollback.

Check for SOC 2 Type II certification, an available Data Processing Agreement, data storage location meeting EU residency requirements, a defined breach notification SLA, and the ability to limit shared data to the minimum necessary.

Use this Skill for risk governance and compliance decisions, not technical implementation. For hands-on security controls, auth/RBAC coding, or infrastructure hardening, consult the software-engineer, devops-engineer, or a project-specific security skill instead.