Generate NCSC ICT-beveiligingsrichtlijnen security audit with technical and stakeholder reports
Generates NCSC ICT-beveiligingsrichtlijnen security audit with technical and stakeholder reports
/plugin marketplace add SSiertsema/claude-code-plugins/plugin install ncsc-security-audit@svens-claude-pluginsYou are initiating a multi-agent security audit based on the NCSC ICT-beveiligingsrichtlijnen voor webapplicaties (Juli 2024). This audit will produce two reports: a technical report for developers and a non-technical summary for stakeholders.
IMPORTANT: Before starting the audit, ask the user which language they prefer for the reports.
Use the AskUserQuestion tool to ask:
Question: "In which language should the security reports be generated?"
Options:
- English (default)
- Other (please specify)
If the user selects "Other", they can specify any language supported by the LLM (e.g., German, French, Spanish, Japanese, Chinese, etc.).
Store the selected language and use it for:
Language Guidelines:
Before proceeding, read the guidelines reference:
templates/ncsc-guidelines.md - Full NCSC guidelines with search patternsNote: From this point forward, all agent outputs and reports should be in the user's selected language.
Launch a Discovery Agent to analyze the solution and determine:
Solution Type Classification
Technology Stack Detection
Guideline Relevance Matrix
Based on solution type, determine which NCSC domains and guidelines apply:
| Domain | Description | Frontend | Backend | Full-Stack | Library |
|---|---|---|---|---|---|
| U/TV | Toegangsvoorzieningsmiddelen | Partial | Full | Full | N/A |
| U/WA | Webapplicaties | Full | Full | Full | Partial |
| U/PW | Platformen en webservers | N/A | Full | Full | N/A |
| U/NW | Netwerken | N/A | Full | Full | N/A |
Output Required:
## Discovery Report
### Solution Type: [TYPE]
### Technologies Detected:
- [LIST]
### Applicable Guidelines:
| ID | Guideline | Relevance | Reason |
|----|-----------|-----------|--------|
| U/TV.01 | ... | Full/Partial/N/A | ... |
| U/WA.01 | ... | Full/Partial/N/A | ... |
...
For each applicable guideline, launch TWO agents in parallel:
Deep-dive analysis for each guideline:
Search Phase
templates/ncsc-guidelines.mdAnalysis Phase
Recommendation Phase
Cross-validate the Security Analyst's findings:
Verification Phase
Consensus Building
For each guideline:
Progress Tracking:
## Guideline Progress
| ID | Analyst | Verifier | Consensus | Status |
|----|---------|----------|-----------|--------|
| U/TV.01 | ✓ | ✓ | ✓ | Complete |
| U/WA.01 | ✓ | ✓ | In Progress | ... |
After all applicable guidelines are analyzed, generate two reports:
security-reports/ncsc-audit-technical.md)Use template: templates/technical-report.md
Content:
security-reports/ncsc-audit-summary.md)Use template: templates/stakeholder-report.md
Content:
Start Discovery Phase
Launch Discovery Agent with prompt:
"Analyze this codebase to determine solution type, technologies,
and which NCSC guidelines (U/TV, U/WA, U/PW, U/NW) are applicable.
Reference templates/ncsc-guidelines.md for the full guideline list."
Execute Guideline Analysis For each applicable guideline, launch parallel agents:
Security Analyst: "Analyze [GUIDELINE_ID]: [GUIDELINE_NAME] using
search patterns from templates/ncsc-guidelines.md. Document all
findings with file:line locations and severity ratings."
Verification Agent: "Verify findings for [GUIDELINE_ID]. Check for
false positives and missed vulnerabilities. Build consensus with
the Security Analyst."
Generate Reports
Create security-reports/ directory if it doesn't exist.
Generate both reports using the templates.
Before completing the audit: