Use this skill when a statement of applicability already exists and the team wants its exclusions to survive the audit, and asks "review our SoA exclusions", "is this a valid justification", "can we exclude physical security if we are fully remote", "the auditor challenged our not applicable controls", "rewrite our exclusion justifications" or "we outsource it, so it does not apply, right".
Install
npx skills add better-isms/grcskills --skill soa-exclusion-justification-reviewnpx skills add better-isms/grcskills --skill soa-exclusion-justification-review -a claude-code -gnpx skills add better-isms/grcskills --skill soa-exclusion-justification-review -a codex -ggemini skills install https://github.com/better-isms/grcskills.git --path skills/tristan-roth/soa-exclusion-justification-reviewgh skill install better-isms/grcskills soa-exclusion-justification-reviewgit clone --depth 1 https://github.com/better-isms/grcskills /tmp/better-isms__grcskills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/better-isms__grcskills/skills/tristan-roth/soa-exclusion-justification-review ~/.claude/skills/soa-exclusion-justification-review # Claude Code
cp -R /tmp/better-isms__grcskills/skills/tristan-roth/soa-exclusion-justification-review ~/.agents/skills/soa-exclusion-justification-review # Codex, Cursor, Gemini CLI, Copilot, OpenCode