feat: add NIST SP 800-39 Enterprise Risk Management skill

[sjackson0109]

NIST SP 800-39 -- Managing Information Security Risk (Enterprise Risk Management)

Source: NIST Special Publication 800-39, March 2011
https://doi.org/10.6028/NIST.SP.800-39

---

Summary

This PR adds a complete Claude skill for NIST SP 800-39, the highest-level NIST risk management publication. SP 800-39 provides the enterprise governance framework within which SP 800-37 (the RMF) and SP 800-30 (risk assessments) operate. The skill covers the three-tier risk management hierarchy, all four risk management components (frame, assess, respond, monitor), risk framing, risk tolerance, risk response options, and risk monitoring.

---

Files Added

plugins/nist-sp-800-39/
  .claude-plugin/plugin.json
  skills/nist-sp-800-39/
    SKILL.md
    references/
      three-tier-model.md
      risk-framing.md
      risk-response-monitoring.md

---

Framework Coverage

Three-Tier Hierarchy: Organisation (Tier 1) governance structure and outputs; Mission/Business Process (Tier 2) functions, artefacts, and roles; Information System (Tier 3) RMF integration. Information flow tables covering top-down (direction/context), bottom-up (risk aggregation), and horizontal (within-tier sharing) flows.

Four Risk Management Components:

Component 1 -- Frame Risk: Risk assumptions (threat, vulnerability, impact, environmental, temporal); risk constraints (legal, policy, mission, budget, technology, workforce, contractual); risk tolerance dimensions with example statements; risk priorities and trade-off acknowledgements; complete risk framing document template.

Component 2 -- Assess Risk: Integration with SP 800-30; tier-scoped assessment types; risk aggregation from system level through business process to enterprise strategic view.

Component 3 -- Respond to Risk: All four options (Accept, Avoid, Mitigate, Transfer/Share) with when-to-use criteria, documentation requirements, authority levels by tier, risk response plan template, mitigation strategies at each tier, and transfer mechanism types and limitations.

Component 4 -- Monitor Risk: Control effectiveness monitoring activities; risk environment monitoring sources; risk acceptance review triggers; risk posture reporting structure by tier (Tier 3 to Tier 2 to Tier 1); immediate escalation triggers.

Integration Points

• NIST SP 800-30 Rev 1: SP 800-39 directs what is assessed; SP 800-30 provides the how-to methodology
• NIST SP 800-37 Rev 2: The RMF operates at Tier 3 within the SP 800-39 framework
• NIST SP 800-53 Rev 5: Controls provide the mitigation mechanisms at Tier 3
• NIST SP 800-137: Continuous monitoring feeds the Monitor component

Tests

All 10 plugin structure tests pass:

tests/test_plugin_structure.py::TestPluginDirectory::test_plugin_json_exists[nist-sp-800-39] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_plugin_json_is_valid[nist-sp-800-39] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_plugin_json_required_fields[nist-sp-800-39] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_plugin_version_semver[nist-sp-800-39] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_skills_directory_exists[nist-sp-800-39] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_skills_directory_has_one_skill_folder[nist-sp-800-39] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_skill_md_exists[nist-sp-800-39] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_skill_md_not_empty[nist-sp-800-39] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_no_files_outside_skill_folder[nist-sp-800-39] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_references_are_markdown[nist-sp-800-39] PASSED