/compliance-assessment

name: compliance-assessment
description: >-
  Gap-assess an organization or system against a compliance framework (SOC 2, ISO
  27001, PCI DSS, HIPAA, GDPR, NIST CSF/800-53), mapping controls to evidence,
  identifying gaps, and producing a prioritized remediation and audit-readiness plan.
  Use for compliance gap analysis, certification prep, or audit readiness.

Goal

A clear picture of where the org stands against the chosen framework: which controls are met, partial, or missing; the evidence for each; and a prioritized path to compliant + audit-ready.

Steps

1. **Scope & framework** — pick the framework(s) and define scope (systems, data, business units, the audit boundary). See `reference.md` for a per-framework map. 2. **Map controls** — enumerate the framework's controls/requirements; map each to the org's existing controls and the **evidence** that demonstrates it (policy, config, logs, tickets, attestations). 3. **Assess each control** — Met / Partial / Not met, with the evidence or the gap. Be honest; reuse outputs from the operational plugins as technical evidence (e.g. `cloud-security`, `sast-sca`, `detection-engineering`). 4. **Identify gaps & risk** — for each gap, the control intent, the exposure it leaves (link `risk-assessment`), and the effort to close. 5. **Prioritize remediation** — by risk and by audit deadline; assign owners and target dates. 6. **Audit readiness** — organize evidence, dry-run control testing, and a remediation tracker an auditor can follow.

Output

A compliance gap analysis: control · requirement · status · evidence · gap · owner · priority · target date, plus a remediation roadmap and an evidence index. Use `security-reporting`; visualize control coverage with `security-diagramming`.

Notes

Compliance ≠ security, but done well it raises the floor — map controls to *real* evidence, not aspirational policy. Many frameworks overlap heavily (ISO 27001, SOC 2, NIST); assess once and map to several to avoid duplicate work. Verify the current version of each framework. Track gaps with owners and dates — an audit is a deadline.