Compliance Control Mapper
Maps one control set to SOC 2, ISO 27001, ISO 42001 and EU AI Act with owners, evidence tracking, and gaps ranked by audit risk.
Before & after
Same prompt, same agent — the only difference is the skill.
I can help you set up compliance documentation for your organization. Security and compliance can be complex, and it depends a lot on your industry, company size, and any regulations you need to follow. Are you in healthcare, fintech, SaaS, or something else? That makes a big difference because HIPAA, SOC 2, GDPR, and PCI-DSS all have different requirements. Do you have existing policies, or are we starting from scratch? Also, who's going to own these docs going forward — a single compliance officer or a distributed team? How large is your security team, and do you have any compliance experience already? I can outline a framework for compliance documentation, but we'd need to customize it based on your specific situation. What regulatory bodies do you need to satisfy, and what's your timeline for getting compliant?
COMPLIANCE FRAMEWORK - STAGED ROLLOUT PHASE 1: FOUNDATION (Week 1-2) Assets to document: • Inventory of systems, data stores, APIs • Access control matrix (who can access what) • Data classification (public/internal/confidential/restricted) • Incident response runbook • Backup and disaster recovery procedures Owner: VP Security, review by CFO PHASE 2: POLICIES (Week 3-4) • Information security policy • Access management policy • Change management process • Third-party vendor risk assessment template • Data retention and disposal procedures • Acceptable use policy Owner: Legal + Security, distribute to all employees PHASE 3: CONTROLS (Week 5-6) Implement monitoring: • VPN/MFA enforcement (audit logs) • Password manager rollout (Vault/1Password) • Code repository access review (GitHub/GitLab audit) • Network segmentation documentation Owner: Infrastructure team, sign-off by Security lead PHASE 4: AUDIT & EVIDENCE (Week 7-8) • SOC 2 Type II audit scope (3-6 months concurrent evidence) • GDPR audit (data processing agreement templates) • Annual policy review calendar • Compliance training for all staff Owner: Third-party auditor + Internal compliance officer DELIVERABLES Google Workspace folder (shared with team). Matrix: 15 policies, 23 controls, 8 audit areas. Timeline: 8-week sprint with 2 governance meetings monthly.
About this skill
Stop doing the same compliance work once per framework. This skill builds one set of controls, maps each to every framework it satisfies with requirement IDs, and shows what evidence is still missing.
What it does
- Scopes frameworks, audit dates, system boundary, and existing artifacts
- Maps against SOC 2 Trust Services Criteria (CC1-CC9 plus A1, C1, PI1, P1-P8), ISO 27001:2022 clauses 4-10 and Annex A, ISO 42001 clauses 4-10 and Annex A (A.2-A.10), and EU AI Act articles
- Writes each control once as a testable statement with owner, frequency, and evidence
- Marks readiness as Designed, Implemented, Evidenced, or Missing
- Ranks gaps with management-system requirements (risk assessment, Statement of Applicability, internal audit) first
What you get
A control map with cross-framework mappings, management-system requirements status, a ranked gap list, an evidence calendar, and stated assumptions.
Best for
Startups and scale-ups preparing for SOC 2 or ISO 27001, or adding ISO 42001 and EU AI Act obligations for AI products.
SKILL.md preview
---
name: compliance-control-mapper
description: Build a unified control set that maps once to many frameworks - SOC 2 (Trust Services Criteria), ISO/IEC 27001:2022, ISO/IEC 42001:2023, and EU AI Act obligations - with an evidence tracker, owners, and a gap list ranked by audit risk. Use when the user says "we need SOC 2 and ISO 27001 without doing the work twice", "map our controls", "are we audit ready?", "what evidence do we need?", or is adding an AI governance framework on top of an existing security program. Also triggers on "which SOC 2 criteria does this control cover?", "quick check on our audit readiness", or "ISO 27001 Annex A mapping for access reviews".
---
… (sign up to view the full skill)More business & ops skills
View all Business & Ops skills →General Counsel Plan Review
A General Counsel issue-spot of one plan: IP, worker classification, securities, privacy, export, ads, and when you need a lawyer.
ISO 42001 Gap Assessment
Assess your AI management system against ISO/IEC 42001 clauses 4-10 and Annex A, draft the SoA, and plan certification.
Services Proposal, SOW and Contract Drafter
Draft proposals, SOWs, freelance agreements, MSAs, and NDAs with acceptance, change orders, payment, and IP terms. Counsel-review flagged.
General Counsel Advisor
On-call startup General Counsel: founder IP, equity, contractors, SAFEs and term sheets, privacy, demand letters, and when to call a lawyer.