SOC 2 or ISO 27001 readiness
Get a requirement-by-requirement position before an external assessor produces it for you.
— Risk & Compliance
Control gap assessment (SOC 2 / ISO 27001)
Extracts documented controls and framework requirements, then grades every requirement covered, partial or absent for SOC 2 or ISO 27001 readiness.
- Risk & Compliance
- Traceable reasoning
- Runs anywhere
2–3 weeks → ~15 minutes
For one complete, review-ready pass
No coding required
- Input
- Your process or policy documentation
- Output
- Covered / partial / absent status per requirement
- Runs in
- Skillsize · ChatGPT · Claude · Copilot
- Export
- SKILL.md · MCP
- Time saved
- ~2–3 weeks per run
— USE CASES
What people use Control gap assessment (SOC 2 / ISO 27001) for
Post-acquisition control review
Assess an acquired entity's documented controls against your own framework in one pass.
Annual control refresh
Re-run the same mapping after process changes to see which controls have drifted to partial.
What it works from
- Your process or policy documentation
- The framework reference
- Any scoping decisions or exclusions
What you get back
- Covered / partial / absent status per requirement
- Missing and weak controls flagged with remediation priority
- A reusable mapping for the next audit cycle
— HOW IT BEHAVES
How Control gap assessment (SOC 2 / ISO 27001) produces its result
The mechanics behind this specific template — what it reads, what it calculates, and where a human stays in the loop.
Coverage across the risk universe in scope, both directions
A coverage pass shows which risks are supported by evidence and which are not — including requirements with nothing behind them and material that supports nothing.
Composed as work product
Findings on the risk universe in scope are written up as a document that reads like professional output, with each claim tied back to a risk.
Criteria-based analysis of every risk
Each risk is assessed against explicit criteria you control, so the same standard is applied across the risk universe in scope on every run.
Structured extraction from risk registers, controls and policy documents
Facts and fields are lifted out of risk registers, controls and policy documents and held in a consistent shape, risk by risk.
Why this is expensive by hand
Certification readiness stalls on mapping what you actually do to what the framework requires. SOC 2 or ISO 27001 readiness is the typical trigger — get a requirement-by-requirement position before an external assessor produces it for you. Done properly it is defensible; done at pace it becomes a judgement call nobody can retrace. And "properly" usually means 2–3 weeks of manual work.
How this Skill produces it
Here the same job runs as a Skill. Your material goes in; covered / partial / absent status per requirement comes out, alongside missing and weak controls flagged with remediation priority. The judgement is built in — how items are broken up, what standard they are held to, and where the run stops for a human review. In effect, 2–3 weeks of senior time compresses into ~15 minutes — and the output is comparable across clients, quarters and colleagues instead of shaped by whoever ran it.
Who it's for
- Internal audit and risk functions
- Compliance and controls teams
- Second-line functions reporting to committees
- Risk consultants running assessments
Run it in Skillsize — or export it anywhere
Control gap assessment (SOC 2 / ISO 27001) exports as a structured SKILL.md file and is MCP-ready, so the same method runs in ChatGPT, Claude, Copilot or your own AI products. Adapt it to your methodology, and the intelligence stays yours — not locked to one vendor.
ChatGPTClaudeCopilotAI Products (MCP)
Related Skill Templates
More Risk & Compliance templates →Risk & Compliance
Data Subject Access Request (DSAR) Engine
Assesses a data subject access request end to end and returns a governed decision on whether to fulfil it, fulfil it in part, refuse it with reasons or extend the deadline, having verified identity, mapped the request to the systems that actually hold the data and held the outcome for a data protection sign-off before anything is disclosed.
Risk & Compliance
Findings consolidation
Fans multiple audit or review reports into individual findings, deduplicates repeats, and sorts them by severity into one consolidated register with sources retained.
Risk & Compliance
Audit evidence mapping
Pairs a full evidence set against every audit assertion or PBC item to produce a coverage matrix, naming the assertions nothing supports and the documents supporting nothing.
Risk & Compliance
Claims Coverage Triage Engine
Reads a submitted claim against the policy wording that governs it and returns a coverage assessment showing whether it appears covered, potentially excluded or in need of specialist review, mapped clause by clause and never issued without a handler's sign-off.
Risk & Compliance
Incident Severity & Response
Assesses a reported incident against your response playbook and policies, assigns the severity band the evidence supports, and returns the matching response plan with the notifications, owners and timelines that band requires.
Risk & Compliance
Privacy / Data-Transfer Approval
Assesses personal-data processing and cross-border transfers against privacy policy and jurisdiction rules, producing a documented approval outcome with conditions, policy evidence and grounds for referral.