Compliance Gap Analyzer

Aggregate audit findings into a structured gap report across ISO 27001, NIST CSF, PCI-DSS, and OWASP frameworks.

When to Use This Skill

Use this skill when the user:

Provides a list of audit findings tagged to framework controls and asks for a gap report
Asks “what controls are failing?” or “what are our biggest compliance gaps?”
Needs to identify blind spots or untested controls in an audit scope
Wants to compare current compliance posture against a previous audit (delta analysis)
Shares pentest or audit results and wants them mapped to a compliance framework

What Does It Check?

This skill processes findings mapped to ISO 27001, NIST CSF, PCI-DSS v4, OWASP Top 10, and OWASP ASVS controls. It classifies each control using a weakest-link rule a single non-compliant finding marks the whole control as Non-Compliant. Partially Compliant controls are treated as gaps, not as passing. Blind spots (controls with no findings) are flagged separately because their risk is unknown.In scope:

ISO 27001 (2013 and 2022 Annex A), NIST CSF 1.1 and 2.0, PCI-DSS v3.2.1 and v4.0, OWASP Top 10 (A01–A10), OWASP ASVS (VX.Y.Z)
Single findings that map to multiple frameworks simultaneously
Delta analysis when a previous gap report is provided

Out of scope:

Producing findings from raw scans or tool output use finding-writer first
Providing control definitions or cross-framework mappings use control-lookup for that

How It Works

Step 1: Gather InputsConfirm the framework(s) in scope, the list of findings (each with a control reference, compliance status, and severity), and optionally a previous audit report for delta analysis.Step 2: Normalize and GroupGroup findings by framework and control, normalizing control IDs to canonical notation. Cross-framework findings appear in every relevant framework they are not deduplicated.Step 3: Classify Each ControlApply the weakest-link rule to produce one of four statuses per control: Compliant, Partially Compliant, Non-Compliant, or Not Tested (blind spot).Step 4: Prioritize GapsScore each gap using finding severity (0–4) plus control criticality within the framework (0–2). Score 5–6 = Critical (48h); 3–4 = High (7 days); 2 = Medium (30 days); 0–1 = Low.Step 5: Delta Analysis (optional)Compare against a previous audit to identify new gaps, closed gaps, persistent gaps, regressions (controls that passed before and now fail), and blind spot changes.

Output

Status	Condition
Complete report	Findings are provided with control mappings
Error	No findings or control mappings provided skill stops and asks for input

Example output structure:

Coverage Summary table
Prioritized Gap List (ordered by Gap Priority Score)
Blind Spots (Not Tested controls)
Compliant Controls (summary only)
Delta Analysis (if prior audit provided)
Key Observations
Recommended Next Steps

Known Limitations

Requires findings to already have control references the skill does not auto-map raw vulnerabilities to controls
Compliance rate is calculated over tested controls only, not total controls in scope; coverage rate is reported separately

Metric	Without Skill	With Skill
Turns to complete	1	1
Response tokens	~4,317	~2,661
Total time	88s	57s
Output quality	Partial	Complete

Compliance Gap Analyzer

Summary

SKILL.md file