> ## Documentation Index
> Fetch the complete documentation index at: https://community.rifteo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance Gap Analyzer

> Aggregates audit findings mapped to framework controls, classifies each control, identifies blind spots, prioritizes gaps by severity, and produces a complete gap report supports ISO 27001, NIST CSF, PCI-DSS, and OWASP. Trigger when the user provides audit findings tagged to framework controls and asks for a gap report, asks what controls are failing or what their biggest compliance gaps are, needs to identify blind spots or untested controls, wants to compare current compliance posture against a previous audit, or shares pentest/audit results wanting them mapped to a compliance framework.

<Info>
  **Status:** Stable
  **Version:** 1.0.0
  **Author:** Rifteo
  **Tags:** compliance, security, reporting
</Info>

**Installation**

```bash theme={"system"}
rifteo-skills add compliance-gap-analyzer
```

***

## Summary

Turns a raw list of audit findings into a fully structured compliance gap report, covering status classification, gap prioritization, blind spot analysis, and optional delta comparison against a prior audit.

* Groups findings by framework and control, then applies a weakest-link rule to classify each control as Compliant, Partially Compliant, Non-Compliant, or Not Tested
* Assigns a Gap Priority Score (Critical → Low) based on finding severity and control criticality within the framework
* Surfaces blind spots controls that were in scope but never tested as unknown-risk items requiring explicit acknowledgment
* Optionally compares against a previous audit to flag regressions, closed gaps, and persistent issues

***

## SKILL.md file

<Accordion title="Discover skill details">
  ### Compliance Gap Analyzer

  Aggregate audit findings into a structured gap report across ISO 27001, NIST CSF, PCI-DSS, and OWASP frameworks.

  #### What Does It Check?

  This skill processes findings mapped to ISO 27001, NIST CSF, PCI-DSS v4, OWASP Top 10, and OWASP ASVS controls. It classifies each control using a weakest-link rule a single non-compliant finding marks the whole control as Non-Compliant. Partially Compliant controls are treated as gaps, not as passing. Blind spots (controls with no findings) are flagged separately because their risk is unknown.

  **In scope:**

  * ISO 27001 (2013 and 2022 Annex A), NIST CSF 1.1 and 2.0, PCI-DSS v3.2.1 and v4.0, OWASP Top 10 (A01–A10), OWASP ASVS (VX.Y.Z)
  * Single findings that map to multiple frameworks simultaneously
  * Delta analysis when a previous gap report is provided

  **Out of scope:**

  * Producing findings from raw scans or tool output use `finding-writer` first
  * Providing control definitions or cross-framework mappings use `control-lookup` for that

  #### How It Works

  **Step 1: Gather Inputs**

  Confirm the framework(s) in scope, the list of findings (each with a control reference, compliance status, and severity), and optionally a previous audit report for delta analysis.

  **Step 2: Normalize and Group**

  Group findings by framework and control, normalizing control IDs to canonical notation. Cross-framework findings appear in every relevant framework they are not deduplicated.

  **Step 3: Classify Each Control**

  Apply the weakest-link rule to produce one of four statuses per control: Compliant, Partially Compliant, Non-Compliant, or Not Tested (blind spot).

  **Step 4: Prioritize Gaps**

  Score each gap using finding severity (0–4) plus control criticality within the framework (0–2). Score 5–6 = Critical (48h); 3–4 = High (7 days); 2 = Medium (30 days); 0–1 = Low.

  **Step 5: Delta Analysis** *(optional)*

  Compare against a previous audit to identify new gaps, closed gaps, persistent gaps, regressions (controls that passed before and now fail), and blind spot changes.

  #### Output

  | Status          | Condition                                                               |
  | --------------- | ----------------------------------------------------------------------- |
  | Complete report | Findings are provided with control mappings                             |
  | Error           | No findings or control mappings provided skill stops and asks for input |

  Example output structure:

  ```
  Coverage Summary table
  Prioritized Gap List (ordered by Gap Priority Score)
  Blind Spots (Not Tested controls)
  Compliant Controls (summary only)
  Delta Analysis (if prior audit provided)
  Key Observations
  Recommended Next Steps
  ```

  #### Known Limitations

  * Requires findings to already have control references the skill does not auto-map raw vulnerabilities to controls
  * Compliance rate is calculated over tested controls only, not total controls in scope; coverage rate is reported separately
</Accordion>

***

## Benchmark Results

Tested on claude-sonnet-4-6 via Claude Code CLI. Same prompt, same model, same target. The only variable is whether the skill is loaded.

| Metric            | Without Skill | With Skill |
| ----------------- | ------------- | ---------- |
| Turns to complete | 1             | 1          |
| Response tokens   | \~4,317       | \~2,661    |
| Total time        | 88s           | 57s        |
| Output quality    | Partial       | Complete   |

***

## Related skills

<CardGroup cols={3}>
  <Card title="finding-writer" href="/skills/finding-writer">
    Convert raw pentest notes into structured audit findings ready for reporting
  </Card>

  <Card title="control-lookup" href="/skills/control-lookup">
    Look up any control ID and map it across ISO 27001, NIST CSF, PCI-DSS, and OWASP
  </Card>

  <Card title="risk-assessor" href="/skills/risk-assessor">
    Score a vulnerability using likelihood × impact with SLA-bound remediation urgency
  </Card>
</CardGroup>