Assess our security against a framework and find the gaps
Maps your current controls to CIS Controls or NIST CSF, scores maturity, and builds a prioritized improvement roadmap.
The prompt
Help me assess our security program against a framework and find the biggest gaps.
Framework: [CIS Controls v8 (and implementation group IG1/IG2/IG3) / NIST CSF 2.0 / ISO 27001 Annex A / other]
Organization: [size, industry, IT model - e.g. "120 staff, mostly SaaS, M365, small IT team"]
What we have in place: [PASTE tools, policies, processes - be honest about partial ones]
Known weak spots: [WHAT worries me]
Budget and staff capacity for next 12 months: [ROUGH]
Why we're doing this: [customer requirement / insurance / audit / board ask / self-improvement]
Steps:
1. Map what I described to the framework's controls or functions. For each: in place / partial / not in place / unknown.
2. Score maturity simply (0-3) with a one-line reason. Where I gave too little detail, mark [NEED EVIDENCE] instead of scoring.
3. Identify the top gaps by risk reduction for our size, not by framework order. Basics first (asset inventory, MFA, patching, backups, logging).
4. For each top gap: a concrete fix, rough effort (low/medium/high), and whether it needs budget.
Return:
- A gap table: Control or function | Current state | Score | Gap | Recommended action | Effort | Priority.
- A 12-month roadmap by quarter.
- A one-paragraph summary for leadership.
Do not claim we are compliant or certified with any framework; this is a self-assessment to plan improvements.
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Legal & Compliance prompts
What to fill in
- WHAT worries me
- ROUGH
- NEED EVIDENCE
How this prompt is built
This prompt follows the RTF structure (Role, Task, Format). RTF tells the model who to be, what to do and what shape the answer should take. It is the quickest structure that still gives noticeably better results than a bare request.
Related prompts
- Review a customer's redlines to my SaaS subscription agreementA clause-by-clause read of an enterprise customer's markup with risk ratings, fallback positions, and reply language.
- Check my dietary supplement labels and marketing for FDA compliance risksFlags disease claims, missing disclaimers, and labeling gaps in supplement packaging and ads under US FDA and FTC rules.
- Review open-source licenses in our software for compliance riskSorts dependencies by license type, flags copyleft and distribution triggers, and lists the notices and actions engineering must take.
- Review a subcontract for risky construction clausesA clause-by-clause review of a subcontract flagging pay-if-paid, indemnity, delay, and flow-down risks, with negotiation asks.