# Assess our security against a framework and find the gaps

Maps your current controls to CIS Controls or NIST CSF, scores maturity, and builds a prioritized improvement roadmap.

- Topic: Legal & Compliance
- Framework: RTF
- Level: Standard
- Tags: Legal, Analyze, Code, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/assess-our-security-against-a-framework-and-find-the-gaps

## Prompt

```text
Help me assess our security program against a framework and find the biggest gaps.

**Framework:** [CIS Controls v8 (and implementation group IG1/IG2/IG3) / NIST CSF 2.0 / ISO 27001 Annex A / other]
**Organization:** [size, industry, IT model - e.g. "120 staff, mostly SaaS, M365, small IT team"]
**What we have in place:** [PASTE tools, policies, processes - be honest about partial ones]
**Known weak spots:** [WHAT worries me]
**Budget and staff capacity for next 12 months:** [ROUGH]
**Why we're doing this:** [customer requirement / insurance / audit / board ask / self-improvement]

Steps:
1. Map what I described to the framework's controls or functions. For each: in place / partial / not in place / unknown.
2. Score maturity simply (0-3) with a one-line reason. Where I gave too little detail, mark [NEED EVIDENCE] instead of scoring.
3. Identify the top gaps by risk reduction for our size, not by framework order. Basics first (asset inventory, MFA, patching, backups, logging).
4. For each top gap: a concrete fix, rough effort (low/medium/high), and whether it needs budget.

Return:
- A gap table: Control or function | Current state | Score | Gap | Recommended action | Effort | Priority.
- A 12-month roadmap by quarter.
- A one-paragraph summary for leadership.

Do not claim we are compliant or certified with any framework; this is a self-assessment to plan improvements.
```

## What to fill in

- WHAT worries me
- ROUGH
- NEED EVIDENCE

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.