Compliance Gap Analysisv0.1.3

A B2B SaaS startup's CTO needs to prove security posture to enterprise prospects. The skill guides an assessment against SOC 2 common criteria, collects evidence per control domain, and produces a gap analysis matrix with a prioritized remediation roadmap before the auditor arrives.

A healthcare compliance officer assesses administrative, physical, and technical safeguards against HIPAA after a re-accreditation audit. The skill walks through PHI-handling domains, records unknown controls as gaps, and generates risk-rated findings and a breach-notification readiness plan.

A payments team maps their cardholder data environment against PCI-DSS requirements. The skill evaluates network security, access control, and monitoring domains, flags scope gaps like third-party processors, and outputs a remediation roadmap for the QSA assessment.

An international retailer expanding to the EU needs to assess data subject rights, cross-border transfers, and processor agreements. The skill collects evidence per GDPR domain, identifies gaps, and produces a prioritized plan for appointing a DPO and updating privacy notices.

A public sector security analyst evaluates their cybersecurity posture against NIST CSF's Identify, Protect, Detect, Respond, and Recover functions. The skill captures vague answers with follow-up questions, rates unmapped controls, and delivers an executive-ready gap analysis for funding requests.

A company offers subscription-based tools and expert guidance for organizations to self-assess against regulatory frameworks. The skill automates structured assessments and report generation, reducing manual consulting hours and scaling to many clients.

A small advisory firm uses the skill to standardize client engagements across GDPR, SOC 2, and ISO 27001. Consultants run the guided assessment in workshops, then deliver a branded gap analysis and remediation roadmap as a paid project deliverable.

Enterprises deploy the skill as an internal capability for their security and audit teams to run recurring assessments. It reduces reliance on external auditors for pre-assessments and centralizes evidence collection across business units.