framework-mapper

---
name: framework-mapper
description: Map security controls, policies, evidence or requirements across frameworks (ISO 27001:2022, NIST CSF 2.0, CIS Controls v8, SOC 2, NIS2, DORA, EU AI Act) and run gap analyses. Use when the user asks "which ISO control covers X", wants a control crosswalk, needs to reuse evidence for multiple audits, is preparing for a new certification or regulation, or asks for a compliance gap assessment.
---

# Framework Mapper

Help security and GRC teams **do the work once and prove it many times**. Map what the organisation already has to the frameworks it must meet, and show exactly where the gaps are.

## Modes

Identify which mode the user needs (it may be several):

1. **Lookup** — "What does NIST CSF say about backups?" / "Which ISO control is supplier security?"
2. **Crosswalk** — map a list of internal controls or policies to one or more target frameworks.
3. **Gap analysis** — compare current controls/evidence against a target framework and list what is missing.
4. **Evidence reuse** — given one piece of evidence (e.g. a pentest report), list every requirement it can support.
5. **Regulatory scoping** — help decide whether NIS2, DORA or the EU AI Act likely applies (always flag that legal confirmation is required).

## Workflow

1. **Clarify scope** (one short question if unclear): target framework(s) and versions, in-scope business units/systems, and the format wanted (table, spreadsheet-ready CSV, narrative).
2. **Load the crosswalk**: read `references/crosswalk.md` for domain-level mappings and `references/framework-notes.md` for structure, versions and key obligations.
3. **Normalise inputs**: give each user control a short ID (e.g. `ORG-01`) and a one-line description of what it actually does — not what the policy title claims.
4. **Map** at the right granularity:
   - Map to **specific control/category IDs** only when confident. Otherwise map to the domain/function and say "verify specific clause".
   - Rate each mapping: **Full** (control meets the requirement's intent), **Partial** (covers part — say which part is missing), **None**.
5. **Gaps**: for each target requirement with no Full mapping, write a remediation action, a suggested owner role, effort (S/M/L) and the evidence an auditor would expect.
6. **Prioritise** gaps: legal/regulatory obligations and certification blockers first, then high-risk technical gaps, then documentation gaps.

## Output format

Default to a table, then a short prioritised action list:

| Internal control | ISO 27001:2022 | NIST CSF 2.0 | SOC 2 | Other | Coverage | Gap / note |
|---|---|---|---|---|---|---|

For gap analyses, finish with: coverage summary (% Full / Partial / None per framework), top 10 actions, and the evidence checklist.
Offer a CSV version for import into a GRC tool or spreadsheet.

## Accuracy rules (critical)

- **Never invent control IDs, clause numbers or article numbers.** If you are not certain an identifier exists and says what you claim, give the domain and write "confirm exact reference".
- Distinguish ISO 27001 **clauses 4–10** (management system requirements, mandatory) from **Annex A controls** (selected via the Statement of Applicability).
- State framework versions explicitly (ISO 27001:2022 not :2013 — note the 2013→2022 renumbering if the user's evidence uses old IDs).
- Mappings between frameworks are **interpretive**. Say so once in the output and recommend validation by the organisation's auditor or assessor.
- Regulatory applicability (NIS2, DORA, AI Act) depends on legal entity, sector, size and member-state transposition. Provide an indicative view and recommend legal review; never state "you are not in scope" as fact.
- The frameworks' official texts are copyrighted in places (notably ISO). Paraphrase control intent; do not reproduce full control text.

• SKILL.md 4 KB
• references/crosswalk.md 4 KB
• references/framework-notes.md 5 KB