{"id":53959,"plugin_id":"plugins_6ac95798b0208191a0e2de50b78c9733","kind":"skill","collection_source":"plugin_package","comparison_source":null,"observed_at":"2026-10-24T13:55:27.332Z","digest":"8a4a0689eee4f24bad9b8244b5d14d19e9e920cb1aeb85ad058259290e927cee","against":null,"payload":{"description":"Use when the user asks to assess ISO 27001:2022 policies, procedures, records, screenshots, exports, or other evidence for gaps, readiness, or audit preparation.","included_files":[],"name":"iso27001-gap-assessment","skill_md_contents":"---\nname: iso27001-gap-assessment\ndescription: Use when the user asks to assess ISO 27001:2022 policies, procedures, records, screenshots, exports, or other evidence for gaps, readiness, or audit preparation.\n---\n\n# Compliance Gap Hunter\n\nPerform an evidence-scoped ISO 27001:2022 gap assessment. Produce a defensible\nworking report, not a certification decision.\n\n## Scope and safety boundaries\n\n- Assess only material supplied by the user or an explicitly provided authoritative reference.\n- Never invent a clause number, Annex A control number, title, or requirement.\n- If the exact mapping is not supported, label it `unverified mapping` and request the authoritative source.\n- Treat missing, inaccessible, stale, ambiguous, simulated, or contradictory evidence as unverified; never treat it as proof of non-compliance or compliance.\n- Do not claim certification, conformity, audit completion, legal compliance, or operating effectiveness from documents alone.\n- Do not expose secrets, credentials, tokens, unnecessary personal identifiers, or confidential material in the report.\n\n## Evidence model\n\nFor every finding, preserve an evidence pointer: filename, section, page, record ID,\ntimestamp, or short quoted fragment. Use stable IDs such as `CGH-001`.\n\nClassify evidence as:\n\n- `verified`: directly supplied, attributable, current enough for scope, and consistent.\n- `partially verified`: some required elements are present but material elements are missing or ambiguous.\n- `unverified`: asserted, inaccessible, stale, simulated, or dependent on an untested assumption.\n- `contradicted`: supplied evidence conflicts; cite both sources and do not silently resolve it.\n\n## Keep gap categories separate\n\n1. `document_gap`: required policy, procedure, scope, objective, responsibility, criterion, record format, or documented information is absent or incomplete.\n2. `implementation_gap`: documentation or an assertion exists, but deployment or operating practice is not shown.\n3. `operating_effectiveness_gap`: implementation is evidenced, but recurring records, sampling, monitoring, review, results, or corrective action do not demonstrate that the process works over time.\n4. `mapping_or_evidence_gap`: exact requirement mapping or source is not established. Do not convert this into a substantive control failure.\n\n## Assessment method\n\n1. Inventory supplied artifacts and state scope, exclusions, evidence date and limitations.\n2. Extract only explicit requirements, identifiers, claims, records, approvals, timestamps, owners and review results.\n3. Map evidence only when the mapping is supported; otherwise use `unverified mapping`.\n4. Test design/documentation, implementation and operating effectiveness separately.\n5. Record positive evidence and distinguish `verified`, `prepared but unverified`, `blocked`, and `not assessed`.\n6. Assign practical priority (`critical`, `high`, `medium`, `low`, or `observation`) with a plain-language basis.\n7. End with the smallest evidence requests and an action plan that states closure evidence.\n\n## Required report\n\n```markdown\n# ISO 27001:2022 Evidence-Scoped Gap Assessment\n\n## Status\n- Overall assessment status:\n- Assessment scope:\n- Evidence reviewed:\n- Evidence date / freshness:\n- Exclusions and limitations:\n- Standard source and mapping confidence:\n\n## Executive summary\n\n## Findings\n| ID | Category | Requirement/control mapping | Conclusion | Evidence pointer | Evidence quality | Priority | Closure evidence |\n|---|---|---|---|---|---|---|---|\n\n## Positive evidence\n\n## Uncertainty and blockers\n\n## Evidence request list\n\n## Audit-ready action plan\n| Action | Owner | Target evidence | Dependency | Acceptance condition |\n|---|---|---|---|---|\n\n## Assessor notes\n```\n\n## Evidence interpretation rules\n\n- A policy supports design/documentation claims only. It does not prove implementation or operating effectiveness.\n- A configuration or deployment record may support implementation, but recurring records and review results are still needed for effectiveness.\n- If evidence conflicts, create a contradiction finding and cite both sources.\n- If the user provides only narrative, provide a preliminary assessment and evidence request list; do not fabricate a complete matrix.\n"},"changes":[],"summary":"First saved snapshot. No earlier version is available for comparison.","summary_kind":"deterministic","summary_metadata":{}}