Purpose
Compare an organization's existing policy inventory against a specified compliance framework's policy requirements, then flag every missing, outdated, or inadequate policy with a severity rating and a concrete remediation action — so compliance teams know exactly what to write, revise, or retire before an audit.
When to Use
Invoke this skill when the user asks to:
- Check whether their current policies satisfy ISO 27001, SOC 2, NIST CSF, HIPAA, GDPR, or another framework
- Prepare a policy set for an upcoming audit or certification
- Identify which required policies they are missing
- Assess whether existing policies are outdated or too thin to pass an assessment
- Build a policy program from scratch against a framework's requirements
- Prioritize policy remediation work before a compliance deadline
Inputs Required
Before starting, collect:
- Target framework: The framework or standard to assess against (e.g., ISO 27001:2022, SOC 2 Type II, NIST CSF 2.0, HIPAA Security Rule, GDPR)
- Policy inventory: List or paste of current policies — titles at minimum; content or summaries improve accuracy
- Policy metadata: For each policy, last review/approval date and owner if known
- Policy domains in scope: Information security / data governance / acceptable use / all
- Organization context: Industry, size, and whether the org is regulated (helps set applicability)
- Assessment driver: Upcoming audit, certification renewal, new-program build, or internal review
- Known constraints: Areas the org already knows are weak or intentionally out of scope
If policy content isn't provided, assess against titles and metadata only, and explicitly flag which findings require content review to confirm.
Instructions
Step 1: Establish the Framework Requirement Set
Identify the policies the chosen framework expects. Map to the framework's control structure:
- ISO 27001:2022: Annex A control themes (Organizational, People, Physical, Technological) — expect an ISMS scope, information security policy, access control, cryptography, supplier security, incident management, business continuity, and acceptable use policies
- SOC 2: Trust Services Criteria (Security, Availability, Confidentiality, Processing Integrity, Privacy) — expect security, change management, logical access, vendor risk, incident response, and monitoring policies
- NIST CSF 2.0: Govern, Identify, Protect, Detect, Respond, Recover — expect governance, risk assessment, asset management, access control, awareness training, and recovery policies
- HIPAA Security Rule: Administrative, Physical, Technical safeguards — expect risk analysis, workforce security, access control, audit controls, and contingency policies
- GDPR: Expect data protection, retention/disposal, data subject rights, DPIA, breach notification, and international transfer policies
List each required policy with a one-line description of what the framework expects it to cover.
Step 2: Match Inventory to Requirements
For every required policy, classify the org's current state:
- Present & adequate: A matching policy exists and (if content is available) covers the requirement
- Present but inadequate: A matching policy exists but is too thin, misses required elements, or covers the wrong scope
- Present but outdated: Last reviewed more than 12 months ago, references retired systems/regulations, or predates a framework version change
- Missing: No corresponding policy exists
Match on function, not title — an "IT Usage Standard" may satisfy an acceptable use requirement even under a different name.
Step 3: Rate Each Gap by Severity
Assign a severity to every gap using consistent criteria:
- Critical: A framework-mandated policy is entirely missing, or an existing one would cause an audit finding/certification failure
- High: Policy exists but omits required elements, or is outdated in a way that affects a core control
- Medium: Policy is present but stale (aging past review cycle) or partially inadequate without core-control impact
- Low: Cosmetic or maintenance issues — formatting, ownership gaps, minor version drift
Step 4: Write Remediation Recommendations
For each gap, provide a specific action — not "update this policy." State:
- What to create, revise, or retire
- The specific elements or clauses to add
- The framework control(s) the fix satisfies
- An estimated effort level (Quick fix / Moderate / New document)
Step 5: Build the Prioritized Remediation Roadmap
Sequence the fixes:
- Immediate (0–30 days): All Critical gaps
- Near-term (30–90 days): High gaps and any outdated core policies
- Ongoing (90+ days): Medium and Low gaps, plus establishing a recurring review cadence
Recommend a standing review cycle (typically annual, or on framework/regulatory change) to prevent future drift.
Output Format
- Structure: Executive summary → coverage table → gap detail entries → prioritized roadmap
- Length: 900–1,400 words depending on inventory size
- Format: Coverage summary as a table (Required Policy | Status | Severity); each gap detailed in structured bullets; roadmap as a phased list
- Sections: Assessment Summary → Framework Coverage Table → Gap Findings (grouped by severity) → Remediation Roadmap → Review Cadence Recommendation
- Tone: Compliance manager to leadership — precise, evidence-based, non-alarmist; every claim tied to a framework requirement
Quality Checklist
Before delivering output, verify:
- [ ] Every required policy from the framework appears in the coverage table with a status
- [ ] Each gap has a severity rating using the four defined levels — not arbitrary labels
- [ ] Each remediation recommendation names the specific policy element to add and the control it satisfies — no "update this policy" filler
- [ ] Findings based on title/metadata only (no content) are explicitly flagged as requiring content review
- [ ] The roadmap places all Critical gaps in the Immediate phase
- [ ] Every finding cites the framework control or clause driving the requirement
Notes
- Match policies by function, not name — orgs frequently satisfy a requirement under a differently titled document
- A policy dated 18+ months ago is not automatically inadequate, but auditors treat stale review dates as a red flag; call these out even when content looks sound
- When multiple frameworks apply, note where a single well-written policy can satisfy overlapping requirements to reduce document sprawl
- Distinguish policy gaps (the document) from control gaps (the practice) — this skill assesses documented policy coverage, and evidence of implementation is a separate review
How to use this skill
This file is a Claude Code skill in Anthropic's standard format — markdown with YAML frontmatter at the top.
Installing in Claude Code:
~/.claude/skills/<folder-name>/SKILL.md— auto-loads in every session anywhere on your machine (recommended for skills you'll use across multiple projects)<your-project>/.claude/skills/<folder-name>/SKILL.md— auto-loads only when working in that project (recommended for project-specific skills)
Restart Claude Code or open a new session to register.
Using in Claude.ai, ChatGPT, Gemini, or other AI tools:
- Drag this file into a new chat, or copy and paste its contents
- Send your task or request as your next message — the AI will apply the skill where it fits
For Claude Code skill details: https://docs.anthropic.com/en/docs/claude-code/skills