Given a target framework (ISO 27001, SOC2, GDPR, etc.) and information about current practices, produce four deliverables in order: Compliance Matrix → Gap Analysis → Audit Checklist → Remediation Plan.

Input: "Assess our SaaS platform against SOC2 Type II Trust Services Criteria"
Output:
1. Compliance Matrix mapping each TSC (Security, Availability, Processing
   Integrity, Confidentiality, Privacy) to current controls and evidence
2. Gap Analysis identifying missing/weak controls per criterion
3. Audit Checklist of items to verify before external audit
4. Remediation Plan with owners, priority, and timeline for each gap

Progress:

• Step 1: Identify applicable framework(s) and scope (systems, data, business units)
• Step 2: Gather evidence of current controls (policies, configs, logs, interviews)
• Step 3: Build Compliance Matrix (requirement → control → evidence → status)
• Step 4: Perform Gap Analysis (status = Compliant / Partial / Non-Compliant / N/A)
• Step 5: Draft Audit Checklist for pre-audit verification
• Step 6: Create Remediation Plan (gap → action → owner → priority → deadline)
• Step 7: Summarize overall risk posture and readiness score

Step details

1. Scope framework Clarify which standard(s) apply and any overlap (e.g., ISO 27001 + SOC2 share many controls — map once, reuse). Note applicable GDPR articles if personal data is processed (Art. 5, 6, 25, 30, 32, 33).

2. Gather evidence Ask for or infer: security policies, access control lists, encryption standards, incident response plans, vendor contracts, data flow diagrams, training records. Flag anything unverifiable as "evidence pending."

3. Compliance Matrix Table format:

4. Gap Analysis For every "Partial" or "Non-Compliant" item, state: root cause, risk level (Critical/High/Medium/Low), and business impact if unaddressed.

5. Audit Checklist Actionable yes/no items an auditor would check, grouped by domain (Access Control, Data Protection, Incident Management, Vendor Management, Change Management, Logging & Monitoring).

6. Remediation Plan Table format:

Prioritize Critical/High risk items first; group quick wins separately from long-term structural fixes.

Example 1: Input: "GDPR readiness check for a marketing platform storing EU customer emails" Output:

• Compliance Matrix: Art. 5 (data minimization) → Partial, only collecting necessary fields but no retention policy; Art. 32 (security) → Compliant, TLS + encryption at rest; Art. 30 (records of processing) → Non-Compliant, no ROPA maintained
• Gap Analysis: Missing ROPA = High risk (regulatory fine exposure); no retention policy = Medium risk
• Audit Checklist: "Is a Record of Processing Activities maintained and updated quarterly?" "Is there a documented data retention/deletion schedule?"
• Remediation Plan: Create ROPA (Owner: DPO, Priority: High, 30 days); Draft retention policy (Owner: Legal, Priority: Medium, 60 days)

Example 2: Input: "ISO 27001 gap assessment for access control domain (A.9)" Output:

• Compliance Matrix: A.9.2.1 (user registration) → Compliant; A.9.2.5 (access review) → Partial, reviews done annually instead of quarterly
• Gap Analysis: Infrequent access reviews = Medium risk of privilege creep
• Audit Checklist: "Are access rights reviewed at defined intervals?" "Is there evidence of deprovisioning within 24h of termination?"
• Remediation Plan: Implement quarterly access review process (Owner: IT Security, Priority: Medium, 45 days)