AI Skill Report Card
Governing Infrastructure
Quick Start13 / 15
Given an infrastructure description (architecture diagram, IaC repo, cloud account, or system inventory), produce three deliverables:
- Infrastructure Assessment — current state, architecture, dependencies, risk areas
- Compliance Report — gap analysis against governance standards (security, resilience, policy)
- Improvement Plan — prioritized, actionable remediation roadmap
Example invocation: "Assess our AWS production environment for resilience and compliance gaps."
Recommendation▾
Add a third example showing a fully compliant/low-risk scenario to demonstrate the full status range, not just gap-heavy cases
Workflow14 / 15
Progress:
- Step 1: Gather inputs — architecture docs, IaC (Terraform/CloudFormation), inventory, incident history, compliance requirements (ISO 27001, SOC2, internal policy, etc.)
- Step 2: Build the Infrastructure Assessment — map topology, components, data flows, dependencies, single points of failure
- Step 3: Evaluate against governance dimensions:
- Compliance: policy adherence, access controls, encryption, tagging/naming standards, audit logging
- Resilience: redundancy, failover, backup/DR, RTO/RPO alignment, capacity headroom
- Governance: change management, ownership clarity, cost controls, documentation currency
- Step 4: Produce Compliance Report — list each requirement, current status (Compliant / Partial / Non-Compliant), evidence, gap description
- Step 5: Produce Improvement Plan — prioritized actions (Critical/High/Medium/Low), owner, effort estimate, expected risk reduction
- Step 6: Summarize overall governance maturity and top 3 risks requiring immediate attention
Recommendation▾
Include specific named standards (e.g., CIS Benchmarks, NIST 800-53) referenced in the compliance mapping to make the gap analysis more concrete
Output Format
Markdown# Infrastructure Assessment
Overview
[Scope, systems in scope, assessment date]
Architecture & Dependencies
[Key components, topology, critical dependencies, SPOFs]
Risk Observations
[Notable risks found during assessment]
Compliance Report
| Requirement | Category | Status | Evidence | Gap |
|---|---|---|---|---|
| ... | Security/Resilience/Governance | Compliant/Partial/Non-Compliant | ... | ... |
Improvement Plan
| Priority | Action | Owner | Effort | Risk Reduced |
|---|---|---|---|---|
| Critical | ... | ... | ... | ... |
Summary
- Overall maturity: [Initial/Developing/Managed/Optimized]
- Top 3 risks: ...
Examples15 / 20
Example 1: Input: "Review our multi-region AWS setup: single RDS instance in us-east-1, no automated backups verified, IAM roles not reviewed in 18 months." Output:
- Infrastructure Assessment: notes single-region database dependency despite multi-region compute, backup verification gap, stale IAM review cycle
- Compliance Report: "Backup & Recovery" = Non-Compliant (no verified restore tests); "Access Review" = Non-Compliant (>90 day review policy violated)
- Improvement Plan: Critical — implement RDS Multi-AZ + cross-region read replica; Critical — automate backup restore testing; High — quarterly IAM access review automation
Example 2: Input: "Our Kubernetes cluster has no pod disruption budgets and secrets stored in plaintext ConfigMaps." Output:
- Infrastructure Assessment: flags resilience gap (no PDBs → risk during node drains) and security gap (plaintext secrets)
- Compliance Report: "Secrets Management" = Non-Compliant; "High Availability Config" = Partial
- Improvement Plan: Critical — migrate secrets to Vault/Sealed Secrets; High — define PDBs for all critical workloads
Recommendation▾
Expand on how to handle conflicting or ambiguous compliance requirements across different frameworks (e.g., SOC2 vs internal policy)
Best Practices
- Always tie findings to concrete evidence (config snippets, metrics, logs) — avoid vague statements.
- Rate compliance status objectively using a fixed scale (Compliant/Partial/Non-Compliant), never skip evidence.
- Prioritize remediation by risk impact × likelihood, not just effort.
- Call out single points of failure explicitly — they are the highest-value resilience findings.
- Keep the Improvement Plan actionable: each item needs an owner-type and effort estimate, not just "fix this."
Common Pitfalls
- Don't produce a compliance report without mapping to specific named requirements/standards.
- Don't bundle unrelated risks into one improvement item — keep actions atomic and trackable.
- Don't ignore governance/process gaps (ownership, documentation, change control) in favor of only technical findings.
- Don't mark something "Compliant" without evidence — default to "Partial" if uncertain.