audit-readiness
Skill2 starsChanged 14 days agoMITView on GitHub
Run a readiness / gap assessment against ISO 27001, SOC 2, Cyber Essentials, GDPR or ISO 42001 — scoring each requirement, identifying gaps, estimating effort, and producing a prioritised remediation roadmap to Stage 1/Stage 2, Type I/Type II, or CE submission. Use for "are we ready for our audit", "gap assessment", "readiness assessment", "how far are we from ISO 27001 / SOC 2", or "what do we need before the auditor arrives".
4 other projects use a version of this, 1 of them edited.
Adopted by
Most recently taken up by
- grcmana/grc-osedited, first seen Nov 8, 2026
- okou-ai/okou-skillstheir own version, first seen Nov 4, 2026
- vm0-ai/vm0-skillstheir own version, first seen Oct 8, 2026
- poorvith-mp/skills-developertheir own version, first seen Aug 19, 2026
Other versions4 projects use a version of this.
Word for word · 0
None found.
Edited · 1
- grcmana/grc-os★ 299% same
Wrote their own version · 3
- okou-ai/okou-skills★ 81same name
- vm0-ai/vm0-skills★ 81same name
- poorvith-mp/skills-developer★ 0same name
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository11 other files it gives its agents.
- CLAUDE.mdCLAUDE.md
- ai-impact-assessmentSkill
- company-contextSkill
- cyber-essentials-scopingSkill
- dpiaSkill
- evidence-request-listSkill
- evidence-reviewSkill
- grc-statusSkill
- policy-gap-reviewSkill
- policy-writerSkill
- risk-registerSkill
The file
We split this skill into the rules it gives an agent
5 rules. 0 are common, 2 are distinctive, and 3 are very specific to this project.
0
Common
Most of the 4 edited versions we read keep these.
2
Distinctive
This author's own choices. Worth a look.
3
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Very specific: line 17
Read references/grc-workspace.md, references/evidence-standards.md and the relevant framework pack(s) first.
- Very specific: line 25
Read grc/context/company-profile.md (framework selection, scope, target dates).
- Distinctive: line 50
Ask what exists, and where.
- Very specific: line 51
Check files in grc/.
- Distinctive: line 69
Don't inflate scores. "Documented" isn't "operating" without records over time.
“Common” is measured: kept by at least 6 in 10 of the 4 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Audit Readiness
You assess how ready the organisation is for a specific audit or certification, and produce a roadmap the team can actually execute.
Read references/grc-workspace.md, references/evidence-standards.md and the relevant framework pack(s) first.
Modes
- quick: a 20–30 minute interview-based readiness score per domain. Good for accidental owners and for sales conversations.
- full: a requirement-by-requirement assessment with evidence checks. Use this for a practitioner preparing for an audit.
- multi: one assessment across several selected frameworks, deduplicated using
references/crosswalk.md.
Context
Read grc/context/company-profile.md (framework selection, scope, target dates). Also use these if they exist:
grc/risks/risk-register.csvgrc/policies/grc/evidence/evidence-tracker.csv
These are evidence of maturity. Inspect what's there, don't just ask.
Maturity scale (per requirement or domain)
| Score | Status | Meaning |
| 0 | Not started | Nothing in place |
| 1 | Ad hoc | Happens informally; no documentation or evidence |
| 2 | Documented | Policy/procedure exists; little operating evidence |
| 3 | Operating | Documented and operating, with evidence for the period |
| 4 | Audit-ready | Operating, evidenced, reviewed; sampling would pass |
Full workflow
- Confirm the target: framework, audit type (CE / CE+ / ISO Stage 1 / Stage 2 / SOC 2 Type I / Type II, or GDPR accountability review), scope, and target date.
- Build the requirement list from the framework pack:
- ISO: clauses 4–10, plus the Annex A controls applicable per the SoA. If there's no SoA yet, assess all of them and flag candidates for exclusion.
- SOC 2: the CC series plus the selected categories.
- CE: the five controls plus scoping.
- GDPR: the accountability artefacts table.
- ISO 42001: clauses plus Annex A.
- Assess in batches by domain:
- Ask what exists, and where.
- Check files in
grc/. - Score 0–4 with a one-line justification.
- Note the evidence location.
- Gaps. Anything below the required level is a gap. Stage 1 / Type I needs ≥2 on all requirements and ≥3 on mandatory documented information. Stage 2 / Type II / CE needs ≥3, ideally 4. For each gap, record the recommended action, owner (role), effort (S <1 day / M 1–5 days / L >5 days), dependency, and target date.
- Roadmap. Sequence the gaps by dependency and critical path. Typically the order is: scope → risk assessment → SoA → policies → operating controls → evidence period → internal audit → management review → audit. Flag whether the target date is realistic and say what would make it so.
Outputs
grc/audits/readiness-<framework>-YYYY-MM-DD.md, containing:- executive summary (readiness %, RAG, go/no-go view on the target date)
- domain heat map
- requirement table:
ref, requirement (own words), score, evidence location, gap, action, owner, effort, due - 30/60/90-day roadmap
- top five risks to the audit date
- Offer next steps: the
evidence-request-listskill for the evidence plan, andpolicy-writerfor missing policies. - A run log in
grc/runs/.
Guardrails
- A readiness assessment isn't an audit opinion. Never state the organisation will pass.
- Don't inflate scores. "Documented" isn't "operating" without records over time.
- Requirements are paraphrased. No copyrighted standard text.
- For CE, flag whether the current question set and requirements version should be confirmed with the certification body.
References
references/grc-workspace.mdreferences/evidence-standards.mdreferences/crosswalk.md- Framework packs:
references/iso27001.md,soc2.md,cyber-essentials.md,gdpr.md,iso42001.md
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.