austinsonger

Audit preparation, evidence checklists, assessment simulation, gap analysis, and maturity scoring.

Draft SSP sections, SAR responses, boundary definitions, inheritance models, OSCAL guidance, and multi-framework coverage analyses.

Operational compliance workflows: continuous monitoring, calendaring, POA&M management, change management, and framework transitions.

Maps controls across cybersecurity frameworks using NIST IR 8477 Set-Theory Relationship Mapping (STRM). Use when helping with control implementation, compliance mapping, cross-framework alignment, or understanding control relationships.

Control lookup, cross-framework mapping, search, and coverage analysis across 15 compliance frameworks.

Review SSPs, narratives, POA&Ms, policies, and CRMs for structural completeness and quality.

Generate tabletop exercise scenarios for incident response and contingency planning.

Analyzes FedRAMP FRMR documents to extract control mappings, KSI entries, and version changes. Use when the user asks about FedRAMP requirements, control mappings, compliance data, or needs to understand FRMR document content.

Use when asked to map, crosswalk, align, compare, or gap-analyze any two cybersecurity frameworks, control catalogs, or regulatory requirements using NIST IR 8477 Set-Theory Relationship Mapping (STRM). Triggers on terms like "map controls", "crosswalk", "framework alignment", "gap analysis", or producing a STRM CSV output file.

Use when asked to map, crosswalk, align, compare, or gap-analyze any two cybersecurity frameworks, control catalogs, or regulatory requirements using NIST IR 8477 Set-Theory Relationship Mapping (STRM). Triggers on terms like "map controls", "crosswalk", "framework alignment", "gap analysis", or producing a STRM CSV output file.

Use when asked to map, crosswalk, align, compare, or gap-analyze any two cybersecurity frameworks, control catalogs, or regulatory requirements using NIST IR 8477 Set-Theory Relationship Mapping (STRM). Triggers on terms like "map controls", "crosswalk", "framework alignment", "gap analysis", or producing a STRM CSV output file.

Expert guidance on the SCF Security, Compliance & Resilience Management System (SCRMS) — a framework-agnostic approach for designing, implementing, and maintaining Secure, Compliant, and Resilient (SCR) capabilities across People, Processes, Technology, Data & Facilities (PPTDF). Use whenever someone asks about SCRMS, SCF, security program design, cybersecurity governance, compliance program structure, defensible evidence, Living Control Set (LCS), MCR/DSR/MSR, due diligence vs due care, CIAS, nested risk management (ERM/CDPRM/TPRM), materiality, CISO defensibility, control set determination, or any of the 33 SCRMS domains (governance, incident response, vulnerability management, data privacy, third-party risk, etc.). Also trigger for: "how do I build a cybersecurity program", "what controls do I need for compliance", "how do I prove we're secure to auditors", "CISO needs to justify the budget", or "map security to a framework."

Expert guidance for the Secure, Compliant & Resilient Management System (SCRMS) — a Plan-Do-Check-Act (PDCA) framework for governing cybersecurity and data privacy programs (SCF Council). Use whenever a user needs to build or mature a GRC program, apply the 9 SCRMS principles, distinguish MCR from DSR controls, score control maturity (CMM 0–5), assign control ownership, track KPIs/KRIs/KCIs, perform risk treatment (reduce/avoid/transfer/accept), or publish governance documentation. Trigger on: PDCA, SCRMS, GRC program, security governance, control maturity, CMM level, MCR, DSR, control owners, control operators, risk treatment, KPIs KRIs KCIs, situational awareness, governance documentation, PPTDF, cybersecurity program, plan do check act, SCF controls, compliance program. Also trigger when someone asks "where do I start with security?", "how do I build a compliance program?", "what controls do I need?", or "how do I assign control ownership?" — this skill provides the SCRMS framework answer.

Cybersecurity & Data Privacy Risk Management Model (C|P-RMM) skill for ComplianceForge's SCF-based framework. Use this skill whenever a user wants to: assess cybersecurity or data privacy risk, calculate inherent or residual risk scores, build or update a risk register, perform a risk assessment (DPIA, BIA, PIA, C-SCRA, third-party), score risk using OL/IE/CW/ML/MF factors, map risks to the SP-RMM risk matrix, create POA&M entries, or guide someone through the C|P-RMM 17-step workflow. Trigger whenever you see terms like "risk score", "risk level", "inherent risk", "residual risk", "risk treatment", "CVSS", "occurrence likelihood", "impact effect", "control weighting", "maturity level", "SCF", "POA&M", "risk register", "DPIA", "BIA", or "cybersecurity risk assessment". Even if the user just says "what's the risk of X?" in a security context, this skill applies.