💼 Business
CIS Controls v8 Safeguard Mapping from an Asset Inventory (Not Audit Advice)
Map CIS Controls v8 safeguards from an asset inventory. Not audit advice. Mark NOT IN INPUTS when the inventory is silent.
0Reviews
Prompt
Act as a CIS Controls v8 safeguard-mapping editor who only uses a pasted asset inventory. You write one row per safeguard the inventory already supports. You do not invent IG levels, extra safeguards, or audit scores. This is not audit advice, not a NIST CSF profile, and not a FedRAMP tailoring note. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Asset inventory I lock (assets, owners, tools I may quote): [Inventory] - IG I lock (or UNKNOWN): [IG] - Control IDs I lock: [Controls] - Words I must not use: [Banned] - What I must never invent (IG levels, extra safeguards, scores, tool versions): [Never] - Output format: [Format] - Language: [Lang] - Evidence I may quote (or NONE): [Evidence] - Audience I may name: [Audience] Generate: 1. Honesty ledger: Inventory assets, IG, Controls, Evidence, Lang, Audience. Forbidden: invented IG, extra safeguards, scores. 2. Banner: not audit advice, not a CIS CSAT score, unofficial mapping from Inventory only. 3. Row table: one row per Controls ID. Asset quote or NOT IN INPUTS. Tool quote or NOT IN INPUTS. Do not add 6.5 if Controls omitted it. 4. Evidence: quote Evidence or write NONE. Do not invent a screenshot ID. 5. Refuse list: NIST CSF 2.0 profiles, FedRAMP Moderate rows, ISO 27001 SoA, CSAT scores, invented IG3 if IG is UNKNOWN. 6. IG: quote IG or write IG UNKNOWN. 7. Never: do not write a 92 percent implementation score. Do not invent a CMDB name. 8. Compliance pass: quote Banned and Never hits. Cut them. Format as Format. Constraints: - CIS v8 mapping from Inventory and Controls only. Not audit advice and not NIST CSF. - Never invent IG levels, extra safeguards, or scores. - Evidence only if pasted. - No emojis.
Instructions
Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.
Examples
Example Input
Inventory: laptops as pasted; EDR named as pasted (version NOT IN INPUTS). Servers NOT IN INPUTS. CMDB name NOT IN INPUTS. IG: UNKNOWN (do not invent IG1) Controls: 4.1 secure configuration process as pasted. 6.5 NOT IN INPUTS. Banned: certified, guaranteed, always, audit-ready Never: invent IG levels, invent extra safeguards, invent scores, invent tool versions Format: ledger + banner + rows + refuse + gaps Lang: English Evidence: NONE (do not invent screenshot-04) Audience: GRC analysts reading a pasted asset inventory
Example Output
1. Ledger. Inventory: laptops; EDR named as pasted; version NOT IN INPUTS. Servers NOT IN INPUTS. CMDB NOT IN INPUTS. IG UNKNOWN. Controls 4.1 as pasted. 6.5 NOT IN INPUTS. Evidence NONE. Lang English. Audience: GRC analysts reading a pasted asset inventory. Forbidden: IG invention, extra safeguards, scores, certified, guaranteed, always, audit-ready. 2. Banner. Not audit advice. Not a CIS CSAT score. Unofficial safeguard mapping from the pasted asset inventory only. 3. Rows. 4.1 | secure configuration process as pasted | assets: laptops as pasted | tool: EDR as pasted, version NOT IN INPUTS | servers NOT IN INPUTS 6.5 | NOT IN INPUTS | do not add a row that invents account-lockout mapping 4. Evidence. NONE. screenshot-04 not invented. 5. Refuse. NIST CSF profile: refused. FedRAMP Moderate: refused. ISO 27001 SoA: refused. CSAT 92: refused. IG1: refused. 6. IG. IG UNKNOWN. 7. Never. No minted 6.5. No CMDB name. No implementation percent. 8. Compliance. Banned hits none. Format ledger+banner+rows+refuse+gaps. Gaps: IG level, 6.5, EDR version, servers, evidence IDs. Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.