📁 Legal
Compliance Prompt: Policy Gap List From Your Rule Checklist
Map your policies and evidence to a rule's obligations: met, partial, or missing with quotes, a remediation tracker with owners, and questions for counsel.
0Reviews
Prompt
Act as a compliance analyst who maps a company's written policies and actual controls to the obligations listed in a rule or counsel's checklist, marks each obligation met, partial, or missing with the evidence quoted, and drafts a remediation tracker for counsel to review. Inputs: - The rule or framework, by name and citation: [RuleName] - Obligations to test, numbered as in the rule or checklist: [Obligations] - Our current policy text, with document names and versions: [PolicyExcerpts] - What we actually do, with the proof we hold: [ControlEvidence] - Company facts that affect scope (size, records, systems): [OrgFacts] - People who can own fixes: [Owners] - Start date and length of the remediation window: [RemediationWindow] Generate: 1. Gap table: one row per obligation with status (Met, Partial, Missing, or Unclear), the policy line and evidence quoted, and the gap in one sentence. Met needs both a written policy and proof it is done. 2. Count: obligations in each status, with the total equal to the number of obligations. 3. Remediation tracker: for each Partial or Missing item, the action, owner from Owners, due date inside RemediationWindow, and the evidence that will show it is done. 4. Policy text to propose: short draft clauses for the missing written pieces, marked "draft for counsel". 5. Scope questions: anything in OrgFacts that could change which obligations apply, as questions for counsel. 6. Questions for counsel: the judgment calls this review cannot make. 7. Next review: what to collect so the next pass can mark items Met. Rules: - Quote only the text I paste; never cite a section, rule, or deadline that is not in Obligations. - Never say the company "is compliant"; this is a working draft for counsel, not legal advice.
Instructions
Paste the obligations exactly as counsel or the rule lists them, plus your policy text and real evidence. The output is a working draft for counsel, not legal advice, and never a statement that you are compliant.
Generated Output
This image was generated using the prompt above.
Examples
Example Input
RuleName: FTC Safeguards Rule, 16 CFR 314.4 (from counsel's checklist) Obligations: (a) designate a Qualified Individual; (b) written risk assessment with criteria; (c) safeguards: access controls, data inventory, encryption at rest and in transit, MFA for anyone accessing customer information, secure disposal no later than two years after last use unless needed, change management, user activity monitoring; (d) continuous monitoring, or annual penetration test and vulnerability scans every six months; (e) security awareness training; (f) oversee service providers, security terms in contracts; (g) keep the program current; (h) written incident response plan; (i) Qualified Individual reports in writing at least annually to the board or a senior officer; (j) notify the FTC within 30 days of discovering a breach of 500 or more consumers' unencrypted information PolicyExcerpts: IT Security Policy v2 (2023): "The Office Manager is the Qualified Individual." "Laptops use full-disk encryption." "Passwords are 12 characters or more." Records Policy v1: "Paper files are shredded after 7 years." ControlEvidence: MFA on email, not on the tax software; March training sign-in sheet for all 9 staff; file transfer to clients by encrypted portal; payroll vendor contract has no security terms; no risk assessment, scans, pen test, incident plan, or written report on file; digital client files kept with no deletion schedule OrgFacts: tax preparation firm, 9 staff, client records for about 6,200 people, cloud tax software, one office Owners: Dana Ruiz (Office Manager, Qualified Individual); Owen Park (IT contractor); Mei Lin (owner) RemediationWindow: 90 days starting 2026-10-19
Example Output
1. GAP TABLE (a) Met. "The Office Manager is the Qualified Individual." Dana Ruiz holds the role. (b) Missing. No risk assessment on file. (c) Partial. "Laptops use full-disk encryption"; encrypted client portal. Gaps: no MFA on the tax software; no deletion schedule for digital files; no data inventory, change management, or activity monitoring on file. (d) Missing. No scans or penetration test on file. (e) Met. March sign-in sheet covers all 9 staff. (f) Partial. Payroll vendor contract "has no security terms"; other vendors not listed. (g) Unclear. Policy v2 is from 2023; no record of a later review. (h) Missing. No incident response plan. (i) Missing. No written report on file. (j) Missing. No breach notification step in any policy. 2. COUNT Met 2, Partial 2, Missing 5, Unclear 1. Total 10. 3. REMEDIATION TRACKER (90 days: 2026-10-19 to 2027-01-16) - MFA on the tax software. Owen Park. Due 2026-11-06. Evidence: settings screenshot and user list. - Written risk assessment with criteria. Dana Ruiz with Owen Park. Due 2026-11-20. Evidence: signed document. - Data inventory and digital deletion schedule. Dana Ruiz. Due 2026-12-04. Evidence: inventory sheet and schedule. - Vulnerability scan, then plan scans every six months and an annual pen test. Owen Park. Due 2026-12-04. Evidence: scan report. - Incident response plan with a breach notification step. Dana Ruiz. Due 2026-12-18. Evidence: approved plan. - Payroll vendor security terms; list all vendors with access. Mei Lin. Due 2026-12-18. Evidence: signed addendum and vendor list. - Change management and activity monitoring steps. Owen Park. Due 2027-01-08. Evidence: procedure and log sample. - First written report from Dana Ruiz to Mei Lin. Due 2027-01-15. Evidence: dated report. 4. POLICY TEXT TO PROPOSE (draft for counsel) - "Multi-factor authentication is required for anyone accessing customer information, including the tax software." - "Digital client files are deleted no later than two years after the last use to serve the client, unless a business need or legal requirement applies; the Qualified Individual keeps the schedule." - "Security events go to the Qualified Individual at once; events that may involve 500 or more consumers' unencrypted information go to counsel the same day for the FTC notice decision." 5. SCOPE QUESTIONS - With about 6,200 client records, do any small-firm exemptions apply to us? - Does "board or senior officer" mean Mei Lin, since there is no board? 6. QUESTIONS FOR COUNSEL - Is the 7-year paper retention in Records Policy v1 a legal requirement that overrides the two-year disposal line? - Does the client portal count as encryption in transit for all transfers? 7. NEXT REVIEW Collect: MFA screenshot, signed risk assessment, scan report, vendor addendum, and the dated report from Dana Ruiz.