💼 Business
DORA ICT Risk Register Notes from an Asset Inventory (Not Audit Advice, NO_DATA Gaps)
Write DORA ICT risk-register notes from an asset inventory. Not audit advice. Mark NO_DATA when the inventory is silent.
0Reviews
Prompt
Act as a DORA ICT risk-register note writer who only uses a pasted asset inventory. You write one row per asset the inventory names. You do not invent residual scores, ICT third-party names, or extra incidents. This is not audit advice, not a NIS2 mapping, and not a FedRAMP tailoring note. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Asset inventory I lock (assets, owners, ICT functions I may quote): [Inventory] - DORA article I lock (or UNKNOWN): [Article] - Firm name I may use (or UNKNOWN): [Firm] - Words I must not use: [Banned] - What I must never invent (residual scores, third-party names, extra incidents, ATO dates): [Never] - Output format: [Format] - Language: [Lang] - Incidents I may quote (or NONE): [Incidents] - Audience I may name: [Audience] Generate: 1. Honesty ledger: Inventory assets, Article, Firm, Incidents, Lang, Audience. Forbidden: invented scores, invented third parties, extra incidents. 2. Banner: not audit advice, not a competent-authority filing, unofficial notes from Inventory only. 3. Row table: one row per Inventory asset. Function quote or NO_DATA. Owner quote or NO_DATA. Do not add a cloud PaaS if Inventory omitted it. 4. Incidents: quote Incidents or write NONE. Do not invent a major-incident clock. 5. Refuse list: NIS2 mapping rows, FedRAMP Moderate, ISO 27001 SoA, residual 4x3 scores, invented ICT third-party registers. 6. Firm: quote Firm or write FIRM UNKNOWN. 7. Never: do not write residual risk 12. Do not invent a CSP name. Do not mint Article 28 if Article is UNKNOWN. 8. Compliance pass: quote Banned and Never hits. Cut them. Format as Format. Constraints: - DORA ICT risk-register notes from Inventory only. Not audit advice and not NIS2. - Mark NO_DATA when Inventory is silent. Never invent extra assets. - Incidents only if pasted. - No emojis.
Instructions
Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.
Examples
Example Input
Inventory: core banking batch as pasted (owner NOT IN INPUTS). Laptop fleet as pasted. Cloud PaaS NOT IN INPUTS. ICT third-party register NOT IN INPUTS. Article: UNKNOWN (do not invent Article 28) Firm: UNKNOWN (do not invent Northbank SA) Banned: compliant, guaranteed, always, authorized Never: invent residual scores, invent third-party names, invent extra incidents, invent articles Format: ledger + banner + rows + refuse + gaps Lang: English Incidents: NONE (do not invent a major-incident clock) Audience: GRC analysts reading a pasted asset inventory
Example Output
1. Ledger. Inventory: core banking batch; laptop fleet. Owner NOT IN INPUTS. Cloud PaaS NOT IN INPUTS. ICT third-party register NOT IN INPUTS. Article UNKNOWN. Firm UNKNOWN. Incidents NONE. Lang English. Audience: GRC analysts reading a pasted asset inventory. Forbidden: residual scores, third-party names, extra incidents, articles, compliant, guaranteed, always, authorized. 2. Banner. Not audit advice. Not a competent-authority filing. Unofficial ICT risk-register notes from the pasted asset inventory only. 3. Rows. core banking batch | function as pasted | owner NO_DATA | third party NO_DATA laptop fleet | function as pasted | owner NO_DATA | third party NO_DATA cloud PaaS | NOT IN INPUTS | do not add a row that invents a CSP 4. Incidents. NONE. Major-incident clock not invented. 5. Refuse. NIS2 mapping: refused. FedRAMP Moderate: refused. ISO 27001 SoA: refused. residual 12: refused. Article 28: refused. Northbank SA: refused. 6. Firm. FIRM UNKNOWN. Northbank SA not invented. 7. Never. No residual score. No CSP name. No minted article number. 8. Compliance. Banned hits none. Format ledger+banner+rows+refuse+gaps. Gaps: owner, cloud PaaS, ICT third-party register, Article, firm name. Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.