📁 Other
ISO 27001 Control Evidence Map from Audit Inventory (No Invented Finding Counts)
Build an ISO 27001 control and evidence map from a pasted audit inventory only. No invented finding counts, residual risk scores, or remediation durations.
0Reviews
Prompt
Act as an ISO 27001 control evidence cartographer who only uses a pasted audit inventory. You map controls, evidence items, and owners the inventory already supports. You do not invent finding counts, residual risk scores, remediation durations, or maturity ratings. This is not a certification guarantee and not a live penetration test. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Audit inventory I lock (controls, evidence, owners, periods): [Inventory] - ISO 27001 version or audit notes I lock: [Version] - Engagement or scope label I may quote (or UNKNOWN): [EngagementLabel] - Control IDs I may quote (or UNKNOWN): [ControlIds] - Evidence titles already present (or UNKNOWN): [EvidenceTitles] - Owner cues already present (or UNKNOWN): [OwnerCues] - Period or sample cues already present (or UNKNOWN): [PeriodCues] - Words I must not use: [Banned] - What I must never invent (finding counts, residual risk scores, remediation durations, maturity ratings): [Never] - Output format: [Format] - Language: [Lang] Generate: 1. Honesty ledger: Inventory nouns, Version, EngagementLabel, ControlIds, EvidenceTitles, OwnerCues, PeriodCues, Lang. Forbidden: invented finding counts, residual risk scores, remediation durations, maturity ratings. 2. Control-to-evidence map: one row per ControlIds entry. Attach only EvidenceTitles named beside that control in Inventory. Missing evidence write NOT IN INPUTS. 3. Owner sketch table: for each OwnerCues entry, list controls that name it. Do not invent 14 open findings if absent. 4. Period caution block: quote PeriodCues only. Sample windows not in Inventory stay NOT IN INPUTS; do not invent continuous monitoring defaults. 5. Refuse list: inventing 14 open findings, inventing residual risk 9.2, inventing 45 day remediation, inventing maturity level 4. 6. Compliance pass: quote Banned and Never hits. Cut them. Print control and evidence counts from Inventory only. Format as Format. Constraints: - Control evidence map from Inventory only. No invented finding counts. - Honor Version. No emojis. Not a certification promise.
Instructions
Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.
Generated Output
This image was generated using the prompt above.
Examples
Example Input
Inventory: control A.5.1 as pasted evidence Fog Policy Binder as pasted; control A.8.1 as pasted evidence Basin Asset Register as pasted. Finding invent NONE. Risk invent NONE. Version: ISO/IEC 27001:2022 as pasted (do not invent unreleased AI SoA writer) EngagementLabel: Fog Basin Stage 1 as pasted ControlIds: A.5.1 as pasted; A.8.1 as pasted. A.9.2 UNKNOWN. EvidenceTitles: Fog Policy Binder as pasted; Basin Asset Register as pasted. Access review UNKNOWN. OwnerCues: owner Security Ops as pasted for A.5.1; A.8.1 owner NOT IN INPUTS. PeriodCues: period Q2 sample as pasted. Continuous monitor UNKNOWN. Banned: 14 open findings, residual risk 9.2, guaranteed certification Never: invent finding counts, invent residual risk scores, invent remediation durations, invent maturity ratings Format: ledger + control-evidence map + owner sketch + period caution + refuse + compliance Lang: English
Example Output
1. Ledger. Inventory: control A.5.1 + evidence Fog Policy Binder; control A.8.1 + evidence Basin Asset Register. Finding invent NONE. Risk invent NONE. Version ISO/IEC 27001:2022. EngagementLabel Fog Basin Stage 1. ControlIds A.5.1; A.8.1. EvidenceTitles Fog Policy Binder; Basin Asset Register. OwnerCues Security Ops for A.5.1; A.8.1 owner NOT IN INPUTS. PeriodCues Q2 sample. Continuous monitor UNKNOWN. Lang English. Forbidden: invented finding counts, residual risk scores, remediation durations, maturity ratings, 14 open findings, residual risk 9.2, guaranteed certification. Not-advice banner: inventory map only, not certification advice. 2. Control-to-evidence map. A.5.1 | evidence Fog Policy Binder as pasted. A.8.1 | evidence Basin Asset Register as pasted. Access review not attached. A.9.2 not added. 3. Owner sketch table. owner Security Ops | control A.5.1 as pasted. A.8.1 owner | NOT IN INPUTS. Finding totals NOT IN INPUTS so do not invent 14 open findings. Second basin owner not invented. 4. Period caution. Q2 sample as pasted. Continuous monitor UNKNOWN. Continuous monitoring default NOT IN INPUTS. Do not invent sampling policy. 5. Refuse. 14 open findings: refused. residual risk 9.2: refused. 45 day remediation: refused. maturity level 4: refused. Unreleased AI SoA writer: refused. 6. Compliance. Banned hits none. Controls 2. Evidence 2. Format ledger+control-evidence map+owner sketch+period caution+refuse+compliance. Gaps: A.8.1 owner, Access review, A.9.2, Continuous monitor, finding totals. Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.