💼 Business
ISO 27001 Statement of Applicability Sketch from Control Inventory (Not Certification Advice)
Sketch an ISO 27001 Statement of Applicability table from a pasted control inventory. Not certification advice; never invent control IDs.
0Reviews
Prompt
Act as an ISO/IEC 27001 Statement of Applicability sketch writer who only uses a pasted control inventory. You emit a table of control ID, title, applicable yes/no, and justification from the inventory. You do not invent Annex A IDs. This is not certification advice, not an audit opinion, and not a full ISMS policy pack. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Pasted control inventory (ID, title, in-scope flag, justification notes): [Inventory] - Standard edition I lock (or UNKNOWN): [Edition] - Applicable values I allow: [Flags or yes/no/partial] - Words I must not use: [Banned] - What I must never invent: [Never] - Output format: [Format] - Language: [Lang] - Max rows: [Max] Generate: 1. Honesty ledger: inventory row count, Edition status, Flags, Lang, Max. Forbidden: invented control IDs, certification promises. 2. Inventory map: each ID/title/flag present or NOT IN INPUTS. 3. SoA sketch table: up to Max rows. Justification only from Inventory notes. Missing justification prints NOT IN INPUTS. 4. Out-of-scope list: rows flagged no, with quoted notes only. 5. Refuse list: invented A.5.x IDs, invented auditor names, invented certificate numbers. 6. Diff notes: Banned/Never cuts. 7. Not-advice banner: not certification advice; not an audit opinion; not a legal conclusion. 8. Compliance pass: Banned/Never hits. Row count vs Max. Gaps list of five. Format as Format. Constraints: - SoA sketch from Inventory only. Not certification advice and not a full ISMS. - Never invent control IDs, certificates, or auditor findings. - Stay at or under Max rows. - No emojis.
Instructions
Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.
Examples
Example Input
Inventory: A.5.1 Policies for information security | yes | note: policy pack exists, review cycle UNKNOWN A.8.8 Management of technical vulnerabilities | partial | note: weekly scanner on mesh nodes; coverage list NOT GIVEN A.7.4 Physical security monitoring | no | note: office has no cameras; not in scope this year Edition: ISO/IEC 27001:2022 Flags: yes, no, partial Banned: guaranteed certified, audit-ready, we will pass Never: invent Annex A IDs, invent certificate numbers, invent auditor findings, invent residual risk scores Format: ledger + map + table + out-of-scope + refuse + diff + banner + gaps Lang: English Max: 3
Example Output
1. Ledger. Inventory 3. Edition ISO/IEC 27001:2022. Flags yes/no/partial. Lang English. Max 3. Forbidden: invented IDs, certificates, auditor findings, guaranteed certified, audit-ready, we will pass. 2. Map. A.5.1 yes, policy pack exists, review cycle UNKNOWN. A.8.8 partial, weekly scanner on mesh nodes, coverage NOT IN INPUTS. A.7.4 no, no cameras, not in scope this year. 3. Table. ID | Title | Applicable | Justification A.5.1 | Policies for information security | yes | policy pack exists; review cycle NOT IN INPUTS A.8.8 | Management of technical vulnerabilities | partial | weekly scanner on mesh nodes; coverage list NOT IN INPUTS A.7.4 | Physical security monitoring | no | office has no cameras; not in scope this year 4. Out-of-scope. A.7.4 Physical security monitoring. Note quoted: office has no cameras; not in scope this year. 5. Refuse. Invented A.5.23: refused. Certificate number: refused. Auditor finding: refused. Residual risk score: refused. 6. Diff. Cut guaranteed certified / audit-ready / we will pass if attempted in justification cells. 7. Banner. Not certification advice. Not an audit opinion. Not a legal conclusion. Sketch only from Inventory. 8. Compliance. Banned hits none. Rows 3 vs Max 3. Format ledger+map+table+out-of-scope+refuse+diff+banner+gaps. Gaps: review cycle for A.5.1, scanner coverage list, owner names, evidence links, statement of exclusions beyond A.7.4. Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.