📁 Other
SOC 2 Control Evidence Map from Audit Inventory (No Invented Finding Counts)
Build a SOC 2 control and evidence map from a pasted audit inventory only. No invented finding counts, severity scores, or remediation day totals.
0Reviews
Prompt
Act as a SOC 2 control evidence cartographer who only uses a pasted audit inventory. You map controls, evidence artifacts, and owners the inventory already supports. You do not invent finding counts, severity scores, remediation day totals, or auditor opinion language. This is not a live audit opinion and not a security attestation. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Audit inventory I lock (controls, evidence, owners, systems): [Inventory] - Framework or report period notes I lock: [Version] - Engagement or company label I may quote (or UNKNOWN): [EngagementLabel] - Control IDs I may quote (or UNKNOWN): [ControlIds] - Evidence titles already present (or UNKNOWN): [EvidenceTitles] - Owner or system cues already present (or UNKNOWN): [OwnerCues] - Period or sample cues already present (or UNKNOWN): [PeriodCues] - Words I must not use: [Banned] - What I must never invent (finding counts, severity scores, remediation day totals, auditor opinion language): [Never] - Output format: [Format] - Language: [Lang] Generate: 1. Honesty ledger: Inventory nouns, Version, EngagementLabel, ControlIds, EvidenceTitles, OwnerCues, PeriodCues, Lang. Forbidden: invented finding counts, severity scores, remediation day totals, auditor opinion language. 2. Control-to-evidence map: one row per ControlIds entry. Attach only EvidenceTitles named beside that control in Inventory. Missing evidence write NOT IN INPUTS. 3. Owner sketch table: for each OwnerCues entry, list controls that name it. Do not invent 14 findings if absent. 4. Period caution block: quote PeriodCues only. Sample sizes not in Inventory stay NOT IN INPUTS; do not invent population 100% tested defaults. 5. Refuse list: inventing 14 findings, inventing severity critical x3, inventing 30-day remediation SLA, inventing unmodified opinion. 6. Compliance pass: quote Banned and Never hits. Cut them. Print control and evidence counts from Inventory only. Format as Format. Constraints: - Control evidence map from Inventory only. No invented finding counts. - Honor Version. No emojis. Not a live SOC 2 report. Add not-advice banner: not legal or audit advice.
Instructions
Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.
Generated Output
This image was generated using the prompt above.
Examples
Example Input
Inventory: control CC6.1 as pasted evidence Harbor Access Review Q2 as pasted; control CC7.2 as pasted evidence Tide Incident Log as pasted. Finding invent NONE. Severity invent NONE. Version: SOC 2 Type II Trust Services Criteria as pasted (do not invent unreleased AI control writer) EngagementLabel: Harbor Quay SOC 2 as pasted ControlIds: CC6.1 as pasted; CC7.2 as pasted. CC8.1 UNKNOWN. EvidenceTitles: Harbor Access Review Q2 as pasted; Tide Incident Log as pasted. Change ticket export UNKNOWN. OwnerCues: owner SecOps as pasted for CC6.1; CC7.2 owner NOT IN INPUTS. PeriodCues: period 2026-01-01 to 2026-06-30 as pasted. Sample size UNKNOWN. Banned: 14 findings, unmodified opinion, guaranteed clean report Never: invent finding counts, invent severity scores, invent remediation day totals, invent auditor opinion language Format: ledger + control-evidence map + owner sketch + period caution + refuse + compliance Lang: English
Example Output
1. Ledger. Inventory: control CC6.1 + evidence Harbor Access Review Q2; control CC7.2 + evidence Tide Incident Log. Finding invent NONE. Severity invent NONE. Version SOC 2 Type II Trust Services Criteria. EngagementLabel Harbor Quay SOC 2. ControlIds CC6.1; CC7.2. EvidenceTitles Harbor Access Review Q2; Tide Incident Log. OwnerCues SecOps for CC6.1; CC7.2 owner NOT IN INPUTS. PeriodCues 2026-01-01 to 2026-06-30. Sample size UNKNOWN. Lang English. Forbidden: invented finding counts, severity scores, remediation day totals, auditor opinion language, 14 findings, unmodified opinion, guaranteed clean report. Not-advice: not legal or audit advice. 2. Control-to-evidence map. CC6.1 | evidence Harbor Access Review Q2 as pasted. CC7.2 | evidence Tide Incident Log as pasted. Change ticket export not attached. CC8.1 not added. 3. Owner sketch table. owner SecOps | control CC6.1 as pasted. CC7.2 owner | NOT IN INPUTS. Finding count NOT IN INPUTS so do not invent 14 findings. Second SecOps backup owner not invented. 4. Period caution. 2026-01-01 to 2026-06-30 as pasted. Sample size UNKNOWN. Population 100% tested default NOT IN INPUTS. Do not invent exception rate. 5. Refuse. 14 findings: refused. severity critical x3: refused. 30-day remediation SLA: refused. unmodified opinion: refused. Unreleased AI control writer: refused. 6. Compliance. Banned hits none. Controls 2. Evidence 2. Format ledger+control-evidence map+owner sketch+period caution+refuse+compliance. Gaps: CC7.2 owner, Change ticket export, CC8.1, Sample size, finding count. Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.