compliance-evidence

Draft short ISO 27001 or SOC 2 control narratives strictly from a control map, with an inline [evidence: file#field] citation on every evidence sentence, and lint any narrative for uncited claims, citations that do not trace, contradicted states, certainty wording and pasted framework text. Use when asked to "write the control narrative for CC6.1", or for PBC responses and audit narratives from evidence. Not for narratives without evidence, policy writing, or an audit opinion or attestation.

Turn saved aws CLI output from one AWS account into ISO 27001 and SOC 2 evidence rows for logging, access control and backup (CloudTrail, root and console MFA, access key age, password policy, GuardDuty, Config, S3 public access block, AWS Backup), telling AccessDenied (not assessable) apart from not configured (contradicted). Use when asked to "prepare AWS evidence for our SOC 2 audit", or for ISO 27001 logging and access controls. Not for ranking security risk (aws-account-audit), live API calls by the script, or an attestation.

Map the exports in an evidence pack to ISO 27001:2022 Annex A or SOC 2 control identifiers and report per control supported, contradicted or not assessable, citing the exact file, field and value, plus the gaps; every file's SHA-256 is re-checked first. Use when asked "which controls do our exports support?", for a statement of applicability, a readiness assessment or an audit request list. Not for collecting data, replacing the assessor's judgement, or an opinion or attestation.

Map an evidence pack to the ASD Essential Eight Maturity Model (November 2023) and show, for each of the eight strategies, which ML1 to ML3 requirements have evidence, which do not, and the maturity level the strategy can claim today, from the pack's manifest and a mapping you own. Use when asked "what Essential Eight maturity level can we claim?", before an Essential Eight assessment or a customer asks for ML2. Not for running the assessment itself, ISO 27001 or SOC 2 mapping (control-map-from-exports), or collecting the exports.

Turn a folder of exports already on disk into an integrity-checked ISO 27001 or SOC 2 evidence pack, recording who collected each file, when, from which system and with which command, with a SHA-256 per file, a manifest and later re-verification that flags changed, missing or stale files. Use when asked "can we prove this file was not changed?", or when handing evidence to an assessor. Not for deciding whether a control is met (control-map-from-exports), collecting data from live systems, or an attestation.

Turn saved gh exports of one GitHub repository into ISO 27001 and SOC 2 evidence rows for change and vulnerability management, checking branch protection or rulesets, required reviews, an approval by someone other than the author on every merged pull request, CODEOWNERS, signed commits, Dependabot and secret scanning, and separating switched off from not assessable. Use when asked to "show every change was reviewed" for an audit. Not for live API calls by the script, organisation-wide settings, or an attestation.

Draft answers to a customer or vendor security questionnaire only from your own evidence pack and policy folder, citing the policy section or evidence file behind every answer and marking questions with nothing behind them as not assessable instead of inventing an answer. Use when asked to "fill in this security questionnaire", for a CAIQ, SIG-style or customer due diligence sheet saved as CSV or Markdown. Not for writing policies, judging a supplier's answers, or signing anything off.