Run an Assessment
Intake to findings — every step of a structured compliance assessment using AI. Client intake, evidence indexing, gap analysis, and SPRS scoring. This is the full workflow, in order.
Client Intake & Second Brain
Build the client profile in 15 minutes
Before you assess anything you need to know who you're assessing. This workflow builds a structured client profile from a first call — org context, tool stack, CUI scope, open questions — so you're never starting cold.
Pre-call recon and targeted question list
Run this before the call using whatever public info you have — LinkedIn, website, any prior documents. Returns a focused question list so you're not improvising when the client asks what you need to know.
You are a senior GRC assessor preparing for a first client intake call. CLIENT: [org name and brief description — e.g., "50-person defense subcontractor, manufactures drone components"] FRAMEWORK: [CMMC L2 / SOC 2 / ISO 27001 / FedRAMP / other] KNOWN INFO: [any info from their website, LinkedIn, prior conversations] Generate: 1. Pre-call intel summary — what we know, what's uncertain 2. Targeted question list (12–15 questions): - Scope and boundary questions - Tool stack and infrastructure questions - CUI handling questions (if CMMC) - Team and ownership questions - Timeline and prior assessment history 3. Red flags to watch for based on org type 4. Questions NOT to ask first call (builds rapport before getting technical) Format each question with: Question | Why we need it | What a bad answer looks like
Post-call second brain build
After the call, paste your raw notes and get back a structured profile. This becomes the context block you load at the start of every assessment session for this client.
You are a GRC analyst. I will give you client intake notes. Build a structured Second Brain profile.
INTAKE NOTES:
[paste your raw call notes — bullets, fragments, whatever you captured]
Output a JSON object with these fields:
{
"org_name": "",
"primary_framework": "",
"tool_stack": {
"identity": "",
"endpoint": "",
"cloud": "",
"ticketing": "",
"other": []
},
"cui_scope": true/false,
"cui_description": "",
"team_size": "",
"grc_owner": "",
"assessment_target_date": "",
"prior_assessments": "",
"key_risks": [],
"open_questions": [],
"red_flags": [],
"next_steps": []
}
Be specific. If a field is unknown, mark it "UNKNOWN — clarify" rather than leaving it blank.Clients are consistently vague about CUI scope on the first call — "we handle some government data" is not a scope statement. If you can't get a clear answer, use this follow-up: "Walk me through the last time you received something from your DoD prime contractor — what format was it, where did it go, who accessed it?" Concrete examples surface the real boundary.
Evidence Indexing
Map documents to control families before assessing
Most assessors start reviewing evidence without a map. Wrong order. Index first — know what you have, what it covers, and where the gaps are before you touch a single AO. This is the difference between structured assessment and random clicking.
Build the evidence gap matrix
Paste the document list with brief descriptions. Returns a table mapping each document to control families, likely AOs it satisfies, and what's still missing. This becomes your evidence tracker for the whole engagement.
Here is a list of documents a client provided for their CMMC L2 assessment. Map each to the relevant control families and identify gaps. DOCUMENTS PROVIDED: [paste document names and brief descriptions — e.g., "Access Control Policy v2.1 (2024-03), System Security Plan draft (2023-11), ..."] FRAMEWORK: CMMC L2 (NIST 800-171) For each document, output a table with: | Document | Control Family | Likely AOs Satisfied | Coverage Rating (Full/Partial/Weak) | Gap | Then add a summary section: - Families with NO evidence provided - Families with only one document (single point of failure) - Documents that are likely stale (>12 months old) - Recommended additional evidence to request
Auto-assign documents to specific AOs
Take the matrix and push it to AO-level specificity. This is the reference you use during assessment when you're evaluating each objective — you'll know immediately which file to pull and what to look for in it.
Using the evidence index below, map each document to specific NIST 800-171A Assessment Objectives. EVIDENCE INDEX: [paste the gap matrix from the previous prompt] CONTROL FAMILY TO ASSESS: [e.g., "AC — Access Control" or list specific practices: AC.L2-3.1.1 through AC.L2-3.1.22] For each AO in the specified family, output: | AO ID | AO Description | Evidence Document | What to look for | Confidence (High/Med/Low) | Where confidence means: - High: document clearly addresses this AO - Med: document partially addresses it or we're inferring - Low: no direct evidence — will need interview or test to confirm Flag any AO with NO mapped evidence as a likely gap.
Evidence dated more than 12 months ago is functionally stale for most frameworks — assessors will note the gap and you'll spend time in the assessment explaining why it's still valid. Flag stale documents immediately and request current versions. For policies, 12 months is the outer limit. For screen exports and configuration screenshots, 90 days is the standard.
Gap Analysis
Turn the evidence index into a scored gap report
Evidence indexing tells you what you have. Gap analysis tells you where it doesn't reach. You run this family-by-family and it becomes the spine of your assessment report. Every table row is a finding.
Per-family gap table
Feed the control family and evidence index. Returns an AO-level status table with the specific evidence file cited for each Met determination. Not Met rows come with a gap description you can use directly in the SAR or gap report.
Using the evidence index and NIST 800-171A, perform a gap analysis for the specified control family. EVIDENCE INDEX: [paste from your evidence indexing output] CONTROL FAMILY: [e.g., "AC — Access Control" or specific practices] FRAMEWORK: CMMC L2 For each Assessment Objective in this family, determine: | AO ID | Practice | Assessment Method | Status | Evidence File | Gap Description | Status options: Met | Partially Met | Not Met | Cannot Determine Rules: - Met only if evidence is current (<12 months), specific, and directly addresses the AO - Partially Met if evidence exists but has gaps (e.g., policy exists but no enforcement evidence) - Not Met if no credible evidence exists - Cannot Determine if the AO requires an interview or test we haven't conducted yet Add a summary: total Met / Partial / Not Met / Cannot Determine counts for this family.
Priority scoring by SPRS impact
Not all gaps are equal. This ranks each Not Met finding by SPRS point value so you're addressing the biggest score hits first — and clients understand where remediation money has the most leverage.
I have a list of Not Met practices from a CMMC L2 gap analysis. Prioritize them by SPRS impact and remediation effort. NOT MET PRACTICES: [list each practice ID and description from your gap table] For each practice, provide: | Practice | SPRS Point Value | Remediation Effort (Low/Med/High) | Remediation Category | Priority Rank | Remediation categories: - Policy: needs a written policy or procedure - Configuration: technical setting or tool change - Process: requires behavioral/workflow change - Evidence: control exists but proof is missing - Vendor: requires third-party action Sort output by: (SPRS points × inverse of effort) — highest ROI first. Add a note: which practices, if remediated, would have the greatest SPRS score recovery?
When you and the client disagree on a finding status, document your rationale inline in the gap table — don't negotiate it away. "Assessor Note: Client asserts control is Met via [X]. Assessor determined Partially Met because [specific gap in evidence]." This protects both parties and gives the client a clear path to upgrade the finding with additional evidence.
Conformity Scoring
SPRS score and 30/60/90 remediation roadmap
The gap table tells you what's broken. This converts it to a number and a plan. SPRS first — with the math shown — then a roadmap that clients can actually execute, with owners and dates attached.
SPRS score calculation
Feed your gap analysis results. Returns the SPRS score with every deduction documented — so when a client asks "why is our score X?" you have a line-item breakdown to show them.
Given these gap analysis results, calculate the SPRS score using DoD methodology. GAP ANALYSIS RESULTS: [paste your Not Met and Partially Met practices from the gap table] SPRS calculation rules: - Start at 110 - Each Not Met practice: subtract the DoD-assigned point value - Partially Met practices: subtract half the point value (round down) - Minimum score is -203 For each Not Met practice, show: | Practice | Point Value | Status | Deduction | Running Score | Then provide: - Final SPRS score: [X] - Score narrative (2 sentences explaining what the score means in plain language) - Top 5 practices by point value — highest-impact remediation targets - Projected SPRS score if top 5 are remediated
30/60/90 remediation roadmap
From the SPRS calculation, build a roadmap clients can execute. Every Not Met item gets a timeline, owner, and effort level — not just a score.
Build a remediation roadmap from these SPRS gap results. Timeline: 90 days. SPRS RESULTS: [paste your scored gap table — practice, point value, status] CLIENT CONTEXT: - Org type: [e.g., 40-person defense contractor] - Internal team: [e.g., one IT manager, no dedicated GRC staff] - Assessment target: [date] Generate a 30/60/90 day remediation plan: 30-DAY SPRINT (Quick wins — policy, evidence, low-effort configs): | Practice | Action | Owner (role) | Effort | SPRS points recovered | 60-DAY SPRINT (Medium effort — process changes, tool configs): [same format] 90-DAY SPRINT (High effort — vendor dependencies, infrastructure): [same format] Then: estimated SPRS score at day 30, 60, 90. Flag any practices that CANNOT be on a POA&M for CMMC certification purposes.
SPRS is self-attestation. When a client signs the SPRS submission, they're certifying the score is accurate. If it's wrong — even by mistake — that's False Claims Act exposure. Always document how you calculated each deduction, keep that documentation, and be explicit with clients that the score has legal weight, not just compliance weight.