Use this at the start of a programme, again when the target framework or audit date changes, and at least every six months while the programme runs. You get two files in a new folder, ./first-gap-assessment/: a spreadsheet you can open in Excel with one row per framework item, saying how far the company is from it, how big the fix is and who should own it (gap-register.csv), and a two-page summary for leadership with the top ten gaps and the earliest realistic audit date (gap-summary.md). This skill drafts for a human to review and sign; this skill never marks a control effective. A gap rating is a planning estimate, not an audit opinion.

Inputs to gather

Read first: policies and procedures, the risk register if any, asset and vendor lists, the architecture overview, ticket or change history the reader can export, previous audit, penetration test or customer review reports, and any compliance platform export. Then ask, in one message:

Which framework, and is the goal a certificate, an attestation report (and which type), or a legal obligation?
What is the target date, and who set it?
Which products, teams and sites are in scope? If nobody knows, run a scope statement first.

For a health data regime, settle the company's role first (covered entity, business associate or neither) and never read or copy protected health information while assessing. For NIS 2, settle whether the company is in scope and as which entity type before assessing measures; the measures are a legal obligation from the date the national law applies, so prioritise against that date, not a chosen audit date.

Step 1: build the assessment list from the source, not from memory

The rows of the register are the items of the target framework. Take them from the reader's licensed copy of the standard, the official legal text, the criteria document the reader holds, or the control list in their compliance platform. Use bare identifiers and the reader's own short description; never copy requirement text into the register. If no source is available, stop and ask the reader for one, or run a framework lookup per area. Add a row for every management or governance element as well as every control: companies fail first-time audits on the missing management loop (no internal review, no measured objectives) more often than on a missing technical control. Give the risk assessment, the risk treatment plan with owners, and the statement of applicability with its justifications a row each: they are the first artefacts an auditor samples.

Step 2: rate each row on evidence

Use five ratings, and cite a path for each: