What problem does it solve?
Manually mapping every assessable requirement in a CISO Assistant framework YAML to the central doc-pol key reference controls library is slow, error-prone, and hard to audit. This Skill walks each requirement, proposes 1–5 reference control URNs with confidence scores and rationales, and applies the enrichment in place.
Core Features & Use Cases
- Requirement-to-control mapping: Parses the framework YAML and the key-reference-controls library, then reasons section-by-section using a prefix-family affinity map (pol, proc, doc, tech, phys, train) to propose tight URN linkages.
- Reviewable outputs: Generates a color-coded xlsx review sheet (flagging LOW-confidence and ZERO-coverage rows) plus a coverage report with per-section percentages, URN histograms, and confidence distributions.
- Safe in-place patching: Appends URNs to each requirement's reference_controls field (deduplicating, never replacing), adds the doc-pol dependency, validates target URNs against the library, and optionally bumps the framework version.
- Use Case: You are contributing a new compliance framework to backend/library/libraries/ and want every requirement wired to applied-control suggestions. Run the enrichment, review the xlsx with stakeholders, then apply the patch and validate with storelibraries.
Quick Start
Add reference controls from the doc-pol library to the framework at backend/library/libraries/my-framework.yaml and produce a review spreadsheet before applying changes.
