Policy Gap Analyst
Maps what your policies actually say to what the framework asks for
5 of 8 requirements need attention.
8 requirements checked. 5 flagged. The largest gap is 455 days.
Start with A.8.13. ISO Annex A has the most flagged.
Whether a control truly meets a requirement is for the assessor; the list only shows what has no control, no owner or no fresh evidence.
Why rows were flagged
- No control covers it40%
- No evidence, or over 12 months old40%
- Control has no owner20%
Value flagged by Framework
- ISO Annex A2
- SOC 22
- GDPR1
Items to act on, worst first
| Item | Framework | Value | Days since the evidence | Why |
|---|---|---|---|---|
| A.8.13 | ISO Annex A | 1 | 0 | No control covers it |
| CC8.1 | SOC 2 | 1 | 0 | No control covers it |
| CC6.1 | SOC 2 | 1 | 455 | No evidence, or over 12 months old |
| A.6.3 | ISO Annex A | 1 | 0 | Control has no owner |
| Art. 30 | GDPR | 1 | 0 | No evidence, or over 12 months old |
What to do this week
- Resolve A.8.13 first: it is the most urgent on the list.
- Fix the data or the status on every flagged row, then re-run.
- Re-run this check every time the list changes, before it reaches a decision.
Do
- Fix the highest-risk item first, then run the check again on fresh data.
Don't
- Don't act on one row alone: open the source record first.
How to improve
- Add more detail per row (owner, date, source) so the next report can trace each item.
- Add a second period of data so the next report can show whether things are improving.
Demo
Overview
Framework readiness is mostly document comparison: what do our policies already say, what does the standard require, and what is genuinely missing. It is clerical work that consumes weeks of expensive time.
This agent does the comparison against your real policies, read from your knowledge base and quoted. For each requirement it reports whether your documents address it, partially address it, or say nothing — with the passage that does, and the document it came from.
The distinction it holds firmly is between what is written, what was asserted, and what is absent. A control someone described in a meeting is not a documented control, and an auditor will say so. It reports gaps and the wording that would close them; it does not certify anything, and it does not tell you that you are compliant, because nobody can conclude that from documents alone.
Benefits
Weeks of comparison, done
The clerical majority of readiness work.
Know your real position
Before an auditor tells you, and while it is cheap to fix.
Traceable
Every claim of coverage points at the passage behind it.
What it does
Reads your actual policies
Quotes the passage covering each requirement, with the document and section it came from.
Written, asserted, absent
Three different states. A control described in a meeting is not a documented control, and an auditor will say so.
Lists what nothing addresses
The real output of a gap analysis is the gap list, and it is specific.
Suggests closing wording
Draft policy language for each gap, for a person to adapt and adopt.
Flags contradictions
Where two of your own policies say different things — a finding auditors reliably catch.
Certifies nothing
It reports coverage. Compliance is not concludable from documents.
What this changes
What this changes about your week
- It takes over
- Mapping your written policies to a framework's requirements, clause by clause.
- Done today by
- A consultant, at consultant rates.
- How often
- Every certification, and every customer security review.
- Typical manual effort
- A full gap analysis is weeks of document comparison.
Why Compliance & Risk in particular. It distinguishes what is written from what someone asserted in a meeting — which is precisely the finding an auditor raises.
Runs unattended
Started by you or by an event, and it finishes on its own. Nothing waits for someone to be at a desk.
The same standard every time
The two-hundredth item is held to the bar the first one was. Consistency is the part people cannot sustain.
It cannot act on its own
Policy Gap Analyst has no path to sending, spending or committing. That limit is why its output is safe to act on.
How it runs
This agent runs server-side through the PROMIVO runtime. Each run is logged step by step and every tool call is permission-checked before it executes.
- 1InputValidated against the agent input schema
- 2Modelclaude-opus-5 with automatic fallback
- 3Toolssearch_knowledge, extract_structured_data
- 4PermissionsRuns READ actions automatically; anything higher waits for approval
- 5OutputStructured result matching the output schema
- 6LoggingTokens, duration and every step recorded
Requirements
Integrations
No integrations required.
Before you start
- The framework's requirements
- A knowledge base holding your current policies and procedures
- Requires the All-Access plan or higher
Use cases
Preparing for certification
Find the gaps before the audit does.
A customer's security questionnaire
See what you can actually evidence.
After a policy rewrite
Check nothing that was covered has quietly stopped being covered.
Pricing
All-Access
Billed monthly through your PROMIVO subscription. Cancel at any time.
Runs consume your plan allowance for agent executions and tokens. See plan limits
FAQ
Does it make us compliant?
No. It compares documents to requirements. Compliance depends on what you actually do, on evidence of operation, and on an assessor's judgement — none of which is in a policy document.
Which frameworks?
It works from the requirements you supply or load. That is deliberate: framework texts are versioned and change, and an agent quoting a remembered version would be quoting a wrong one.
Can it write our policies?
It drafts wording for gaps, for a person to adapt and adopt. A policy nobody in the organisation has read or agreed to is a document, not a control.
Reviews
Reviews open once customers have run this agent.
Need this agent to work differently?
Tell us what to change and our team will scope a customised version for your business.
Customize this agent