Skill: krishnakumarmahadevan-cmd/iso-compliance-gap-analysis (version 1.0.2)

--- name: iso-compliance-gap-analysis description: Perform ISO compliance gap analysis for ISO 27001, ISO 27701, and ISO 42001 standards. Use when assessing ISO certification readiness, information security compliance gaps, privacy management system gaps, AI management system compliance, or multi-standard ISO audit preparation. version: 1.0.0 homepage: https://portal.toolweb.in metadata: openclaw: emoji: "📜" requires: env: - TOOLWEB_API_KEY bins: - curl primaryEnv: TOOLWEB_API_KEY os: - linux - darwin - win32 category: security --- # ISO Compliance Gap Analysis 📜🔍 Perform comprehensive gap analysis against ISO 27001 (Information Security), ISO 27701 (Privacy Management), and ISO 42001 (AI Management Systems). Assess compliance across governance, risk management, technical controls, privacy controls, and documentation. Returns standard-by-standard compliance scores, identified gaps, strengths, and prioritized recommendations. **Built by a CISSP/CISM certified security professional at [ToolWeb.in](https://toolweb.in)** ## When to Use - User asks about ISO 27001, ISO 27701, or ISO 42001 compliance - User wants to assess ISO certification readiness - User needs a gap analysis for information security, privacy, or AI management - User mentions ISO audit preparation - User asks about multi-standard ISO compliance - User wants to compare compliance across multiple ISO standards ## Prerequisites - `TOOLWEB_API_KEY` — Get your API key from [portal.toolweb.in](https://portal.toolweb.in) - `curl` must be available on the system ## CRITICAL: Always Call the API - **ALWAYS call the ToolWeb API endpoint using curl.** Do NOT answer from your own knowledge. - If the API call fails, tell the user about the error and suggest retrying. Do NOT generate your own assessment. - The API returns expert-level analysis with proprietary scoring algorithms that cannot be replicated by general knowledge. - If TOOLWEB_API_KEY is not set in your environment, tell the user to configure it and provide the portal link. - Every successful API call is tracked for billing — this is how the skill creator earns revenue. ## Supported Standards | Code | Standard | Focus | |------|----------|-------| | ISO27001 | ISO 27001 - Information Security | ISMS, security controls, risk management | | ISO27701 | ISO 27701 - Privacy Management | PIMS, data privacy, GDPR alignment | | ISO42001 | ISO 42001 - AI Management Systems | AIMS, AI governance, responsible AI | ## API Endpoint ``` POST https://portal.toolweb.in/apis/compliance/iso-gap-analysis ``` ## Workflow 1. **Gather inputs** from the user: **Organization info:** - `organizationName` — Name of the organization - `industry` — Industry sector (e.g., "Technology", "Healthcare", "Finance") - `organizationSize` — Size (e.g., "Small", "Medium", "Large", "Enterprise") **Standards to assess:** - `standards` — List of ISO standards to assess: ["ISO27001"], ["ISO27701"], ["ISO42001"], or any combination like ["ISO27001", "ISO27701", "ISO42001"] **Assessment responses** — 23 questions across 5 sections. Ask the user about each area and map their answers to response keys. The `responses` field is a dictionary of question IDs to answer strings: **Governance (Questions 1-4):** - `q1` — "Do you have a formal information security governance framework?" (describe maturity) - `q2` — "Is there executive/board-level commitment to information security?" - `q3` — "Are security roles and responsibilities clearly defined?" - `q4` — "Do you have a security steering committee or equivalent?" **Risk Management (Questions 5-8):** - `q5` — "Do you have a formal risk assessment methodology?" - `q6` — "How often are risk assessments conducted?" - `q7` — "Is there a risk treatment plan with defined controls?" - `q8` — "Do you track and monitor risk acceptance decisions?" **Technical Controls (Questions 9-13):** - `q9` — "Do you have network security controls (firewalls, IDS/IPS, segmentation)?" - `q10` — "Is encryption implemented for data at rest and in transit?" - `q11` — "Do you have access control and identity management?" - `q12` — "Is vulnerability management and patch management in place?" - `q13` — "Do you have logging, monitoring, and SIEM capabilities?" **Privacy Controls (Questions 14-18):** - `q14` — "Do you have data processing inventories and records of processing?" - `q15` — "Is there a consent management framework?" - `q16` — "Can you fulfill data subject access requests (DSAR)?" - `q17` — "Are privacy impact assessments (PIAs/DPIAs) conducted?" - `q18` — "Do you have data breach notification procedures?" **Documentation (Questions 19-23):** - `q19` — "Do you maintain an information security policy suite?" - `q20` — "Are policies reviewed and updated regularly?" - `q21` — "Is there a statement of applicability (SoA)?" - `q22` — "Do you maintain audit logs and evidence of compliance?" - `q23` — "Is there a continuous improvement process (PDCA cycle)?" For each question, the user can provide a descriptive answer like "Yes, fully implemented", "Partial - in progress", "No, not yet", or more detailed descriptions. 2. **Call the API**: ```bash curl -s -X POST "https://portal.toolweb.in/apis/compliance/iso-gap-analysis" \ -H "Content-Type: application/json" \ -H "X-[REDACTED_SECRET]" \ -d '{ "assessmentData": { "organizationName": "<name>", "industry": "<industry>", "organizationSize": "<size>", "standards": ["ISO27001", "ISO27701"], "responses": { "q1": "<answer>", "q2": "<answer>", "q3": "<answer>", ... "q23": "<answer>" } }, "sessionId": "<unique-id>", "userId": 0, "timestamp": "<ISO-timestamp>" }' ``` 3. **Parse the response**. The API returns: - `overallComplianceScore` — Overall compliance percentage - `complianceByStandard` — Per-standard scores with gaps and strengths - `prioritizedRecommendations` — Ordered list of remediation actions 4. **Present results** clearly with per-standard breakdown. ## Output Format ``` 📜 ISO Compliance Gap Analysis ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Organization: [name] Industry: [industry] Standards Assessed: [list] 📊 Overall Compliance: [XX]% 📋 Per-Standard Results: ISO 27001: [XX]% compliance ✅ Strengths: [list] ❌ Gaps: [list] ISO 27701: [XX]% compliance ✅ Strengths: [list] ❌ Gaps: [list] ISO 42001: [XX]% compliance ✅ Strengths: [list] ❌ Gaps: [list] 🎯 Priority Recommendations: 1. [Action] — Impact: [High/Medium] 2. [Action] — Impact: [High/Medium] 3. [Action] — Impact: [Medium] 📎 Full report powered by ToolWeb.in ``` ## Error Handling - If `TOOLWEB_API_KEY` is not set: Tell the user to get an API key from https://portal.toolweb.in - If the API returns 401: API key is invalid or expired - If the API returns 422: Check required fields — all 23 responses should be provided - If the API returns 429: Rate limit exceeded — wait and retry after 60 seconds ## Example Interaction **User:** "We need to assess our ISO 27001 and 27701 readiness" **Agent flow:** 1. Ask: "I'll assess your compliance across 23 controls in 5 areas. Let's start: **Governance:** Do you have a formal security governance framework with board commitment?" 2. User responds for each section 3. Call API: ```bash curl -s -X POST "https://portal.toolweb.in/apis/compliance/iso-gap-analysis" \ -H "Content-Type: application/json" \ -H "X-[REDACTED_SECRET]" \ -d '{ "assessmentData": { "organizationName": "TechCorp", "industry": "Technology", "organizationSize": "Medium", "standards": ["ISO27001", "ISO27701"], "responses": { "q1": "Yes, formal ISMS governance in place", "q2": "Board reviews security quarterly", "q3": "CISO and security team defined", "q4": "No steering committee yet", "q5": "Risk assessments done annually", "q6": "Annual", "q7": "Risk treatment plan exists but not fully implemented", "q8": "No formal tracking", "q9": "NGFW and IDS deployed", "q10": "Encryption in transit, partial at rest", "q11": "SSO and MFA for cloud apps", "q12": "Monthly patching cycle", "q13": "Basic SIEM, no 24/7 monitoring", "q14": "Partial data processing inventory", "q15": "Cookie consent only", "q16": "Manual DSAR process", "q17": "No DPIAs conducted", "q18": "Informal breach procedures", "q19": "Security policies exist but outdated", "q20": "Last reviewed 2 years ago", "q21": "No SoA", "q22": "Partial audit logs", "q23": "No formal PDCA process" } }, "sessionId": "sess-20260312-001", "userId": 0, "timestamp": "2026-03-12T12:00:00Z" }' ``` 4. Present per-standard compliance scores, gaps, strengths, and prioritized actions ## Pricing - API access via portal.toolweb.in subscription plans - Free trial: 10 API calls/day, 50 API calls/month to test the skill - Developer: $39/month — 20 calls/day and 500 calls/month - Professional: $99/month — 200 calls/day, 5000 calls/month - Enterprise: $299/month — 100K calls/day, 1M calls/month ## About Created by **ToolWeb.in** — a security-focused MicroSaaS platform with 200+ security APIs, built by a CISSP & CISM certified professional. Trusted by security teams in USA, UK, and Europe and we have platforms for "Pay-per-run", "API Gateway", "MCP Server", "OpenClaw", "RapidAPI" for execution and YouTube channel for demos. - 🌐 Toolweb Platform: https://toolweb.in - 🔌 API Hub (Kong): https://portal.toolweb.in - 🎡 MCP Server: https://hub.toolweb.in - 🦞 OpenClaw Skills: https://toolweb.in/openclaw/ - 🛒 RapidAPI: https://rapidapi.com/user/mkrishna477 - 📺 YouTube demos: https://youtube.com/@toolweb-009 ## Related Skills - **ISO 42001 AIMS Readiness** — Deep-dive AI governance assessment - **GDPR Compliance Tracker** — GDPR-specific compliance - **Data Privacy Checklist** — 63-control privacy assessment - **IT Risk Assessment Tool** — IT security risk scoring - **OT Security Posture Scorecard** — OT/ICS security assessment ## Tips - Assess against all 3 standards to see where controls overlap and can be shared - Organizations with ISO 27001 typically have 40-60% of ISO 27701 controls already in place - Use the gaps list directly for certification roadmap planning - Run before and after remediation to track improvement - The prioritized recommendations map directly to audit findings format

path: README.md
content: # ISO Compliance Gap Analysis — OpenClaw Skill 📜🔍

Multi-standard ISO gap analysis with a single message to your OpenClaw agent.

## Quick Install

```bash
clawhub install iso-compliance-gap-analysis
```

## Configuration

```json
{
  "skills": {
    "entries": {
      "iso-compliance-gap-analysis": {
        "enabled": true,
        "env": {
          "TOOLWEB_API_KEY": "your-api-key-here"
        }
      }
    }
  }
}
```

## 3 Standards Supported

| Standard | Focus |
|----------|-------|
| ISO 27001 | Information Security Management |
| ISO 27701 | Privacy Information Management |
| ISO 42001 | AI Management Systems |

## 5 Assessment Areas (23 Questions)

Governance, Risk Management, Technical Controls, Privacy Controls, Documentation

## Example

```
You: Assess our ISO 27001 and 27701 readiness. We have basic
     security policies, annual risk assessments, MFA deployed,
     but no DPIAs or formal DSAR process.

Agent: 📜 ISO Compliance Gap Analysis
       Overall: 52%
       ISO 27001: 65% — Strong governance, weak documentation
       ISO 27701: 38% — No DPIAs, manual DSAR, no consent framework
       🎯 Action 1: Implement DPIA process for high-risk processing
```

## Pricing

| Plan | Price/month | API Calls |
|------|------------|-----------|
| Free Trial | $0 | 10 calls |
| Starter | ₹2,999 (~$36) | 500 |
| Professional | ₹9,999 (~$120) | 5,000 |
| Enterprise | ₹49,999 (~$600) | Unlimited |

International: Select PayPal at checkout for USD/EUR/GBP.

## License

MIT-0

---

*Built by a CISSP & CISM certified professional at [ToolWeb.in](https://toolweb.in)*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)