AI-Assisted GRC Analysis with NIST CSF

Use Claude, ChatGPT, and Gemini to build a full GRC deliverable package.

Introduction

30 Second Summary

Every company that handles sensitive data needs to prove its security posture is up to standard. For a small startup without a dedicated security team, figuring out where to start with cybersecurity compliance can feel overwhelming.

In this project, you will step into the role of a GRC analyst at CloudVault, a fictional SaaS startup preparing for its first cybersecurity compliance assessment against the NIST Cybersecurity Framework (CSF) 2.0. Using Claude, ChatGPT, and Google Gemini strategically, you will produce a complete set of professional GRC deliverables in under an hour.

What You'll Build

You'll walk away with a professional compliance package for a cloud startup that you could present to a CEO and defend to an auditor.

By the end of this project, you'll have:

  • A scored risk register that identifies CloudVault's top cybersecurity threats and a verified gap analysis that maps the company's security posture against all six NIST CSF 2.0 functions, with every AI-generated framework reference cross-checked against the real standard.
  • Audit-ready security policies with precise NIST CSF 2.0 references, standard policy sections, and CloudVault-specific details that an auditor would take seriously.
  • A board-ready executive risk report that translates your technical findings into plain business language a CEO can understand and act on.
  • Secret Mission: Map your NIST CSF 2.0 findings to ISO 27001:2022 Annex A controls, proving you can work across multiple compliance frameworks at once.

Are there any prerequisites?

No prior cybersecurity or compliance experience is needed. You will need free accounts on Claude, ChatGPT, and Google Gemini. Step 1 walks you through verifying each platform is ready to use.

Before We Start

Before you dive in, let's lock in what you're about to build and why it matters.

You're stepping into the role of a GRC analyst at CloudVault, a fictional SaaS startup storing sensitive customer documents on AWS. CloudVault is preparing for its first cybersecurity compliance assessment against the NIST Cybersecurity Framework (CSF) 2.0, and you'll use three AI platforms strategically to produce the deliverables a solo analyst would normally spend weeks on.

Set Up Your AI Analyst Toolkit

A GRC analyst's biggest advantage is knowing which tool to reach for. In this project, you'll use three AI platforms, and each one earns its spot by excelling at a specific type of compliance work.

Before building risk registers and gap analyses, you need to verify all three are live and responsive. You'll also learn which compliance task each platform handles best.

In this step, get ready to:
  • Verify your Claude, ChatGPT, and Gemini accounts are working.
  • Assign each platform its specific role in the GRC workflow.
Verify your Claude account

Claude will be your policy drafting specialist throughout this project. It excels at structured compliance writing with precise framework references, which makes it the right tool for drafting security policies that an auditor would take seriously.

  • Open a new browser tab and go to claude.ai.
  • Sign in to your account.
  • Start a new conversation.
  • Type Hello into the message field and press Enter.

Claude should respond with a friendly greeting. If you see a reply appear in the chat window, your account is verified and ready.

Not getting a response?

If you're stuck on the sign-in screen, try resetting your password using the link on the login page.

If you see a usage limit or rate limit message, wait a minute and try again. Free-tier accounts sometimes have brief cooldown periods.

These tips apply to all three platforms in this step.

Help me troubleshoot my AI platform login

Verify your ChatGPT account

ChatGPT will handle your gap analysis and executive reporting. It is strong at synthesizing complex information into clear, structured outputs, which is exactly what you need when translating technical findings into language a CEO can act on.

  • Open a new browser tab and go to chatgpt.com.
  • Sign in to your account.
  • Start a new conversation.
  • Type Hello into the message field and press Enter.

You should see ChatGPT reply in the conversation window. That confirms your account is working.

Verify your Google Gemini account

Google Gemini will handle your risk identification and threat landscape research. Its broad research and data-gathering capabilities make it effective at scanning for cybersecurity threats relevant to a specific company profile.

  • Open a new browser tab and go to gemini.google.com.
  • Sign in with your Google account.
  • Start a new conversation.
  • Type Hello into the message field and press Enter.

Gemini should reply in the chat. That's your third and final platform confirmed.

Why three AI platforms instead of one?

Each platform has demonstrated strengths for different GRC tasks. Claude leads on governance work like policy drafting, producing tighter framework references and clearer compliance language. ChatGPT is strong at short-form compliance communication and executive summaries where clarity matters most.

Gemini's broad research capabilities make it effective at scanning threat landscapes for a given company profile. Matching the right tool to the right task produces better deliverables than defaulting to a single platform for everything.

You should now have three browser tabs open, each showing a successful conversation. Keep all three tabs open for the rest of the project.

Your platform role assignments

  • Gemini = risk identification and threat landscape research (Step 2).
  • ChatGPT = gap analysis (Step 3) and executive risk reporting (Step 5).
  • Claude = security policy drafting (Step 4).

Your analyst toolkit is ready. Next up, you'll put Gemini to work building a risk register that identifies and scores CloudVault's top cybersecurity threats.

Build a Risk Register with Gemini

Your AI analyst toolkit is ready. Now it is time to put Gemini to work on the first and most foundational piece of any GRC program: the risk register.

You cannot protect what you have not identified. Before writing security policies or assessing compliance gaps, you need a structured inventory of what could go wrong at CloudVault, how likely each threat is, and how bad it would be if it happened. Gemini's broad research capabilities make it effective at scanning the threat landscape for a company profile like CloudVault's.

In this step, get ready to:
  • Prompt Gemini with CloudVault's company profile to generate a structured risk register.
  • Critically review and refine vague risks into CloudVault-specific threats.
  • Compile a final risk register ordered by severity, with top risks flagged and mapped to NIST CSF 2.0 functions.
Set the scene and prompt Gemini

A well-structured prompt produces well-structured output. You will give Gemini CloudVault's full company profile and specify exactly what columns you want in the risk register.

  • Switch to your Gemini tab at gemini.google.com.
  • Start a new conversation and paste the following prompt:
I am a GRC analyst at CloudVault, a SaaS startup with 50 employees.
CloudVault stores sensitive customer documents in the cloud using AWS
infrastructure. The company has no formal security program yet and is
preparing for its first cybersecurity compliance assessment against
NIST CSF 2.0.

Identify the top 10 cybersecurity risks facing CloudVault. For each
risk, provide:
- Risk ID (format: R-001, R-002, etc.)
- Risk Description (specific to CloudVault's context as a cloud
  document storage provider on AWS)
- Threat Source (e.g., external attacker, insider, environmental,
  third-party vendor)
- Likelihood (1-5 scale, where 1 = Rare and 5 = Almost Certain)
- Impact (1-5 scale, where 1 = Negligible and 5 = Catastrophic)
- Risk Rating (Low/Medium/High/Critical based on the combination
  of likelihood and impact)

Present the results in a table format.

What does this prompt do?

This prompt does three things that make Gemini's output immediately useful.

  • It sets the role (GRC analyst) and the company context (50-employee SaaS startup on AWS, sensitive documents, no security program). This grounds every risk in CloudVault's real situation instead of producing generic threats.
  • It defines the exact columns you want (Risk ID, Description, Threat Source, Likelihood, Impact, Risk Rating). Specifying the output format up front saves you from reformatting later.
  • It requests a table format, which makes the register easy to scan and copy into a document.

Gemini returns a table with 10 identified cybersecurity risks. Each row should contain a Risk ID, a description tied to CloudVault's cloud document storage context, and scored ratings.

Not seeing a structured table?

  • If Gemini returns a numbered list instead of a table, reply with: "Please reformat the risks as a table with columns for Risk ID, Risk Description, Threat Source, Likelihood, Impact, and Risk Rating."
  • If Gemini returns fewer than 10 risks, ask it to continue: "Please identify additional cybersecurity risks specific to CloudVault until you reach at least 10."

Ask for help troubleshooting your Gemini prompt.

Critically review and challenge the output

AI models tend to produce risks that sound reasonable but are too generic to be useful. A risk like "cyberattack" tells you nothing actionable. Your job as the analyst is to push every entry until it is specific enough to drive a real decision.

  • Read through each of the 10 risks Gemini generated.
  • Look for entries that are vague or could apply to any company. For example, a generic "insider threat" entry should specify the actual threat vector, such as "unauthorized data export by employees with broad S3 bucket access."
  • Check whether the likelihood and impact scores make sense for a 50-person cloud SaaS startup with no existing security program. A company with no formal access controls has a higher likelihood of access-related threats than a mature enterprise.

Now send Gemini a follow-up prompt that pushes it to sharpen the vague entries and recalibrate scores:

  • Paste the following refinement prompt into the same Gemini conversation:
Review the risk register and make these improvements:

1. Replace any generic risks with CloudVault-specific risks. For
   example, a generic "insider threat" should become something like
   "unauthorized data export by employees with broad S3 bucket
   access." Every risk description must reference CloudVault's
   specific context (AWS infrastructure, sensitive customer
   documents, 50-person team, SaaS model).

2. Re-evaluate the likelihood and impact scores. CloudVault has NO
   formal security program, which increases the likelihood of many
   threats. Adjust scores accordingly.

3. Present the updated risk register as a table.

Why push back on AI output?

The first output from any AI model is a starting point, not a finished product. A GRC analyst adds value by challenging assumptions, injecting company-specific context, and recalibrating scores based on institutional knowledge.

This iterative refinement loop (generate, review, push back, refine) is how professionals use AI for compliance work. The analyst's judgment is what turns generic AI output into something an auditor would take seriously.

Gemini returns an updated table. The risk descriptions should now reference CloudVault-specific details like AWS services, customer document sensitivity, and the company's lack of existing controls.

Risks still feel generic?

  • If specific risks still read like they could apply to any company, reply to Gemini with the exact risk and ask: "Make R-003 specific to CloudVault. What exact AWS resource or document handling process is at risk?"
  • You can iterate as many times as needed. Each round should produce sharper, more actionable entries.

Help me refine my risk register entries to be more specific.

Compile your final risk register

Your refined risks are ready. Now you need to organize them into a finished register that you will carry forward through the rest of this project. This means ordering by severity, flagging priorities, and mapping each risk to the NIST CSF 2.0 framework.

  • Send Gemini this final prompt to add the NIST CSF 2.0 mapping and organize the register:
Add one more column to the risk register: "NIST CSF 2.0 Function."
For each risk, identify which of the six NIST CSF 2.0 functions it
most closely relates to: Govern (GV), Identify (ID), Protect (PR),
Detect (DE), Respond (RS), or Recover (RC).

Re-order the table by Risk Rating, with Critical risks first, then
High, Medium, and Low.

Flag the top 3 risks that need immediate attention by adding
"[PRIORITY]" next to their Risk ID.

What are the six NIST CSF 2.0 functions?

The NIST Cybersecurity Framework 2.0 organizes cybersecurity outcomes into six core functions. Govern (GV) covers strategy and risk management decisions. Identify (ID) covers understanding what assets you have. Protect (PR) covers safeguards like access controls.

Detect (DE) covers monitoring for threats. Respond (RS) covers incident handling. Recover (RC) covers restoring operations after an incident. Mapping each risk to a function tells you which part of your security posture that risk threatens.

Gemini returns the re-ordered, annotated risk register. Before you copy it to your document, apply your own analyst judgment to the NIST function mappings.

  • Scan the NIST CSF 2.0 Function column. Does each mapping make sense? A risk about unauthorized access should map to Protect (PR), not Detect (DE). If any mapping looks wrong, note the correction for when you paste into your document.
  • Check that the top 3 flagged risks are truly the most critical for CloudVault. If you disagree with Gemini's prioritization, trust your own judgment and adjust.
  • Open a new document in your text editor or Google Docs.
  • Title the document "CloudVault Risk Register" and paste the final table from Gemini.
  • Apply any corrections you noted to the NIST function mappings or priority flags.
  • Save the document. You will reference this risk register in every remaining step of the project.

Keep Gemini open

Do not close your Gemini tab. You may want to return to this conversation later if you need to add risks or revisit Gemini's reasoning.

Before you move on, take a moment to predict: does your risk register cover threats across most of the six NIST CSF 2.0 functions, or are they clustered under just one or two?

Scan the NIST CSF 2.0 Function column in your saved document. You should see at least 8 risks with Risk IDs, CloudVault-specific descriptions, threat sources, scored likelihood and impact values, risk ratings ordered from Critical down to Low, the top 3 flagged with [PRIORITY], and a NIST CSF 2.0 function assigned to each. If any function (Govern, Identify, Protect, Detect, Respond, Recover) is missing entirely, that is worth noting for the gap analysis in the next step.

Missing columns or fewer than 8 risks?

  • If your register has fewer than 8 risks, return to Gemini and ask: "Identify 3 more cybersecurity risks specific to CloudVault that are not already in the register."
  • If the NIST CSF 2.0 Function column is missing, paste the completed table back into Gemini and ask it to add the function mapping.
  • If [PRIORITY] flags are missing, add them yourself to the 3 risks with the highest combination of likelihood and impact.

Help me complete my CloudVault risk register.

Your risk register is complete. You now have a structured inventory of CloudVault's biggest cybersecurity threats, scored and prioritized. Next up, you will take this register to ChatGPT and map it against the full NIST CSF 2.0 framework to find the gaps in CloudVault's defenses.

Run a NIST CSF 2.0 Gap Analysis with ChatGPT

Your risk register tells you what could go wrong at CloudVault. It does not tell you where your defenses are weakest. That is the job of a gap analysis.

A gap analysis maps CloudVault's current security posture against the NIST CSF 2.0 framework's six core functions to find the specific places where what you have falls short of what you need. In this step, you will use ChatGPT to produce that analysis. You will also discover firsthand why verifying AI output against authoritative sources is the single most important skill in GRC work.

In this step, get ready to:
  • Prompt ChatGPT to assess CloudVault against all six NIST CSF 2.0 functions.
  • Verify every framework reference ChatGPT produces against the official NIST documentation.
  • Compile a verified, prioritized gap analysis document.
Prompt ChatGPT with the scenario and framework structure

ChatGPT needs two things to produce a useful gap analysis: CloudVault's company context and the exact framework structure you want the output mapped to.

  • Switch to your ChatGPT browser tab.
  • Start a new conversation.
  • Copy and paste the following prompt into ChatGPT:
I'm a GRC analyst at CloudVault, a 50-employee SaaS startup that stores
sensitive customer documents in the cloud. Our infrastructure runs on AWS.
We have no formal security program yet and are preparing for our first
cybersecurity compliance assessment against NIST CSF 2.0.

Here are our top risks from our risk register:
- [Paste your top 3-5 risks from your risk register here, including Risk ID,
  Description, and Risk Rating]

Please assess CloudVault's likely current security posture against all six
NIST CSF 2.0 functions:
1. Govern (GV)
2. Identify (ID)
3. Protect (PR)
4. Detect (DE)
5. Respond (RS)
6. Recover (RC)

For each function, provide:
- 2-4 specific gaps with the relevant NIST CSF 2.0 category ID
  (e.g., ID.AM for Asset Management, PR.AA for Identity Management,
  Authentication, and Access Control)
- A brief description of what CloudVault is likely missing
- A maturity rating from 1 (not started) to 5 (optimized)

Format the output as a structured table or list I can use as a formal
gap analysis document.

What does this prompt do?

This prompt does three important things. First, it gives ChatGPT enough company context to tailor its analysis to a small SaaS startup on AWS rather than producing generic advice.

Second, it explicitly names all six NIST CSF 2.0 functions so ChatGPT structures its output around the correct framework. Third, it requests a specific output format (category IDs, gap descriptions, maturity ratings), which keeps the response structured and usable.

  • Before pasting, replace the bracketed section with your actual top 3-5 risks from the risk register you built in the previous step.
  • Press Enter to send the prompt.
  • Wait for ChatGPT to generate the full response.

You should see a structured output covering all six functions. Each function should have specific gaps listed with category IDs like ID.AM, PR.AA, or DE.CM.

What are these category IDs?

NIST CSF 2.0 organizes cybersecurity outcomes in a hierarchy: Functions contain Categories, which contain Subcategories. Each category has a short ID. For example, ID.AM stands for Asset Management under the Identify function. PR.AA stands for Identity Management, Authentication, and Access Control under the Protect function.

These IDs are how GRC analysts reference specific parts of the framework in professional documents. Getting them right matters because an auditor will check them.

ChatGPT only covered some functions?

If ChatGPT's response is missing one or more of the six functions, send a follow-up message asking it to complete the remaining functions. Copy the function names it missed and paste them into a follow-up prompt.

Help me get ChatGPT to cover all six NIST CSF 2.0 functions in my gap analysis.

Verify the framework references against the official source

You now have a gap analysis that looks professional and thorough. Before you trust it, ask yourself one question: are those category IDs actually real?

AI models routinely fabricate plausible-sounding framework references. A category ID like ID.SC or PR.MA might look right, but if it does not exist in the official NIST CSF 2.0 documentation, you would be shipping hallucinated compliance data to an auditor. This is the moment you find out.

  • Open the official NIST CSF 2.0 Reference Tool by visiting this link:
  • NIST CSF 2.0 Reference Tool
  • Before you start checking, pause and predict: do you think every category ID that ChatGPT produced is a real NIST CSF 2.0 category? Or do you expect to find any that are fabricated?

Now check each category ID from ChatGPT's output against the Reference Tool. Here are the real categories for each function to compare against:

  • Govern (GV) categories: GV.OC (Organizational Context), GV.RM (Risk Management Strategy), GV.RR (Roles, Responsibilities, and Authorities), GV.PO (Policy), GV.OV (Oversight), GV.SC (Cybersecurity Supply Chain Risk Management).
  • Identify (ID) categories: ID.AM (Asset Management), ID.RA (Risk Assessment), ID.IM (Improvement).
  • Protect (PR) categories: PR.AA (Identity Management, Authentication, and Access Control), PR.AT (Awareness and Training), PR.DS (Data Security), PR.PS (Platform Security), PR.IR (Technology Infrastructure Resilience).
  • Detect (DE) categories: DE.CM (Continuous Monitoring), DE.AE (Adverse Event Analysis).
  • Respond (RS) categories: RS.MA (Incident Management), RS.AN (Incident Analysis), RS.CO (Incident Reporting and Communication), RS.MI (Incident Mitigation).
  • Recover (RC) categories: RC.RP (Incident Recovery Plan Execution), RC.CO (Incident Recovery Communication).
  • Go through ChatGPT's output line by line. For every category ID it used, check whether that ID appears in the list above or in the Reference Tool.
  • Mark any IDs that do not match a real NIST CSF 2.0 category. These are hallucinated references.

Most learners find at least one fabricated category ID. This is expected and intentional. If ChatGPT produced an ID that does not exist in the official framework, you just caught an error that would have undermined your credibility with an auditor.

Why does this matter so much?

Shipping a gap analysis with fabricated framework references is the fastest way to lose credibility in GRC. An auditor who spots a made-up category ID will question every other finding in your document.

This verification skill is what separates a competent GRC analyst from someone who blindly copies AI output. Every framework reference in a professional deliverable must be traceable to the authoritative source.

Produce the final gap analysis document

Now that you know which references are real and which are fabricated, you can produce a gap analysis you would actually stand behind.

  • For any hallucinated category IDs you found, replace them with the correct NIST CSF 2.0 category from the reference list above.
  • Review the maturity ratings (1-5) ChatGPT assigned to each function. Ask yourself: does a rating of 2 for Protect make sense for a startup with no formal security program? Adjust any ratings that seem too generous for CloudVault's situation.
  • Send a follow-up prompt to ChatGPT to prioritize the gaps by business impact:
Based on the gap analysis you just produced, identify the top 3-5 gaps
that pose the greatest business risk to CloudVault.

For each gap, explain:
- Why this gap is critical for a SaaS company storing sensitive
  customer documents
- What the business impact would be if this gap is not addressed
  (e.g., data breach, regulatory penalty, customer loss)

Rank them from highest to lowest business impact.

Why prioritize by business impact?

A gap analysis with 20 findings is overwhelming. Prioritizing by business impact gives leadership a clear starting point. It also shows you can think like a business analyst, not just a checklist runner.

  • Review ChatGPT's prioritized list. Make sure the top gaps align with what you know about CloudVault: a company storing sensitive customer documents with no formal security program.
  • Compile your final gap analysis into a clean document in your text editor or Google Docs.

Your gap analysis document should now include: all six NIST CSF 2.0 functions with verified category-level references, specific gaps per function, a maturity rating (1-5) for each function, and a prioritized list of the top 3-5 gaps by business impact.

Save your corrections alongside the original

Keep a record of which category IDs you corrected. In a real GRC engagement, documenting your verification process is itself a professional deliverable. It proves due diligence.

You now have a verified gap analysis that maps CloudVault's security posture against every NIST CSF 2.0 function. Next up, you will turn your most critical gaps into actionable security policies using Claude.

Draft Security Policies with Claude

Your verified gap analysis from the previous step pinpoints exactly where CloudVault's security posture falls short across the NIST CSF 2.0 framework. Knowing where the gaps are is valuable, but gaps on paper don't protect anyone.

A GRC analyst's next job is turning those gaps into actionable security policies. These formal documents tell the organization exactly what to do, who is responsible, and when it must happen. Claude excels at structured compliance writing with precise framework references, making it the right tool for drafting policies an auditor would take seriously.

In this step, get ready to:
  • Select your top compliance gaps and prompt Claude to draft formal security policies.
  • Review each policy for audit-readiness and accurate NIST CSF 2.0 references.
  • Customize the policies with CloudVault-specific details like role titles, AWS services, and implementation timelines.
Select your top gaps and prompt Claude

Your gap analysis prioritized the top 3-5 gaps by business impact. You will pick the two most critical ones and use them to drive policy creation.

  • Open your gap analysis document and identify your two most critical gaps. These are the gaps with the highest business impact that you prioritized at the end of Step 3.
  • Note the NIST CSF 2.0 category reference for each gap (for example, PR.AA for Identity Management, Authentication, and Access Control, or RS.MA for Incident Management).
  • Switch to your Claude browser tab and start a new conversation.
  • Send Claude the following prompt, filling in your two critical gaps where indicated:
I am a GRC analyst at CloudVault, a 50-employee SaaS startup that stores sensitive customer documents on AWS. We are preparing for our first NIST CSF 2.0 compliance assessment.

Our gap analysis identified these two critical compliance gaps:

1. [[FIRST_GAP="your first critical gap with its NIST CSF 2.0 category reference, e.g. PR.AA - no formal access control policy"]]

2. [[SECOND_GAP="your second critical gap with its NIST CSF 2.0 category reference, e.g. RS.MA - no incident response procedures"]]

For each gap, draft a formal security policy with these exact sections:
- Purpose
- Scope
- Roles and Responsibilities
- Policy Statements (use specific, auditable language, not vague phrases like "appropriate measures")
- Enforcement
- Review Schedule

Each policy must reference the relevant NIST CSF 2.0 categories from the gap above.

What does this prompt do?

This prompt gives Claude three things it needs to produce useful output.

  • Context about CloudVault's size, industry, and infrastructure so the policies are relevant to the company.
  • The specific compliance gaps and their NIST CSF 2.0 category references so each policy targets a real weakness.
  • An exact output structure (Purpose through Review Schedule) so the policies follow the standard format auditors expect.

Claude will generate two full security policies. Read through both before moving on.

Claude's response got cut off?

Security policies can be long. If Claude's output stops mid-sentence, type Please continue where you left off and it will pick up from the cutoff point.

If Claude only generated one policy, ask it to draft the second one by referencing the gap you provided. Help me get both policies from Claude.

Review your policies for quality and accuracy

A policy that sounds professional but contains vague language or incorrect framework references will fail an audit. Your job as the analyst is to catch these weaknesses before anyone else does.

  • Check that each policy includes all six standard sections: Purpose, Scope, Roles and Responsibilities, Policy Statements, Enforcement, and Review Schedule.
  • Compare the NIST CSF 2.0 category references in Claude's policies against the verified references in your gap analysis from Step 3. Every category ID (such as PR.AA or RS.MA) must match what you already verified.
  • Scan the Policy Statements section for vague language. Flag any statement that uses words like "appropriate," "adequate," or "reasonable" without a specific, measurable requirement.

What makes policy language audit-ready?

An auditor needs to verify whether a policy is being followed. Vague language makes that impossible.

  • Weak: "Employees should use strong passwords." An auditor cannot measure "strong."
  • Strong: "All user accounts must enforce 12-character minimum passwords with MFA enabled within 30 days of policy adoption." An auditor can check every part of this.
  • If you found vague language or mismatched references, send Claude a follow-up message asking it to fix the specific issues. For example: "In Policy 1, replace 'appropriate access controls' with a specific requirement like 'role-based access enforced through AWS IAM policies with quarterly access reviews.'"

After your review, both policies should contain only specific, measurable statements and verified NIST CSF 2.0 references.

Customize your policies for CloudVault

Right now your policies likely contain generic placeholders like "the organization" or "the IT department." A real security policy names real people, real systems, and real deadlines. This is what makes it an organizational document instead of a template.

  • Send Claude this follow-up message to add CloudVault-specific details:
Refine both policies with these CloudVault-specific details:

- Company name: CloudVault (replace any generic references like "the organization")
- Infrastructure: AWS (specifically S3 for document storage, EC2 for application hosting, IAM for access management)
- Key roles: CTO (security executive sponsor), DevOps Lead (technical implementation owner), Security Analyst (day-to-day monitoring and compliance)
- Implementation timeline: 30 days for critical controls, 90 days for full policy rollout
- Review cycle: policies reviewed annually, compliance checks quarterly

Replace all generic placeholders with these real details throughout each policy.

Why do the details matter?

Generic policies get ignored. When a policy says "the CTO must approve access changes within 48 hours," it assigns a specific person a specific action with a specific deadline. That is enforceable. "Management should review access" is not.

Naming AWS services like S3, EC2, and IAM also helps. It tells the DevOps Lead exactly which systems the policy covers instead of leaving them to guess.

Before your final review, ask yourself: do both policies use specific, measurable language that an auditor could verify? Or do any vague phrases remain?

  • Read through both updated policies from top to bottom.
  • Confirm each policy includes the company name "CloudVault," at least one AWS service reference, named role titles (CTO, DevOps Lead), and specific timelines.
  • Copy both finalized policies into your text editor or Google Docs alongside your risk register and gap analysis.

You should now have two complete security policies. Each one targets a specific compliance gap, references verified NIST CSF 2.0 categories, follows the six-section standard structure, and reads as a CloudVault organizational document.

Policies still look generic?

If Claude kept generic language after your customization prompt, try being more direct. Quote the exact generic phrase and tell Claude what to replace it with. For example: "Change 'the IT team will manage access' to 'the DevOps Lead will manage IAM policies in AWS, with quarterly reviews approved by the CTO.'"

Help me get Claude to write more specific policies.

Your GRC deliverable package is growing. You have a risk register, a verified gap analysis, and now two professional security policies. In the next step, you will synthesize all of these findings into a board-ready executive risk report that a CEO can understand and act on.

Create an Executive Risk Report with ChatGPT

Your security policies are drafted, verified, and customized for CloudVault. You now have a risk register, a verified gap analysis, and formal policies ready to close your most critical compliance gaps.

All of that analysis is useless if leadership cannot understand it. In this step, you'll use ChatGPT to synthesize your technical findings into a board-ready executive risk report written in plain language a CEO can act on.

In this step, get ready to:
  • Feed ChatGPT your risk register, gap analysis, and policy highlights to generate a draft executive report.
  • Refine the report into a clear narrative for a non-technical audience.
  • Add a compliance readiness scorecard showing CloudVault's posture across all six NIST CSF 2.0 functions.
Feed ChatGPT your deliverables

ChatGPT is strong at synthesizing complex information into clear, structured summaries. To produce a useful executive report, it needs the key findings from each deliverable you have built so far.

  • Switch back to your ChatGPT tab and start a new conversation.
  • Compose your synthesis prompt by pasting the following into ChatGPT, filling in the highlighted sections with content from your own deliverables:
I'm a GRC analyst at CloudVault, a 50-employee SaaS startup that stores sensitive customer documents on AWS. I need you to synthesize my compliance assessment findings into a board-ready executive risk report.

Audience: Non-technical CEO. Avoid all cybersecurity jargon.

The report should be 1-2 pages and include:
1. A risk posture summary (where are we now?)
2. Top 3 findings with business impact in plain language (what is at risk?)
3. Recommended next steps (what are we doing about it?)

Here are my findings:

RISK REGISTER HIGHLIGHTS:
[[RISK_HIGHLIGHTS="paste your top 3-5 risks with their ratings from your risk register"]]

GAP ANALYSIS SUMMARY:
[[GAP_SUMMARY="paste your maturity ratings per NIST CSF 2.0 function and your top 3-5 gaps"]]

SECURITY POLICIES DRAFTED:
[[POLICIES_LIST="list the policies you drafted, e.g. Access Control Policy and Incident Response Policy"]]

What does this prompt do?

  • Setting the audience as a non-technical CEO forces ChatGPT to translate every technical finding into business language.
  • The three numbered sections structure the report around executive decision-making: situation, risk, and response.
  • Including all three deliverables gives ChatGPT full context to draw connections across your risk register, gap analysis, and policies.
  • Send the prompt and review ChatGPT's response.

You should see a 1-2 page report structured around CloudVault's risk posture, key findings, and recommended actions.

Output too technical or generic?

  • If the report uses cybersecurity jargon, send a follow-up asking ChatGPT to rewrite assuming the reader has zero cybersecurity knowledge and to replace every technical term with a plain English equivalent.
  • If the findings feel too vague, paste more specific detail from your risk register or gap analysis and ask ChatGPT to incorporate those specifics.
  • Help me get ChatGPT to write a clearer executive risk report for CloudVault.
Ensure the report tells a story

A strong executive report is not a list of findings. It answers three questions in order: Where are we now? What is at risk? What are we doing about it?

  • Read through your draft report and check whether it follows that three-question flow.
  • Send this follow-up prompt to ChatGPT to tighten the narrative:
Review this report against these three questions that every executive report must answer in order:
1. Where are we now? (current security posture)
2. What is at risk? (business impact of the gaps)
3. What are we doing about it? (policies drafted and next steps)

Revise the report so it flows through these three questions in order. Quantify risk where possible (e.g., "3 of 6 security functions rated below target maturity"). Replace any remaining jargon with plain language.

Why the three-question structure?

Executives make decisions based on situation, risk, and response. This structure maps directly to that mental model.

Quantifying risk (e.g., "3 of 6 security functions rated below target maturity") gives leadership concrete numbers to anchor decisions on instead of vague warnings.

  • Review the revised report that ChatGPT generates.
  • Confirm that every paragraph uses plain language a non-technical reader could follow without a glossary.

If you spot any remaining jargon or unexplained acronyms, ask ChatGPT to replace them with plain English.

Report still reads like a technical document?

  • Try this test: could you hand this report to someone who has never heard the word "cybersecurity" and have them understand what to do? If not, send another follow-up telling ChatGPT to imagine explaining the findings to a restaurant owner.
  • If the report is too long, ask ChatGPT to cut it to one page with only the most critical findings.
  • My executive report still has too much jargon. How do I fix it?
Add a compliance readiness scorecard

A single table can communicate compliance posture faster than a full page of text. The scorecard gives leadership one view of where CloudVault stands across the entire NIST CSF 2.0 framework.

  • Send this follow-up prompt to ChatGPT to add the scorecard:
Add a compliance readiness scorecard table to the report with these columns:
- NIST CSF 2.0 Function (Govern, Identify, Protect, Detect, Respond, Recover)
- Current Maturity Rating (use the 1-5 ratings from my gap analysis)
- Target Maturity Rating (the level CloudVault needs for credible compliance)
- Gap (difference between target and current)

Format it as a clear table that a non-technical executive can scan in seconds.

What does this scorecard show?

Each row represents one of the six NIST CSF 2.0 functions: Govern (GV), Identify (ID), Protect (PR), Detect (DE), Respond (RS), and Recover (RC).

The gap column highlights exactly where CloudVault needs to invest. A function with a gap of 3 demands more immediate attention than one with a gap of 1.

  • Review the scorecard table in ChatGPT's response.
  • Verify that all six NIST CSF 2.0 functions appear in the table: Govern, Identify, Protect, Detect, Respond, and Recover.
  • Cross-check the current maturity ratings against the ratings in your gap analysis from Step 3. If any ratings don't match, ask ChatGPT to correct them using your verified values.

Scorecard data doesn't match your gap analysis?

  • ChatGPT may invent maturity ratings instead of using the ones you provided. Paste the exact ratings from your gap analysis and tell ChatGPT to use those specific values.
  • If a function is missing from the table, ask ChatGPT to add it. All six functions must be present for the scorecard to be complete.
  • ChatGPT is making up maturity ratings instead of using mine. How do I fix this?

Before you finalize, ask yourself: does this report give a CEO everything they need to understand CloudVault's security posture and decide what to do next?

Your finished executive risk report should include four components: a risk posture summary, the top 3 findings with business impact in plain language, a compliance readiness scorecard table covering all six NIST CSF 2.0 functions, and recommended next steps. The entire report should be understandable by someone with no cybersecurity background.

  • Copy the final report, including the scorecard table, into your text editor or Google Docs alongside your other deliverables.

What is in your complete GRC deliverable package?

You now have four deliverables that would take a solo analyst weeks to produce manually.

  • A risk register identifying and scoring CloudVault's top cybersecurity threats (built with Gemini).
  • A verified gap analysis mapping CloudVault against all six NIST CSF 2.0 functions (produced with ChatGPT, verified by you).
  • At least two security policies with precise framework references and CloudVault-specific details (drafted by Claude).
  • A board-ready executive risk report with a compliance readiness scorecard (synthesized by ChatGPT).

Secret mission

Cross-Framework Compliance Mapping

Real organizations rarely comply with just one framework. In this challenge, you'll use Claude to map your NIST CSF 2.0 gap analysis findings to ISO 27001:2022 Annex A controls. You'll build a cross-reference table, identify controls that close gaps in both frameworks at once, and verify every AI-generated reference. This is the skill that separates junior GRC analysts from senior ones.

Clean Up Your Resources

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely on free-tier AI platforms and local documents, so there are no ongoing costs.

Resources you used:

  • AI conversations in Claude, ChatGPT, and Gemini.
  • GRC deliverable documents (risk register, gap analysis, security policies, executive risk report, and cross-framework compliance mapping table).

Keep everything running

No action needed. Choose this if you plan to continue refining your GRC deliverables or want to reference them for future compliance work.

  • Your AI conversations remain accessible in each platform for future reference.
  • Your GRC documents stay wherever you saved them, whether that is Google Docs, a text editor, or local files on your machine.
  • Your free-tier accounts on all three platforms remain active at no cost.

Pause - I'll come back to this later

Organize your deliverables so they are easy to find when you return. There are no running processes or costs to pause.

  • Create a dedicated folder called "CloudVault GRC Project" in Google Docs or on your local machine and move all six deliverable documents into it.
  • Rename your AI conversations in Claude and ChatGPT to include "CloudVault GRC" so you can locate them quickly later.
  • Bookmark the NIST CSF 2.0 Reference Tool page so you can return to it for future verification work.

Delete - I don't want to use this again

Remove all project conversations and documents. Your free-tier accounts will remain active.

  • In Claude, open each CloudVault-related conversation and delete it from your conversation history.
  • In ChatGPT, open each CloudVault-related conversation and delete it from your conversation history.
  • In Gemini, open each CloudVault-related conversation and delete it from your activity.
  • If you saved your GRC documents in Google Docs, select all six documents and move them to the Trash. If you saved them as local files, delete them from your file system.

That's a Wrap!

That's a Wrap!

Nice work! You just produced a complete GRC deliverable package for a realistic cloud SaaS company, using three AI platforms strategically to do in under an hour what would normally take a solo analyst weeks.

What you learned:

  • Built a risk register with Gemini, ran a NIST CSF 2.0 gap analysis with ChatGPT, drafted security policies with Claude, and synthesized everything into a board-ready executive risk report, learning to match the right AI platform to each GRC task.
  • Caught AI-fabricated framework references by verifying ChatGPT's output against the official NIST CSF 2.0 documentation, proving why human verification is the skill that makes a GRC analyst irreplaceable.
  • Translated technical findings into business language a CEO can act on, including a compliance readiness scorecard covering all six NIST CSF 2.0 functions.
  • Secret Mission: Mapped findings across NIST CSF 2.0 and ISO 27001:2022, demonstrating multi-framework compliance capability and the analyst judgment required to verify AI output across different standards.

Ready to quiz yourself?