# Co Compliance Gap Analysis

> Detects control and evidence gaps with severity ranking and remediation urgency. Use when ANALYZING compliance gaps, assessing control deficiencies, prioritizing remediation efforts, or preparing gap reports for management.

- Skill: `nahisaho/co-compliance-gap-analysis` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add nahisaho/co-compliance-gap-analysis`
- Raw SKILL.md: https://api.skillmd.com/api/skills/nahisaho/co-compliance-gap-analysis/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: nahisaho (https://skillmd.com/u/nahisaho)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/nahisaho/co-compliance-gap-analysis

---


# Gap Analysis

Detect control/evidence gaps and rank remediation urgency.

## Use This Skill When

- Identifying missing or ineffective controls.
- Ranking compliance gaps by business impact.
- Preparing gap reports for management review.

## Workflow

1. Compare control mapping against evidence inventory.
2. Identify: missing controls, ineffective controls, missing evidence, expired evidence.
3. Classify severity: Critical / High / Medium / Low (based on business impact).
4. Calculate compliance coverage percentage.
5. Save gap report to files.

## Deliverables

- `results/gap-analysis.md`: gaps with severity and remediation urgency.
- Reuse `assets/gap-analysis-template.md` when producing standardized gap reports.

## Quality Gates

- [ ] All gaps classified by severity with business impact rationale.
- [ ] No gaps silently downgraded (rationale required for severity changes).
- [ ] Compliance coverage percentage calculated.
- [ ] Root cause identified for Non-Compliant findings.

If any gate fails: identify the issue, fix, and re-validate.

## Gotchas

- 重大度は「技術的深刻度」ではなく「ビジネスインパクト」で判定すること。データ漏洩リスクのある Low-tech ギャップは Critical になりうる
- 「Partially Compliant」は最もグレーな判定。具体的に何が不足しているか明記すること
- ギャップの root cause を特定しないと、remediation が表面的な対処になる

## Validation Loop

1. ギャップ分析を生成
2. チェック: 重大度根拠、カバレッジ%、root cause、ダウングレード根拠
3. 不合格なら修正
4. ユーザー承認後のみ remediation に進む ⏸️