GRC Messaging Guardrails
Validate compliance and security terminology in B2B SaaS marketing copy. Prevent claim errors that
erode credibility with CISOs, compliance managers, and security-aware buyers.
Why This Skill Exists
GRC (Governance, Risk, and Compliance) buyers are domain experts. They will catch every terminology
mistake. A single error — calling SOC 2 a "certification" instead of an attestation, or claiming a
product "guarantees compliance" — destroys credibility with the exact audience you're trying to reach.
Most marketing teams making these errors aren't careless. They lack domain-specific validation
processes. This skill acts as that validation layer.
When to Use This Skill
- Writing or reviewing ad copy that mentions compliance frameworks
- Creating landing pages for GRC/compliance products
- Drafting email sequences targeting CISOs, compliance managers, or security teams
- Building case studies that reference audit outcomes
- Reviewing AI-generated copy before publication
- Creating sales enablement content about compliance topics
- Writing blog posts or thought leadership about security/compliance
When NOT to Use This Skill
- General SaaS marketing copy with no compliance references
- Internal documentation not intended for external audiences
- Product/engineering documentation (different accuracy standards apply)
- Legal documents (requires actual legal review, not marketing validation)
Terminology Dictionary
Framework Classification (CRITICAL)
These are the most frequently confused terms in GRC marketing. Get these wrong and your buyer knows
you don't understand their world.
| Framework |
Correct Classification |
Common Error |
Why It Matters |
| SOC 2 |
Attestation (or examination/report) |
Certification |
SOC 2 is issued by a CPA firm as an attestation report, not a certification body. CISOs know this instantly. |
| SOC 1 |
Attestation (or examination/report) |
Certification |
Same as SOC 2 — CPA attestation, not certification. |
| ISO 27001 |
Certification |
Compliance |
Issued by accredited certification bodies. "ISO 27001 certified" is correct. "ISO 27001 compliant" is weaker but acceptable. |
| ISO 27701 |
Certification (extension to 27001) |
Standalone standard |
Always reference as extension: "ISO 27701 (privacy extension to ISO 27001)" |
| GDPR |
Regulation |
Certification Standard |
EU regulation. Companies comply with GDPR; they are not "GDPR certified." |
| HIPAA |
Regulation (US federal law) |
Certification Standard |
There is no official HIPAA certification. Companies can be "HIPAA compliant" but not "HIPAA certified." |
| PCI DSS |
Standard |
Regulation Certification |
Payment Card Industry Data Security Standard. Compliance is validated, not certified. Use "PCI DSS compliant." |
| CCPA/CPRA |
Regulation (California state law) |
Standard |
State privacy regulation. Companies comply; they are not certified. |
| NIST CSF |
Framework |
Standard Regulation |
Voluntary framework. Companies "align with" or "adopt" NIST CSF. They don't "comply with" it (it's not mandatory). |
| NIST 800-53 |
Publication/Controls catalog |
Certification |
Required for FedRAMP. Use "implements NIST 800-53 controls," not "NIST 800-53 certified." |
| FedRAMP |
Authorization program |
Certification |
Companies receive FedRAMP "authorization," not "certification." |
| CSA STAR |
Certification program |
Compliance |
Cloud Security Alliance program. "CSA STAR certified" is correct at Level 2. Level 1 is self-assessment only. |
| CIS Controls |
Best practice framework |
Standard Regulation |
Companies "implement" or "align to" CIS Controls. |
Correct Usage Patterns
✅ "Achieve SOC 2 attestation"
✅ "Complete your SOC 2 examination"
✅ "Get your SOC 2 report"
✅ "Obtain ISO 27001 certification"
✅ "Maintain GDPR compliance"
✅ "Demonstrate HIPAA compliance"
✅ "Align with NIST CSF"
❌ "Get SOC 2 certified"
❌ "Achieve SOC 2 compliance certification"
❌ "GDPR certified"
❌ "HIPAA certification"
❌ "NIST compliant"
❌ "PCI certified"
Commonly Confused Terms
| Term |
Correct Usage |
Incorrect Usage |
| Audit |
An examination by a qualified assessor. SOC 2 audits are performed by CPA firms. ISO audits by accredited CBs. |
Don't use "audit" and "assessment" interchangeably — they have different legal/professional meanings. |
| Assessor vs. Auditor |
SOC 2: auditor (CPA). ISO 27001: auditor (CB). Penetration test: assessor. |
Mixing these signals unfamiliarity with the audit process. |
| Controls |
Technical or administrative safeguards. "Implement controls" or "map controls." |
Don't say "install controls" or "activate controls." Controls aren't software features. |
| Compliance |
State of meeting requirements. Always relative to a specific standard/regulation. |
Never use "fully compliant" without specifying the framework. Avoid "100% compliant" — implies permanence. |
| Continuous compliance |
Ongoing monitoring and maintenance of compliance posture. |
Don't imply it means "never out of compliance." It means continuous monitoring, not perfection. |
| Risk |
Potential impact × likelihood. Always contextual. |
Don't use "risk" and "vulnerability" interchangeably. A vulnerability is a weakness; a risk includes the probability and impact of exploitation. |
| Posture |
Overall security/compliance state. "Security posture" or "compliance posture." |
Acceptable in marketing. Avoid "compliance score" unless you actually provide a numerical score. |
Claim Validation Rules
NEVER Make These Claims
These claims are factually incorrect or legally problematic. Flag and rewrite immediately.
| Banned Claim |
Why |
Suggested Rewrite |
| "Guarantees compliance" |
No tool can guarantee compliance. Compliance depends on organizational controls, processes, and human behavior. |
"Accelerates your path to compliance" or "Streamlines compliance workflows" |
| "Automates compliance" (unqualified) |
Misleading. Tools automate evidence collection, monitoring, and workflows — not the entirety of compliance. |
"Automates evidence collection and compliance monitoring" |
| "Get compliant in X days" (absolute) |
Timelines vary by org size, complexity, and readiness. Absolute claims invite legal risk. |
"Companies typically achieve [framework] readiness in X-Y weeks" (with supporting data) |
| "100% compliant" |
Compliance is continuous, not binary. This implies a permanent state. |
"Maintain continuous compliance posture" |
| "Replace your auditor" |
Tools supplement, never replace, qualified auditors. This claim undermines buyer trust. |
"Reduce audit preparation time by X%" |
| "One platform for all frameworks" |
Implies equal depth across all frameworks. Buyers know this is unrealistic. |
"Supports [X] frameworks including [list specific ones]" |
| "No-code compliance" |
Oversimplifies. Implementation always requires configuration and domain decisions. |
"Streamlined setup with minimal technical overhead" |
| "Hack-proof" / "Breach-proof" |
No product can make this claim. Immediate credibility killer. |
"Strengthens your security posture" or "Reduces attack surface" |
Claims That Require Qualification
These claims are acceptable with proper context. Flag if used without qualification.
| Claim |
Required Qualification |
| "Reduces audit time" |
Must specify: by how much, based on what data, for which framework. E.g., "Reduces SOC 2 audit prep time by 60% based on customer data (n=50)." |
| "Saves X hours" |
Must cite source: customer survey, case study, or internal benchmark. |
| "Trusted by X companies" |
Must be verifiable. Specify segment if possible: "Trusted by [APPROVED CUSTOMER COUNT] [SEGMENT] companies." |
| "Faster than [competitor]" |
Must have documented basis. Comparative claims require defensible evidence. |
| "AI-powered" |
Must specify what the AI does. "AI-powered risk assessment" is acceptable. "AI-powered compliance" is vague. |
| "Enterprise-grade" |
Must be backed by specific capabilities: SSO, RBAC, SOC 2 Type II of your own product, uptime SLAs, etc. |
Claims That Are Safe
| Claim Pattern |
Example |
| Workflow description |
"Automates evidence collection across [X] integrations" |
| Customer proof (attributed) |
"Reduced audit prep from 8 weeks to 2 weeks — [Customer Name], [Title]" |
| Capability statement |
"Maps controls across SOC 2, ISO 27001, and GDPR simultaneously" |
| Risk-first framing |
"Identify compliance gaps before your auditor does" |
| Time-value |
"Get audit-ready faster with automated evidence collection" |
| Outcome-focused |
"Close enterprise deals faster with trust documentation" |
Narrative Framing Rules
Lead With Risk, Not Features
GRC buyers are motivated by risk reduction, not feature excitement. Every piece of copy should answer:
"What bad thing does this help me avoid?" before "What good thing does this help me achieve?"
❌ Feature-first: "Our platform automates SOC 2 evidence collection with 150+ integrations."
✅ Risk-first: "Manual evidence collection is the #1 reason SOC 2 audits take 3x longer than
they should. Automate it across 150+ integrations."
❌ Feature-first: "AI-powered risk assessment dashboard."
✅ Risk-first: "Your board wants a risk score. Your spreadsheet can't give them one. Get
real-time risk visibility your leadership team actually trusts."
❌ Feature-first: "Multi-framework compliance management platform."
✅ Risk-first: "Managing SOC 2, ISO 27001, and GDPR in separate spreadsheets means one
framework is always out of date. Unify them."
Buyer Persona Tone Calibration
| Persona |
What They Care About |
Tone |
Avoid |
| CISO |
Risk reduction, board reporting, incident preparedness, vendor risk |
Technical, strategic, peer-level. Never condescending. |
Marketing fluff, vague claims, basic security explanations they already know. |
| GRC Manager / Compliance Lead |
Audit efficiency, evidence gaps, framework coverage, workflow reduction |
Practical, operational, empathetic to daily pain. |
Strategic vision statements — they want tactical help. |
| CTO / VP Engineering |
Integration ease, engineering time not wasted on compliance, API quality |
Technical depth, developer-friendly, low-friction messaging. |
"No-code" claims, non-technical feature descriptions. |
| CFO / Procurement |
ROI, cost of non-compliance, vendor consolidation, time-to-value |
Business case, quantified outcomes, risk-as-cost framing. |
Technical jargon, feature lists, compliance acronym soup. |
Enterprise Trust Signals
In order of credibility impact for GRC buyers:
- Named customer quotes with title and company (highest trust)
- Specific metrics from customer deployments (e.g., "60% faster audit prep")
- Analyst recognition (Gartner, Forrester, G2 category leader)
- Your own compliance posture (your SOC 2 Type II report, ISO 27001 cert)
- Customer count with segment specificity ("[APPROVED CUSTOMER COUNT] [SEGMENT] companies" > "trusted by many")
- Integration count (signals depth of evidence automation)
- Framework count (signals breadth, but only if each is genuinely supported)
Validation Checklist
Run this checklist on every piece of marketing copy before publication.
Terminology Check
Claim Check
Narrative Check
Proof Check
Examples
Ad Copy Validation
Input (flagged):
"Get SOC 2 certified in 2 weeks. Our AI-powered platform guarantees compliance and replaces the
need for expensive auditors. Trusted by hundreds of companies."
Output (corrected):
"Get SOC 2 audit-ready in as little as 2 weeks. Automate evidence collection with AI-powered
monitoring and reduce audit prep time by [APPROVED METRIC — check proof library]%.
Trusted by [APPROVED CUSTOMER COUNT] [SEGMENT] companies."
Note: Never insert specific customer counts, named logos, or performance metrics
unless they are supplied in an approved proof library. If proof is unavailable,
mark the claim as [PROOF NEEDED] rather than inventing plausible numbers.
Corrections applied:
- "certified" → "audit-ready" (SOC 2 is an attestation, not a certification)
- "guarantees compliance" → "automate evidence collection" (no tool guarantees compliance)
- "replaces the need for auditors" → "reduce audit prep time" (tools supplement, not replace)
- "hundreds of companies" → "[APPROVED CUSTOMER COUNT] [SEGMENT] companies" (specific > vague, but must be verified)
- Named customers require explicit logo usage permission — use [APPROVED LOGOS] placeholder if unavailable
Landing Page Headline Validation
Input (flagged):
"The All-in-One Compliance Certification Platform"
Output (corrected):
"Compliance Automation for Growing SaaS Teams"
Corrections applied:
- "Certification Platform" conflates compliance with certification — most frameworks don't involve certification
- "All-in-One" is a hype claim without substance — replaced with specific audience
- Added "Growing SaaS Teams" for ICP specificity
Integration Notes
With Other Skills
- Copywriting skills: Run this guardrails check AFTER copy is drafted, as a validation layer
- Ad creative skills: Apply before any ad copy goes to paid platforms
- Email sequence skills: Validate every email in a nurture sequence — terminology errors compound
- Case study skills: Apply the Proof Check section to validate all metrics and quotes
With Brand Context
For best results, upload alongside this skill:
- Your company's message house or positioning document
- An approved terminology glossary (extends this skill's dictionary)
- A list of approved customer quotes and metrics
- Your competitor positioning guidelines (what you can/cannot say about competitors)
Changelog
- v1.0 (March 2026): Initial release. Terminology dictionary, claim validation, narrative framing, validation checklist.
1---2name: grc-messaging-guardrails3description: Validates compliance, security, and GRC terminology in marketing copy. Enforces accurate claims, prevents common mistakes (e.g., calling SOC 2 a "certification"), and applies risk-first narrative framing for B2B SaaS audiences. Use when writing or reviewing any marketing content that references compliance frameworks, security standards, regulatory requirements, or audit processes. Also use when creating ads, landing pages, emails, case studies, or sales collateral for GRC/cybersecurity B2B SaaS products.4---56# GRC Messaging Guardrails78> Validate compliance and security terminology in B2B SaaS marketing copy. Prevent claim errors that9> erode credibility with CISOs, compliance managers, and security-aware buyers.1011## Why This Skill Exists1213GRC (Governance, Risk, and Compliance) buyers are domain experts. They will catch every terminology14mistake. A single error — calling SOC 2 a "certification" instead of an attestation, or claiming a15product "guarantees compliance" — destroys credibility with the exact audience you're trying to reach.1617Most marketing teams making these errors aren't careless. They lack domain-specific validation18processes. This skill acts as that validation layer.1920## When to Use This Skill2122- Writing or reviewing ad copy that mentions compliance frameworks23- Creating landing pages for GRC/compliance products24- Drafting email sequences targeting CISOs, compliance managers, or security teams25- Building case studies that reference audit outcomes26- Reviewing AI-generated copy before publication27- Creating sales enablement content about compliance topics28- Writing blog posts or thought leadership about security/compliance2930## When NOT to Use This Skill3132- General SaaS marketing copy with no compliance references33- Internal documentation not intended for external audiences34- Product/engineering documentation (different accuracy standards apply)35- Legal documents (requires actual legal review, not marketing validation)3637---3839## Terminology Dictionary4041### Framework Classification (CRITICAL)4243These are the most frequently confused terms in GRC marketing. Get these wrong and your buyer knows44you don't understand their world.4546| Framework | Correct Classification | Common Error | Why It Matters |47|-----------|----------------------|--------------|----------------|48| **SOC 2** | Attestation (or examination/report) | ~~Certification~~ | SOC 2 is issued by a CPA firm as an attestation report, not a certification body. CISOs know this instantly. |49| **SOC 1** | Attestation (or examination/report) | ~~Certification~~ | Same as SOC 2 — CPA attestation, not certification. |50| **ISO 27001** | Certification | ~~Compliance~~ | Issued by accredited certification bodies. "ISO 27001 certified" is correct. "ISO 27001 compliant" is weaker but acceptable. |51| **ISO 27701** | Certification (extension to 27001) | ~~Standalone standard~~ | Always reference as extension: "ISO 27701 (privacy extension to ISO 27001)" |52| **GDPR** | Regulation | ~~Certification~~ ~~Standard~~ | EU regulation. Companies comply with GDPR; they are not "GDPR certified." |53| **HIPAA** | Regulation (US federal law) | ~~Certification~~ ~~Standard~~ | There is no official HIPAA certification. Companies can be "HIPAA compliant" but not "HIPAA certified." |54| **PCI DSS** | Standard | ~~Regulation~~ ~~Certification~~ | Payment Card Industry Data Security Standard. Compliance is validated, not certified. Use "PCI DSS compliant." |55| **CCPA/CPRA** | Regulation (California state law) | ~~Standard~~ | State privacy regulation. Companies comply; they are not certified. |56| **NIST CSF** | Framework | ~~Standard~~ ~~Regulation~~ | Voluntary framework. Companies "align with" or "adopt" NIST CSF. They don't "comply with" it (it's not mandatory). |57| **NIST 800-53** | Publication/Controls catalog | ~~Certification~~ | Required for FedRAMP. Use "implements NIST 800-53 controls," not "NIST 800-53 certified." |58| **FedRAMP** | Authorization program | ~~Certification~~ | Companies receive FedRAMP "authorization," not "certification." |59| **CSA STAR** | Certification program | ~~Compliance~~ | Cloud Security Alliance program. "CSA STAR certified" is correct at Level 2. Level 1 is self-assessment only. |60| **CIS Controls** | Best practice framework | ~~Standard~~ ~~Regulation~~ | Companies "implement" or "align to" CIS Controls. |6162### Correct Usage Patterns6364```65✅ "Achieve SOC 2 attestation"66✅ "Complete your SOC 2 examination" 67✅ "Get your SOC 2 report"68✅ "Obtain ISO 27001 certification"69✅ "Maintain GDPR compliance"70✅ "Demonstrate HIPAA compliance"71✅ "Align with NIST CSF"7273❌ "Get SOC 2 certified"74❌ "Achieve SOC 2 compliance certification"75❌ "GDPR certified"76❌ "HIPAA certification"77❌ "NIST compliant"78❌ "PCI certified"79```8081### Commonly Confused Terms8283| Term | Correct Usage | Incorrect Usage |84|------|--------------|-----------------|85| **Audit** | An examination by a qualified assessor. SOC 2 audits are performed by CPA firms. ISO audits by accredited CBs. | Don't use "audit" and "assessment" interchangeably — they have different legal/professional meanings. |86| **Assessor vs. Auditor** | SOC 2: auditor (CPA). ISO 27001: auditor (CB). Penetration test: assessor. | Mixing these signals unfamiliarity with the audit process. |87| **Controls** | Technical or administrative safeguards. "Implement controls" or "map controls." | Don't say "install controls" or "activate controls." Controls aren't software features. |88| **Compliance** | State of meeting requirements. Always relative to a specific standard/regulation. | Never use "fully compliant" without specifying the framework. Avoid "100% compliant" — implies permanence. |89| **Continuous compliance** | Ongoing monitoring and maintenance of compliance posture. | Don't imply it means "never out of compliance." It means continuous monitoring, not perfection. |90| **Risk** | Potential impact × likelihood. Always contextual. | Don't use "risk" and "vulnerability" interchangeably. A vulnerability is a weakness; a risk includes the probability and impact of exploitation. |91| **Posture** | Overall security/compliance state. "Security posture" or "compliance posture." | Acceptable in marketing. Avoid "compliance score" unless you actually provide a numerical score. |9293---9495## Claim Validation Rules9697### NEVER Make These Claims9899These claims are factually incorrect or legally problematic. Flag and rewrite immediately.100101| Banned Claim | Why | Suggested Rewrite |102|-------------|-----|-------------------|103| "Guarantees compliance" | No tool can guarantee compliance. Compliance depends on organizational controls, processes, and human behavior. | "Accelerates your path to compliance" or "Streamlines compliance workflows" |104| "Automates compliance" (unqualified) | Misleading. Tools automate evidence collection, monitoring, and workflows — not the entirety of compliance. | "Automates evidence collection and compliance monitoring" |105| "Get compliant in X days" (absolute) | Timelines vary by org size, complexity, and readiness. Absolute claims invite legal risk. | "Companies typically achieve [framework] readiness in X-Y weeks" (with supporting data) |106| "100% compliant" | Compliance is continuous, not binary. This implies a permanent state. | "Maintain continuous compliance posture" |107| "Replace your auditor" | Tools supplement, never replace, qualified auditors. This claim undermines buyer trust. | "Reduce audit preparation time by X%" |108| "One platform for all frameworks" | Implies equal depth across all frameworks. Buyers know this is unrealistic. | "Supports [X] frameworks including [list specific ones]" |109| "No-code compliance" | Oversimplifies. Implementation always requires configuration and domain decisions. | "Streamlined setup with minimal technical overhead" |110| "Hack-proof" / "Breach-proof" | No product can make this claim. Immediate credibility killer. | "Strengthens your security posture" or "Reduces attack surface" |111112### Claims That Require Qualification113114These claims are acceptable with proper context. Flag if used without qualification.115116| Claim | Required Qualification |117|-------|----------------------|118| "Reduces audit time" | Must specify: by how much, based on what data, for which framework. E.g., "Reduces SOC 2 audit prep time by 60% based on customer data (n=50)." |119| "Saves X hours" | Must cite source: customer survey, case study, or internal benchmark. |120| "Trusted by X companies" | Must be verifiable. Specify segment if possible: "Trusted by [APPROVED CUSTOMER COUNT] [SEGMENT] companies." |121| "Faster than [competitor]" | Must have documented basis. Comparative claims require defensible evidence. |122| "AI-powered" | Must specify what the AI does. "AI-powered risk assessment" is acceptable. "AI-powered compliance" is vague. |123| "Enterprise-grade" | Must be backed by specific capabilities: SSO, RBAC, SOC 2 Type II of your own product, uptime SLAs, etc. |124125### Claims That Are Safe126127| Claim Pattern | Example |128|--------------|---------|129| Workflow description | "Automates evidence collection across [X] integrations" |130| Customer proof (attributed) | "Reduced audit prep from 8 weeks to 2 weeks — [Customer Name], [Title]" |131| Capability statement | "Maps controls across SOC 2, ISO 27001, and GDPR simultaneously" |132| Risk-first framing | "Identify compliance gaps before your auditor does" |133| Time-value | "Get audit-ready faster with automated evidence collection" |134| Outcome-focused | "Close enterprise deals faster with trust documentation" |135136---137138## Narrative Framing Rules139140### Lead With Risk, Not Features141142GRC buyers are motivated by risk reduction, not feature excitement. Every piece of copy should answer:143"What bad thing does this help me avoid?" before "What good thing does this help me achieve?"144145```146❌ Feature-first: "Our platform automates SOC 2 evidence collection with 150+ integrations."147✅ Risk-first: "Manual evidence collection is the #1 reason SOC 2 audits take 3x longer than 148 they should. Automate it across 150+ integrations."149150❌ Feature-first: "AI-powered risk assessment dashboard." 151✅ Risk-first: "Your board wants a risk score. Your spreadsheet can't give them one. Get 152 real-time risk visibility your leadership team actually trusts."153154❌ Feature-first: "Multi-framework compliance management platform."155✅ Risk-first: "Managing SOC 2, ISO 27001, and GDPR in separate spreadsheets means one 156 framework is always out of date. Unify them."157```158159### Buyer Persona Tone Calibration160161| Persona | What They Care About | Tone | Avoid |162|---------|---------------------|------|-------|163| **CISO** | Risk reduction, board reporting, incident preparedness, vendor risk | Technical, strategic, peer-level. Never condescending. | Marketing fluff, vague claims, basic security explanations they already know. |164| **GRC Manager / Compliance Lead** | Audit efficiency, evidence gaps, framework coverage, workflow reduction | Practical, operational, empathetic to daily pain. | Strategic vision statements — they want tactical help. |165| **CTO / VP Engineering** | Integration ease, engineering time not wasted on compliance, API quality | Technical depth, developer-friendly, low-friction messaging. | "No-code" claims, non-technical feature descriptions. |166| **CFO / Procurement** | ROI, cost of non-compliance, vendor consolidation, time-to-value | Business case, quantified outcomes, risk-as-cost framing. | Technical jargon, feature lists, compliance acronym soup. |167168### Enterprise Trust Signals169170In order of credibility impact for GRC buyers:1711721. **Named customer quotes with title and company** (highest trust)1732. **Specific metrics from customer deployments** (e.g., "60% faster audit prep")1743. **Analyst recognition** (Gartner, Forrester, G2 category leader)1754. **Your own compliance posture** (your SOC 2 Type II report, ISO 27001 cert)1765. **Customer count with segment specificity** ("[APPROVED CUSTOMER COUNT] [SEGMENT] companies" > "trusted by many")1776. **Integration count** (signals depth of evidence automation)1787. **Framework count** (signals breadth, but only if each is genuinely supported)179180---181182## Validation Checklist183184Run this checklist on every piece of marketing copy before publication.185186### Terminology Check187- [ ] Every framework is classified correctly (attestation/certification/regulation/standard/framework)188- [ ] "SOC 2" never appears next to "certification" or "certified"189- [ ] "HIPAA" and "GDPR" never appear next to "certification" or "certified"190- [ ] "ISO 27001" uses "certification" (not "attestation" or "compliance")191- [ ] "Compliance" always specifies which framework192- [ ] "Controls" are not described as product features or software to install193194### Claim Check195- [ ] No absolute guarantees ("guarantees compliance," "100% compliant," "hack-proof")196- [ ] All time-based claims are qualified with source data197- [ ] All comparative claims have documented evidence198- [ ] "AI-powered" specifies what the AI actually does199- [ ] Customer proof points are attributed and approved for use200- [ ] No claims that the product replaces auditors or legal counsel201202### Narrative Check203- [ ] Copy leads with risk/pain, not features204- [ ] Persona-appropriate tone (not condescending to CISOs, not overly technical for CFOs)205- [ ] No hype words: "revolutionary," "game-changing," "unprecedented," "cutting-edge" (GRC buyers tune these out)206- [ ] No excessive em dashes in copy207- [ ] No AI-written patterns: "In today's landscape," "It's worth noting," "navigating the complex world of"208209### Proof Check210- [ ] Trust signals are ordered by credibility (named quotes > metrics > logos)211- [ ] Customer logos have explicit usage permission212- [ ] Case study metrics are current and verified213- [ ] Your own compliance certifications are listed (practice what you preach)214215---216217## Examples218219### Ad Copy Validation220221**Input (flagged):**222> "Get SOC 2 certified in 2 weeks. Our AI-powered platform guarantees compliance and replaces the223> need for expensive auditors. Trusted by hundreds of companies."224225**Output (corrected):**226> "Get SOC 2 audit-ready in as little as 2 weeks. Automate evidence collection with AI-powered227> monitoring and reduce audit prep time by [APPROVED METRIC — check proof library]%.228> Trusted by [APPROVED CUSTOMER COUNT] [SEGMENT] companies."229230**Note:** Never insert specific customer counts, named logos, or performance metrics231unless they are supplied in an approved proof library. If proof is unavailable,232mark the claim as `[PROOF NEEDED]` rather than inventing plausible numbers.233234**Corrections applied:**2351. "certified" → "audit-ready" (SOC 2 is an attestation, not a certification)2362. "guarantees compliance" → "automate evidence collection" (no tool guarantees compliance)2373. "replaces the need for auditors" → "reduce audit prep time" (tools supplement, not replace)2384. "hundreds of companies" → "[APPROVED CUSTOMER COUNT] [SEGMENT] companies" (specific > vague, but must be verified)2395. Named customers require explicit logo usage permission — use [APPROVED LOGOS] placeholder if unavailable240241### Landing Page Headline Validation242243**Input (flagged):**244> "The All-in-One Compliance Certification Platform"245246**Output (corrected):**247> "Compliance Automation for Growing SaaS Teams"248249**Corrections applied:**2501. "Certification Platform" conflates compliance with certification — most frameworks don't involve certification2512. "All-in-One" is a hype claim without substance — replaced with specific audience2523. Added "Growing SaaS Teams" for ICP specificity253254---255256## Integration Notes257258### With Other Skills259- **Copywriting skills:** Run this guardrails check AFTER copy is drafted, as a validation layer260- **Ad creative skills:** Apply before any ad copy goes to paid platforms261- **Email sequence skills:** Validate every email in a nurture sequence — terminology errors compound262- **Case study skills:** Apply the Proof Check section to validate all metrics and quotes263264### With Brand Context265For best results, upload alongside this skill:266- Your company's message house or positioning document267- An approved terminology glossary (extends this skill's dictionary)268- A list of approved customer quotes and metrics269- Your competitor positioning guidelines (what you can/cannot say about competitors)270271---272273## Changelog274275- **v1.0** (March 2026): Initial release. Terminology dictionary, claim validation, narrative framing, validation checklist.
Stallin-Sanamandra