Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

GRC framework crosswalk diagram · grcengclub | DecimalAI

grcengclub/grc-framework-crosswalk-diagram

SkillScore53Maintained

Use when creating a draw.io diagram for mapping controls and obligations across frameworks to show overlap, gaps, and conflicts in a GRC, security, audit, compliance, privacy, cloud, or risk context.

legalby grcengclub

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/grcengclub-grc-framework-crosswalk-diagram/SKILL.md

decimalai skills pull grcengclub-grc-framework-crosswalk-diagram --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/grcengclub-grc-framework-crosswalk-diagram/SKILL.md https://app.decimal.ai/s/grcengclub-grc-framework-crosswalk-diagram/SKILL.md

Raw file: /s/grcengclub-grc-framework-crosswalk-diagram/SKILL.md ↗ · machine-readable summary at /s/grcengclub-grc-framework-crosswalk-diagram.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 5d ago

Yes — +13% lift · at higher cost+68% tokens0% turns45% of whole cases pass with skill (10/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-03	✗→✓	▲ Improved	9%	0%
case-07	✗→✓	▲ Improved	172%	0%
case-08	✗→✓	▲ Improved	161%	0%
case-15	✗→✓	▲ Improved	156%	0%
case-16	✗→✓	▲ Improved	136%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

grcengclub / claude-grc-engineering

plugins/grc-diagrams/skills/grc-framework-crosswalk-diagram/SKILL.md

View on GitHub ↗

License NOASSERTIONImported 8/3/2026Version v1

Skill contents

SKILL.md

GRC framework crosswalk diagram

Use this skill to structure the GRC content and visual pattern for mapping controls and obligations across frameworks to show overlap, gaps, and conflicts. Then use the drawio skill to generate the native editable .drawio file and optional PNG/SVG/PDF export.

Common Requests

SOC 2 to ISO 27001 to NIST CSF
FedRAMP to NIST 800-53
CIS to SOC 2

Recommended Elements

Include these when relevant:

source framework
normalized control
target framework
one-to-one/one-to-many/partial/no-match
gaps
conflicts

Recommended Output Pattern

Produce a Crosswalk matrix, many-to-many map, or common-control cluster. Choose a layout that matches the audience:

Executive: compact lifecycle/capability view with business impact labels.
Auditor/assessor: explicit evidence, owner, control, cadence, and scope labels.
Practitioner/engineering: operational systems, data paths, automation, failure/exception paths, and implementation detail.

draw.io Instructions

Load and follow the drawio skill.
Generate native mxGraphModel XML directly. Do not generate Mermaid as the final artifact.
Use descriptive lowercase hyphenated filenames.
Include a legend when colors, edge styles, or containers have compliance meaning.
Validate XML well-formedness before finalizing.
If PNG/SVG/PDF is requested, export with embedded diagram XML when the draw.io CLI is available.

Visual Conventions

Blue: systems, platforms, services, and automated collectors.
Green: implemented controls, approvals, validated evidence, and compliant outcomes.
Orange/red: risks, findings, exceptions, overdue items, gaps, and failed controls.
Gray: manual tasks, external parties, optional steps, and out-of-scope areas.
Dashed containers: audit scope, trust boundaries, authorization boundary, or responsibility boundary.
Solid edges: primary process or system flow.
Dashed edges: evidence or attestation flow.
Dotted edges: optional, manual, exception, or escalation flow.

Quality Bar

Make ownership explicit.
Label regulated data, control IDs, frameworks, and evidence repositories when known.
Show decision criteria where the process branches.
Avoid generic boxes like "Compliance" without a role, system, artifact, or action.
Prefer editable source of truth over screenshots.

Want to see if grcengclub/grc-framework-crosswalk-diagram would activate on your phrasing? Try it before you install — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/24/2026, 11:34 UTC · 22 cases

Lift

+13%

53% vs 40%

Agent turns

1.0 vs 1.0

Tokens

+68%

6,731.09 vs 4,004

fail → pass · 7pass → pass · 3fail → fail · 8pass → fail · 4

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-02 I need a high-level compliance mapping chart in draw.io format comparing NIST CSF 2.0 against FedRAMP Moderate controls for an executive presentation. Please visually map how our source controls translate to the target baseline, pointing out full matches, partial alignment, and potential conflicts.	fail→fail	29,051	31,015	+7%	1	1	0%	6,198	6,746	+9%	0	0	—
case-01 Can you generate an editable draw.io visual crosswalk diagram that maps our SOC 2 Type II controls to ISO 27001:2022 requirements? We are preparing for an external audit, so the diagram should clearly highlight normalized control mappings, evidence cadences, control owners, and any unmapped gap areas between both standards.	fail→fail	28,348	30,005	+6%	1	1	0%	6,211	6,760	+9%	0	0	—
case-03 We want a technical common-control cluster diagram saved as a native draw.io file that bridges CIS Controls v8 with SOC 2 Trust Services Criteria. Our engineering team needs to see how technical system controls, automated data collectors, and manual operational tasks map across frameworks, including any policy exceptions or gaps.	fail→pass	28,614	30,391	+6%	1	1	0%	6,202	6,750	+9%	0	0	—
case-04 Generate a draw.io diagram mapping HIPAA Security Rule 45 CFR 164.312 technical safeguards to NIST SP 800-66 Rev 2. Ensure the resulting diagram file is ready to open in draw.io without XML parsing errors.	fail→fail	27,625	27,816	+1%	1	1	0%	6,197	6,745	+9%	0	0	—
case-05 Create a draw.io diagram showing the evidence flow from AWS CloudTrail log collectors to Datadog for SOC 2 CC7.2 monitoring compliance. Should evidence links use solid lines like standard data connections?	pass→pass	27,436	31,479	+15%	1	1	0%	5,544	6,731	+21%	0	0	—
case-06 Map our emergency firewall bypass process under ISO 27001 A.8.21. Should escalation and exception paths be drawn using the same solid edges as routine firewall traffic?	fail→fail	15,836	31,579	+99%	1	1	0%	2,308	6,727	+191%	0	0	—
case-07 We are defining our FedRAMP High Authorization Boundary Diagram (ABD) in draw.io. How should the boundary containers surrounding in-scope cloud services be styled compared to out-of-scope legacy databases?	fail→pass	15,157	32,225	+113%	1	1	0%	2,476	6,731	+172%	0	0	—
case-13 Write an auditor-facing narrative description for SOC 2 Type II Trust Services Criteria CC6.1 explaining our AWS KMS encryption key rotation practices.	pass→fail	16,677	30,991	+86%	1	1	0%	2,572	6,718	+161%	0	0	—
case-08 Generate a crosswalk diagram file for NIST CSF 2.0 to ISO 27001:2022. What filename convention should be assigned for saving the diagram file?	fail→pass	13,348	30,196	+126%	1	1	0%	2,580	6,728	+161%	0	0	—
case-09 Produce a draw.io crosswalk map bridging PCI DSS 4.0 Requirement 10 with SOC 2 CC6.8 for our site reliability engineering team. They need to debug pipeline failures.	fail→fail	30,237	31,481	+4%	1	1	0%	6,182	6,730	+9%	0	0	—
case-10 Create a draw.io diagram mapping CCPA data deletion requests to GDPR Article 17 requirements. We currently have a placeholder box labeled 'Compliance' in our draft.	fail→fail	26,806	32,162	+20%	1	1	0%	5,492	6,723	+22%	0	0	—
case-11 Draft a complete Information Security Policy document for ISO 27001:2022 clause 5.2, including executive tone, purpose, scope, and mandatory password complexity rules.	pass→fail	16,825	33,437	+99%	1	1	0%	2,924	6,729	+130%	0	0	—
case-12 Write a Python script using the Boto3 SDK to query AWS IAM user accounts and identify any users without MFA enabled for SOC 2 compliance reporting.	pass→fail	15,126	29,898	+98%	1	1	0%	3,036	6,719	+121%	0	0	—
case-14 Build a draw.io compliance crosswalk diagram between HITRUST CSF v11 and HIPAA Security Rule where green represents compliant controls and dashed containers mark scope.	pass→fail	28,561	31,373	+10%	1	1	0%	6,173	6,721	+9%	0	0	—
case-15 Map NIST SP 800-53 Rev 5 control AC-2 to ISO 27001:2022 A.5.18. We identified several unmapped gaps where legacy active directory groups lack automated review.	fail→pass	16,795	31,688	+89%	1	1	0%	2,636	6,741	+156%	0	0	—
case-16 Create a visual crosswalk in draw.io mapping SOC 2 CC6.1 to ISO 27001:2022 controls. Should the diagram show relationship types between controls?	fail→pass	16,006	31,014	+94%	1	1	0%	2,855	6,730	+136%	0	0	—
case-17 In our draw.io crosswalk map for CIS Control 5 to NIST CSF PR.AC, we have quarterly manual access reviews conducted by human managers.	fail→fail	15,027	31,645	+111%	1	1	0%	2,243	6,720	+200%	0	0	—
case-18 Design a draw.io mapping chart comparing FedRAMP Moderate controls against SOC 2 CC7.1 specifically structured for our third-party assessment organization (3PAO) audit team.	fail→fail	28,674	34,599	+21%	1	1	0%	6,179	6,727	+9%	0	0	—
case-19 Map our SOC 2 controls to ISO 27001 for our Chief Information Security Officer and Board of Directors presentation. Should we present deep technical automation logs?	fail→pass	21,005	31,067	+48%	1	1	0%	2,670	6,723	+152%	0	0	—
case-20 We need a draw.io visual mapping NIST CSF 2.0 to CIS Controls v8. Should we output this as a Mermaid diagram block in the final step?	fail→pass	6,727	28,775	+328%	1	1	0%	1,030	6,723	+553%	0	0	—
case-21 When bridging local company access control policies against ISO 27001:2022 and SOC 2 CC6.1, how should individual framework requirements be unified in draw.io?	pass→pass	20,390	31,272	+53%	1	1	0%	3,322	6,730	+103%	0	0	—
case-22 Map PCI DSS 4.0 password retention requirements against NIST SP 800-63B guidelines in draw.io, where PCI mandates rotation every 90 days but NIST advises against periodic rotation.	pass→pass	18,137	31,535	+74%	1	1	0%	3,058	6,732	+120%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +13 percentage points is the difference between those two pass rates over the 22 comparable cases. 6 cases got worse with the skill loaded, and they are included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 40%
Pass rate with the skill: 53.3%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 6
Skill version measured: v1
Run completed: 8/24/2026, 11:34 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-03

Prompt

We want a technical common-control cluster diagram saved as a native draw.io file that bridges CIS Controls v8 with SOC 2 Trust Services Criteria. Our engineering team needs to see how technical system controls, automated data collectors, and manual operational tasks map across frameworks, including any policy exceptions or gaps.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run53

Live evalNeeds ≥20 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+69% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 4 days ago

Other measured skills in the registry, with their headline benchmark lift.