Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →grcengclub/program-portfolio-composition
Patterns for synthesizing findings across multiple frameworks into one readable portfolio view.
Passed 22 of 22 test cases with the skill, and 7 of 22 without it.
and 15 more in the full report
15 fixed7 passed either way0 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 15 test cases the skill fixed. Same model, same prompt, with and without the skill.
What are the exact five header titles required for the summary coverage dashboard table in our executive deck?
| Checked | Without skill | With skill |
|---|---|---|
| Uses Framework, Coverage, 30-day delta, Top gap, and Owner as the five table headers. | Missed | Passed |
The instructions your model reads when the skill loads.
Most GRC programs run 3 to 8 frameworks. Presenting each one in full is how leadership reports get ignored. The job is to show the portfolio, not every control.
Most "different" controls across frameworks map back to the same SCF control. SCF IAC-01 shows up as SOC 2 CC6.1, NIST AC-2, ISO A.9.2, CMMC AC.L2-3.1.1, and more. When you report the portfolio, collapse down to SCF first, then expand back to frameworks for the appendix.
A 15-framework program is usually a 400 SCF control program. That's the denominator that matters.
1. Coverage table (one row per framework)
| Framework | Coverage | 30-day delta | Top gap | Owner |
|---|---|---|---|---|
| SOC 2 | 82% | +3 pp | Access reviews | IAM |
Five columns. Never more. If you need more, split into a second table with a clear break (e.g., "priority frameworks" vs "monitored frameworks").
2. Leverage list (cross-framework patterns)
Controls that fail in 3+ frameworks. Fix one, close many. This is the board-friendly version of "we are investing in the right things."
Example: "SCF IAC-15 (account-recertification) fails in SOC 2, FedRAMP, and ISO 27001. One automation project closes all three. Scoped for Q2."
3. Watch list (at-risk items)
Controls or frameworks trending down. Specifically name what could slip, why, and what prevents it.
test cases passed, vs 7 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.