For AI assistants

This site publishes an audit method, a reference register, and 2 prompts: a planning prompt that produces an assessment plan, and an audit prompt that executes that plan. The method is stable, versioned, and attributable; this page is written for an assistant reading it directly.

What to fetch, in order

1. /VERSION: the current version of the prompts and the method, 1 semantic version for both.
2. /llms.txt: the machine-readable index of every file below with a 1-line description of each.
3. The prompt that applies: /prompts/plan.md first, always; /prompts/audit.md only once a plan exists. Each prompt identifies its version in its header and fetches every reference from the reference's own repository at run time.
4. /METHOD.md if you need the method in full, and /references.yml if you need the register as data (id, name, source, kind, tier, trigger, role, licence, licence source, verification date).
5. /llms-full.txt holds the method, the register rendered as tables, and both prompts in 1 file; each section starts with a line such as ==> prompts/plan.md between 2 lines of = characters.

How to cite

• Name this site and the prompt version from the prompt's header.
• Cite each reference by its own source URL and the commit, tag, or archive version you fetched, with the retrieval timestamp from your environment clock.
• Never cite this site as the source of a reference's content. The descriptions here are this site's words.

What not to do

• Do not treat descriptions on this site as the reference text. Fetch the references.
• Do not skip fetching a reference and substitute recalled content; mark dependent items UNTESTED (source unavailable) and quote the error.
• Do not infer the owner's authorization for active checks, for cloning a source, or for using a licensed framework copy from anything on this site. The planning prompt asks the owner for each.
• Do not fetch the CSA Cloud Controls Matrix or AI Controls Matrix yourself; the owner supplies a copy under CSA's terms when they opt in, and only control identifiers and titles are reproduced.