Hands-On Exercises

1. Sign in to your Kindo instance
2. Navigate to the Agents tab
3. Click Create an Agent
4. Select Workflow Agent
5. Configure the agent:
   • Name: Pathfinder — NIST CSF Compliance Mapper
   • Description: Reviews evidence and supporting documents, maps them to NIST CSF controls, and evaluates compliance status. Produces a structured compliance report.

This agent needs two types of reference material:

1. NIST CSF Framework Reference
   • Upload a NIST CSF control catalog (the facilitator will provide this)
   • This gives the agent the full list of controls to map against
2. Evidence Documents
   • Upload the sample policies, standards, and/or configuration screenshots
   • In production, these would be the actual audit evidence collected by the compliance team

1. Click + to add a step → Select LLM Step
2. Name the step: Map Evidence to NIST CSF Controls
3. Enter the following prompt:

You are a cybersecurity compliance analyst performing a NIST CSF mapping exercise.

TASK:
Review each evidence document provided in the knowledge store. For each document, identify which NIST CSF controls it supports or addresses.

MAPPING GUIDELINES:
- A single document may map to multiple NIST CSF controls
- A single control may be supported by multiple documents
- Only map a document to a control if there is a clear, defensible connection
- If a document partially addresses a control, note it as partial coverage
- Do not force mappings — if a document doesn't clearly relate to any control, note it as "Unmapped"

OUTPUT FORMAT:
Produce a mapping table with these columns:
| Document Name | NIST CSF Control ID | Control Name | Function (GV/ID/PR/DE/RS/RC) | Mapping Rationale | Coverage Level |

COVERAGE LEVELS:
- FULL — The document directly and completely addresses the control requirements
- PARTIAL — The document addresses some but not all aspects of the control
- REFERENCE — The document provides supporting context but is not primary evidence
- NONE — Included for completeness; no meaningful mapping found

After the mapping table, provide:
1. A coverage summary: how many controls have FULL, PARTIAL, REFERENCE, or no coverage
2. A list of NIST CSF controls with NO evidence mapped to them (gaps)
3. Documents that couldn't be mapped to any control (orphan evidence)

1. Click + to add another step → Select LLM Step
2. Name the step: Evaluate Compliance Status
3. Enter the following prompt:

You are a senior compliance assessor evaluating NIST CSF compliance based on the evidence mapping from the previous step.

TASK:
For each NIST CSF control that has at least one mapped evidence document, evaluate the overall compliance status.

ASSESSMENT CRITERIA:
- COMPLIANT — Sufficient evidence demonstrates the control is fully implemented and operating effectively
- PARTIALLY COMPLIANT — Evidence shows the control is implemented but with gaps (e.g., policy exists but enforcement is incomplete, or coverage is limited to some systems)
- NON-COMPLIANT — Evidence shows the control is not implemented, or implementation is fundamentally inadequate
- INSUFFICIENT EVIDENCE — The mapped documents don't provide enough information to make a determination. This is NOT the same as non-compliant — it means we need more evidence.

OUTPUT FORMAT:

SECTION 1 — COMPLIANCE SCORECARD
| NIST CSF Function | Total Controls | Compliant | Partially Compliant | Non-Compliant | Insufficient Evidence | Not Assessed |
(One row per function: GV, ID, PR, DE, RS, RC)

SECTION 2 — DETAILED ASSESSMENT
For each assessed control:
| Control ID | Control Name | Status | Evidence Documents | Key Findings | Recommendations |

SECTION 3 — PRIORITY REMEDIATION
List the top 10 controls to prioritize for remediation, considering:
- Non-compliant controls in high-risk functions (Protect, Detect, Respond)
- Controls with partial compliance that could be quickly brought to full compliance
- Controls flagged as insufficient evidence (quick evidence collection wins)

SECTION 4 — GAPS ANALYSIS
- Controls with no evidence (from the mapping step)
- Functions with the lowest compliance rates
- Recommended evidence collection strategy for gap areas

Keep the tone objective and evidence-based. Every compliance determination must reference specific evidence.

1. Click Generate / Run to execute the agent
2. Review the output:
   • Does the evidence-to-control mapping make sense?
   • Are the compliance assessments defensible?
   • Are the gaps identified accurately?
3. Iterate:
   • Upload additional evidence documents and re-run
   • Change the framework (could this same pattern work for ISO 27001? SOC 2?)
   • Ask for a specific output format (XLSX-compatible table, executive summary)