Reads a requirement, regulation, or policy and the organisation's control descriptions, then produces a DRAFT controls-and-gap pack — the requirement broken into obligations, mapped controls, apparent coverage, gaps, and actions to assess. Never concludes compliance or that a control is effective; c
Reads a requirement, regulation, or policy and the organisation's control descriptions, then produces a DRAFT controls-and-gap pack — the requirement broken into obligations, mapped controls, apparent coverage, gaps, and actions to assess. Never concludes compliance or that a control is effective; control owners and audit assess. Use when the user asks to map a requirement to controls or run a con