Controls & Assurance

The Controls & Assurance domain maintains internal safeguards, establishes many-to-many crosswalk mappings to regulatory obligations, and collects verified evidence.

---

Key Modules

1. Control Register (/controls)

The authoritative catalog of internal controls. Tracks control title, domain, owner, implementation mechanism, and operational status.

2. Control Crosswalk (/crosswalk)

Maps internal controls to regulatory requirements. Supports semantic relationship typing (Equivalent, Subset, Superset, Intersection, Compensating), confidence ratings, and review rationales.

3. Evidence Fabric (/evidence, /evidence/fabric)

Central evidence asset repository. Upload, verify, and link evidence artifacts to controls and obligations while tracking validity periods and freshness.

4. Continuous Assurance (/assurance)

Automated monitoring of control health, evidence freshness, and periodic review cadences.