Control map

Keeps one table, compliance/control-map.csv, that links each requirement number of each framework in scope to the team's own control, its owner, the evidence and the gap. One control can serve many rows. The table holds numbers and the team's own words only.

Licence boundary

Standards are licensed texts. Under the terms of the standards publishers, processing their text with AI tools needs a separate licence (for example DIN Media AGB 5.4).

• Write numbers only: ISO/IEC 27001:2022 Annex A control numbers (A.5.1 to A.8.34), VDA ISA question numbers, article numbers.
• The title column is for the client, filled by hand from their licensed copy. Never fill it, quote it, summarise it or use it as input.
• Never write a title, requirement text or paraphrase of ISO 27001, VDA ISA or any other standard into any file, commit message or chat reply.
• If the user pastes standards text, do not process it. Ask for the number and the team's own one-line description of what their control does.
• EU legal acts are public. Cite article numbers and link EUR-Lex; do not paste article text. NIS2: Directive (EU) 2022/2555, https://eur-lex.europa.eu/eli/dir/2022/2555/oj. GDPR: Regulation (EU) 2016/679, https://eur-lex.europa.eu/eli/reg/2016/679/oj. Check before use: the links resolve to the current consolidated versions.

Inputs

• Frameworks in scope: ISO/IEC 27001:2022, TISAX (with the VDA ISA catalogue version and the assessment objectives the team holds), NIS2 (and whether the company is an essential or important entity, which the user confirms), GDPR.
• The team's controls: what exists today, in the team's own words. Sources in the repository: gate/gate.json and its rules, .github/workflows/, CODEOWNERS, branch protection, docs/ (policies, runbooks, decision records), observability/ (logging, alerting), backup and restore jobs, access reviews, incident records.
• Owners: a person or team per control.