---
name: control-mapping
location: .haiku/intents/{intent-slug}/stages/scope/artifacts/
scope: intent
format: text
required: true
---

# Control Mapping

Framework requirements mapped to specific systems, owners, and scope boundaries.

## Expected Artifacts

- **Control inventory** -- all applicable controls from the target framework with applicability justification
- **System inventory** -- in-scope services, data stores, and integrations with data classification
- **Scope boundary document** -- explicit inclusion/exclusion rationale for each system and control
- **Regulatory obligations** -- applicable regulations identified and prioritized

## Quality Signals

- Every control has an applicability determination with rationale
- System inventory includes data classification for each asset
- Exclusions have documented justification, not just omission
- Scope boundaries are clear enough for an external auditor to follow
