---
model: opus
name: control-mapping
location: .haiku/intents/{intent-slug}/knowledge/CONTROL-MAPPING.md
scope: intent
format: text
required: true
---

# Control Mapping

Map regulatory framework controls to organizational systems, services, and processes. This output drives the assess stage's evaluation work.

## Content Guide

Structure the mapping around the target framework:

- **Framework identification** — which framework(s) and version(s) are in scope
- **Applicable controls** — each control with its requirement description and applicability rationale
- **Excluded controls** — controls deemed not applicable with documented justification
- **System inventory** — all in-scope systems, services, data stores, and integrations
- **Control-to-system mapping** — which systems are relevant to each control
- **Data classification** — sensitivity level and type of data handled by each system
- **Scope boundaries** — explicit in-scope/out-of-scope delineation with rationale

## Quality Signals

- Every control has an applicability determination with rationale
- Exclusions are justified, not just omitted
- System inventory includes third-party services and integrations
- Data classifications are consistent and follow a defined scheme
