Control Framework

Control Framework

Select a unified control framework for "$ARGUMENTS" that maximizes regulatory coverage by mapping shared controls across multiple regulations, reducing duplication of compliance effort.

Prerequisites

None — this is a Phase 0 (Scope) skill.

Process

1. Read context files:

   • Read plugins/compliance/shared/grc-lifecycle-guide.md for GRC methodology reference
   • Read plugins/compliance/shared/control-mapping-template.md for output structure
   • Read .metapowers/compliance/$ARGUMENTS/00-scope.md for applicable regulations and priorities

2. Framework evaluation:

   • Evaluate candidate frameworks: ISO 27001 Annex A, NIST CSF 2.0, CIS Controls v8, NIST 800-53, SOC 2 TSC
   • Score each framework on: customer recognition, regulatory coverage breadth, implementation maturity, tooling ecosystem
   • Consider customer requirements — which frameworks do customers explicitly request?

3. Primary framework selection:

   • Select the primary framework based on highest regulatory overlap and customer demand
   • Document selection rationale with specific evidence
   • Identify supplementary frameworks needed for coverage gaps

4. Control-to-regulation mapping:

   • Map each control in the selected framework to applicable regulations
   • Identify controls that satisfy multiple regulations simultaneously (compliance leverage points)
   • Highlight controls unique to a single regulation (regulation-specific requirements)
   • Flag gaps — regulations with requirements not covered by the selected framework

5. Coverage analysis:

   • Calculate coverage percentage per regulation
   • Identify the minimum control set that covers the maximum number of regulations
   • Document gap-filling controls needed from supplementary frameworks

6. Write the artifact to .metapowers/compliance/$ARGUMENTS/00-scope.md (append to existing) with sections:

   • Framework Evaluation — comparison table of candidate frameworks
   • Selected Framework — chosen framework with rationale
   • Control-to-Regulation Map — full mapping following the control mapping template
   • Leverage Points — controls satisfying 3+ regulations
   • Coverage Gaps — requirements needing supplementary controls

Output

The control framework analysis appended to .metapowers/compliance/$ARGUMENTS/00-scope.md. Present a summary to the user highlighting:

• Selected primary framework and why
• Number of controls that cover multiple regulations
• Coverage gaps requiring supplementary controls
• Recommended next step: run /compliance:compliance-roadmap $ARGUMENTS