Lion Cipher Lab
Assess the impact of a new version of a security requirements document
- GRC / Compliance
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Requirements are never finished. Standards publish new versions, regulators amend rules, and customers send an updated supplier security schedule with their contract renewal, often with a request to confirm compliance within weeks. ISO 37301 treats identifying changes to compliance obligations as part of running a compliance management system, and NIST CSF 2.0 expects legal, regulatory and contractual requirements to be understood and managed (GV.OC-03). In practice the first step is a comparison: what changed between versions, which controls does each change touch, and what is entirely new?…
What you'll learn
- requirement change management as a compliance process
- diffing two versions of a requirement set
- why matching by ID alone misleads when requirements are renumbered
- text-similarity matching with difflib
- routing each change to the controls it affects
- spotting new obligations that need a new control
- reviewing automated matches
Steps in this lab
- What a version change asks of you
- Two versions and a mapping
- Write the comparison
- Run it both ways
- Review the matches, then act