Lion Cipher Lab
Trace requirements to controls to evidence and find the gaps
- GRC / Compliance
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Every compliance programme rests on a chain. A requirement (from a law, a standard or a contract) is met by a control (something the organization does), and the control is proved by evidence (a record that it was done). Auditors walk that chain. ISO/IEC 27001's Statement of Applicability links Annex A controls to the decision to apply them, NIST SP 800-53 assessments test whether each control is implemented and operating, and NIST CSF 2.0 expects requirements to be understood and managed. In practice the chain breaks quietly in both directions. Requirements get added and no control is…
What you'll learn
- the traceability chain: requirement, control, evidence
- checking traceability in both directions
- unmet requirements and orphan controls
- evidence freshness
- dangling references after a framework or register change
- what 'traced' does and does not prove
- using a traceability check before an audit
Steps in this lab
- The chain, and the four ways it breaks
- The three registers
- Write the traceability check
- Run it and read the breaks
- What 'traced' does not prove