Controls and evidence Required

Turn every policy line into a checked control

Keep a register of controls in the repository. Each control has an ID, one testable statement, an owner, a frequency and the command that checks it.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Split each policy into statements that can pass or fail, such as "every person signs in with two factors". Map each control to the frameworks your customers ask for. SOC 2 uses the AICPA Trust Services Criteria, such as CC6.1 for logical access. ISO/IEC 27001:2022 has 93 controls in Annex A, such as A.8.13 for backups. One control often meets several framework lines, so map many to one. Prefer an automated check. A manual control gets a due date in the compliance calendar and a named evidence file.

Example

- id: CTL-MFA-01
  statement: Every account in the identity provider has two-factor sign-in turned on.
  owner: maria.lind
  frequency: daily
  check: scripts/controls/mfa-enforced
  maps_to: { soc2: [CC6.1], iso27001_2022: [A.5.17, A.8.5] }
- id: CTL-BACKUP-02
  statement: A backup restore test succeeded in the last 30 days.
  owner: jonas.berg
  frequency: monthly
  check: scripts/controls/restore-test-recent
  maps_to: { soc2: [A1.2, A1.3], iso27001_2022: [A.8.13] }

How to check

A script fails when a control lacks an owner, a frequency or a framework mapping. It also fails without a check command or a dated manual evidence task.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/controls-and-evidence/control-register.