---
title: "Turn every policy line into a checked · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/controls-and-evidence/control-register
updated: 2026-10-20
licence: "All rights reserved"
---

# Turn every policy line into a checked control

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Controls and evidence](https://agentwranglers.se/playbook/compliance/controls-and-evidence)
- Rule: Keep a register of controls in the repository. Each control has an ID, one testable statement, an owner, a frequency and the command that checks it.
- How: Split each policy into statements that can pass or fail, such as "every person signs in with two factors". Map each control to the frameworks your customers ask for. SOC 2 uses the AICPA Trust Services Criteria, such as CC6.1 for logical access. ISO/IEC 27001:2022 has 93 controls in Annex A, such as A.8.13 for backups. One control often meets several framework lines, so map many to one. Prefer an automated check. A manual control gets a due date in the [compliance calendar](https://agentwranglers.se/playbook/compliance/scope-and-ownership/compliance-calendar) and a named evidence file.
- Check: A script fails when a control lacks an owner, a frequency or a framework mapping. It also fails without a check command or a dated manual evidence task.

Example:

```yaml
- id: CTL-MFA-01
  statement: Every account in the identity provider has two-factor sign-in turned on.
  owner: maria.lind
  frequency: daily
  check: scripts/controls/mfa-enforced
  maps_to: { soc2: [CC6.1], iso27001_2022: [A.5.17, A.8.5] }
- id: CTL-BACKUP-02
  statement: A backup restore test succeeded in the last 30 days.
  owner: jonas.berg
  frequency: monthly
  check: scripts/controls/restore-test-recent
  maps_to: { soc2: [A1.2, A1.3], iso27001_2022: [A.8.13] }
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/controls-and-evidence/control-register`.

- Next: [Collect evidence automatically](https://agentwranglers.se/playbook/compliance/controls-and-evidence/automated-evidence)
- [Controls and evidence](https://agentwranglers.se/playbook/compliance/controls-and-evidence)