Control mappings
Governance → Policy Management → (a document) → Mappings
A mapping says: this document governs that control. It is the single most load-bearing relationship in the module, because almost everything else is computed from it — coverage, the brief handed to the AI author, and the answer to "show me the policy behind this control" when an assessor asks.
Two kinds of control
| Mapping | Points at | Comes from |
|---|---|---|
| Framework control | A control in a framework catalogue | ISO 27001, SAMA CSF, NCA ECC, NIST CSF… |
| Risk control | A control in your own risk module | Your control library |
They are kept separate rather than merged into one generic link, so each one holds proper referential integrity: a mapping can never point at a control that does not exist, and deleting a control takes its mappings with it.
Framework catalogues are shared across the platform; risk controls belong to your organisation. Either way, a document can only be mapped by someone in your organisation, to a document in your organisation.
Mapping strength
Every mapping carries one of three strengths. Set it honestly — it is what separates a real coverage figure from a flattering one:
| Strength | Means |
|---|---|
| primary | This document is the main governing source for the control |
| secondary | It contributes, but is not where the requirement primarily lives |
| informative | Loosely related; useful context, not governance |
The scaffold generator uses this distinction deliberately: the framework-wide governing policy is mapped secondary across everything, and each procedure is mapped primary to its own sub-domain's controls — because the procedure is the operational document of record for those controls, and the policy is the umbrella.
Optional notes on a mapping record why the link was made. Worth using when the connection is not obvious from the two titles.
Adding a mapping
The Mappings tab lists the document's current mappings grouped by framework, showing each control's ref-id, name and strength.
Mappings are created one of two ways:
- Directly, by an analyst or above.
- By accepting an AI suggestion — the agent proposes, a manager accepts, and acceptance is what writes the mapping.
A document can be mapped to a given control only once. Adding the same mapping twice is refused as a duplicate rather than creating a second row.
Suggesting mappings with AI
Pick a framework and click Suggest mappings. The agent is given the document's class, title, description and category, and the framework's full list of assessable controls, and asked which controls the document governs — meaning the document sets the expectation that the control checks for.
The agent is instructed towards precision over recall: it is told not to force weak matches, and to use only control ref-ids from the list it was given. Each suggestion comes back as its own proposal with a strength, a one-sentence rationale and a confidence score, so you accept and reject them individually rather than taking a batch on trust.
Suggestions that name a control that does not exist, or one the document is already mapped to, are dropped before they reach you. Runs are capped at 30 suggestions.
Nothing is written by the agent. Acceptance is what creates the mapping — see AI proposals.
Removing a mapping
Mappings can be deleted by an analyst or above. Removing one is not a small act: it changes the coverage figure and takes the control out of the brief the AI author works from. If the document genuinely does not govern the control, remove it; if it governs it weakly, change the strength instead.