Map Controls to Checklist Items
Say which framework controls each Definition of Ready and Definition of Done item is evidence for, so that a passport can show an auditor where every control stands.
Before you start
You need to be the studio’s owner or a reviewer. Nothing else is required: the seed checklists come mapped already, so a new studio has a filled-in controls table from its first work package.
Map an item
- Open Settings → Work Package Checklists.
- Open the item and find Controls.
- Choose a framework, then a control from its list. To use a reference of your own, choose Custom and give a short reference and, if you like, a title.
- Add more if the item is evidence for more than one. An item can name up to ten.
- Save. The change is in the studio audit.
The frameworks on offer
| Framework | What is in the list |
|---|---|
| ISO/IEC 27001:2022 | A.8.25 to A.8.32 — the secure development controls |
| SOC 2 | CC8.1 (change management), with CC3.4, CC6.8 and CC7.1 |
| NIST SSDF v1.1 | Practices from the PS, PW and RV groups |
| SLSA v1.0 | Build levels 1 to 3 |
| Custom | Your own reference and title |
For a named framework the title shown is the catalogue’s own wording, not text you type, so two studios citing A.8.29 cite the same thing.
Where the mapping takes effect
How a control’s status is worked out
Each item that cites a control gives one outcome, and the control takes the worst of them. You do not set a status; it is derived from the record.
| The passport shows | When |
|---|---|
| Not satisfied | An item citing it is not met, or its exception has expired or been voided |
| Unknown | An item is still pending, was decided on an earlier version of the work package, or reads as met with no decision in the ledger behind it |
| Waived | An item citing it stands on an exception that is in force |
| Satisfied | Every item citing it is met, with evidence in the ledger for this version |
| Not needed | Every item citing it was found not needed for this change |
A release’s controls are its work packages’, each at the worst status any package gives it.
A control that no item names
The passport cannot say anything about it, and says so under What this passport does not know. That is not a failure — a lone developer with nothing mapped is not held by a pipeline for it — but it is the first thing an auditor will ask about.