CONTEXT(CLONE)
Sign in

Security control evidence mapped before an audit

For: Security compliance manager preparing for a certification or customer audit

Pattern: Hierarchical decompositionNeeds live modelsDesigned for 8 to 200 agents
Get early accessSign in to use

The pain today

The framework has a long list of controls, each with sub-requirements. Evidence lives in policies, procedures and exports. Mapping one to the other is done by hand, and the gaps appear in front of the auditor.

The ask

“I attached the control framework we are audited against and our policies, procedures and evidence exports. For every control, show me which documents satisfy which part, quote the passage, and list the parts where we have nothing or where two documents contradict each other.”

Plain words, as you would say it to a colleague. Edit it to fit your case before you send it.

What you attach or connect

  • Control framework text
  • Policies and procedures
  • Evidence exports as text: tickets, settings, review records
  • Previous audit findings

The unit of work

One worker task per one sub-requirement of one control.

Why a swarm fits

A framework is already a tree: domain, control, sub-requirement. Each leaf needs only its own wording and a few candidate passages, and each control is checked before it rolls up.

Not for

Answering one customer's question about one control: search the policy and reply.

The decision tree

6 typed decisions, each with an action for every answer

At fixed moments in a run, the engine puts one narrow question to a decision model. The decision model never writes text: it answers yes or no with a probability, picks from listed options, or gives a score, about a small slice of the material. The engine then does exactly what this tree says, which is what makes the run auditable. The thresholds are the template's design values, not measured results.

  1. Planner, while planning

    Split or keep serialYes or no, with a probability

    While planning

    Does this control's wording contain several separately testable obligations, such as a defined frequency, a named owner and a retained record?

    Sees only: The text of one control

    Why: Splitting only compound controls keeps each leaf small without multiplying trivial tasks.

    • Yes: 0.60 or higherthenSplit the work
    • Unsure: 0.30 up to 0.60thenKeep serial
    • No: below 0.30thenKeep serial

  2. Scope checkYes or no, with a probability

    Before work starts on a unit

    Does this candidate passage address the subject of the sub-requirement at all, so that it is worth a worker's reading?

    Sees only: One sub-requirement and one candidate passage heading and opening

    Why: Shortlisting keeps each worker's context to a few passages instead of the policy library.

    • Yes: 0.55 or higherthenAccept
    • Unsure: 0.20 up to 0.55thenAccept
    • No: below 0.20thenSkip this unit

  3. After workers, the judge checks

    Evidence checkA choice among options

    After a worker answers

    Does the quoted passage meet the sub-requirement's wording, and does it show the control operating?

    Sees only: The sub-requirement, the quoted passage and the document's version line

    Why: Auditors reject topic matches; policy without operating evidence is marked design-only.

    • States the obligation and shows it operatingthenAccept
    • States the obligation onlythenMark unresolved
    • Same topic but not the obligationthenReject and retry
    • Document version or date missingthenMark unresolved

  4. Reconciler, while merging

    Conflict checkYes or no, with a probability

    While reconciling

    Do these two documents state different values for the same obligation, such as different review frequencies or retention periods?

    Sees only: Two quoted passages mapped to the same sub-requirement

    Why: A contradiction found before the audit is a fix; found during it, a finding.

    • Yes: 0.70 or higherthenMark unresolved
    • Unsure: 0.40 up to 0.70thenMark unresolved
    • No: below 0.40thenAccept

  5. Run control, between rounds

    Another round?Yes or no, with a probability

    Between rounds

    Is every sub-requirement of this control either mapped to verified evidence or listed as a gap?

    Sees only: The control's sub-requirement status table

    Why: A control rolls up only when nothing beneath it is still pending.

    • Yes: 0.85 or higherthenStop
    • Unsure: 0.50 up to 0.85thenContinue
    • No: below 0.50thenContinue

  6. Accountable person, before anything is settled

    Person decidesYes or no, with a probability

    Before anything is reported as settled

    Would this control be reported as met in a statement that an auditor or customer will rely on?

    Sees only: One control's rolled-up status with its evidence list

    Why: The compliance manager signs what is met; the swarm never attests for the company.

    Accountable: The compliance manager signs the statement of what is met; the swarm never attests on the company's behalf.

    • Yes: 0.30 or higherthenAsk a person
    • Unsure: 0.10 up to 0.30thenAsk a person
    • No: below 0.10thenAccept

The fleet: who does what

Model tiers by role, not brands: you choose the models. Strong reasoning models plan and reconcile, small fast models do the wide work, and the judge is a decision model from a different family, so it does not share the workers' blind spots.

  1. Planner

    A strong reasoning model breaks each control into testable sub-requirements and shortlists candidate documents.

    Decisions here:1. Split or keep serial2. Scope check

  2. Workers

    Small fast workers from an open-weight family each test one sub-requirement against its candidate passages.

    Designed for 8 to 200 agents, one worker task per one sub-requirement of one control. Each worker receives only its own unit.

  3. Judge, from a different model family

    A decision model from a different family checks the quoted passage meets the wording, not just the topic.

    Decisions here:3. Evidence check

  4. Reconciler

    A strong reasoning model rolls leaves into control status and keeps partial and contradicted controls distinct.

    Decisions here:4. Conflict check5. Another round?

  5. Accountable person

    The compliance manager signs the statement of what is met; the swarm never attests on the company's behalf.

    Decisions here:6. Person decides

Checked before anything is accepted

  • 'Met' requires a quoted passage and the document version
  • Policy statements without operating evidence are marked design-only
  • Contradictions between documents are listed with both quotes
  • A control rolls up only when every leaf is resolved or listed as a gap

What comes back

  • Control-by-control map with quoted evidence
  • Gaps and design-only controls
  • Contradicting documents
  • Evidence request list for control owners

What to measure

  • Gaps found before the audit against gaps found by the auditor
  • Mappings the auditor rejects
  • Preparation hours per control
  • Cost per sub-requirement checked

Names of measures only. No result is claimed for this template.

Templates open in the workspace chat with the ask filled in. Nothing runs until you send it.

Get early accessSign in to use

More in Security and IT operations

A night of alerts triaged into incidents with evidence

For: Security operations lead or on-call analyst starting the morning shift

Overnight the queue fills with alerts, most of them duplicates or noise.

Pattern: Map, verify, reduceNeeds a connector6 decisionsDesigned for 30 to 1,000 agents

Root-cause hypotheses tested against log windows

For: Site reliability engineer or incident commander writing the review after an outage

After an outage the first plausible story wins.

Pattern: Cross-examinationNeeds scale6 decisionsDesigned for 20 to 500 agents

Threat model attacked before the design is built

For: Security architect or product security engineer reviewing a new system design

Threat models are written by the people who designed the system, so they list the threats the design already handles.

Pattern: Adversarial reviewNeeds live models5 decisionsDesigned for 6 to 60 agents