Capability / ControlLedger
Controls & evidence
Connect the control objective to practice and a retrievable record.
What would show that the practice operated?
Clarify what a control is intended to achieve and how it operates in the relevant environment. Design the record alongside the activity so that a later reviewer can understand its timing, coverage and limits without reconstructing the whole process.
The record we want to leave
A decision someone else can follow.
A control record linked to dated evidence and a documented review question.
We keep the boundary, assumptions and unresolved questions visible. An output is useful when it helps the next person make or review a decision.
Before the work begins
Does this depend on a certification project?
No. The example service model supports broader information security governance and assurance. If certification is an objective, it must be addressed within a separately agreed scope.
What information would be needed first?
A description of the services and information involved, the decision to be made, relevant responsibilities and any known constraints. Avoid including sensitive evidence in an initial brief.
A focused starting point
What needs to become clearer?
Capture the review question, the systems involved and the decision you need to make.
A browser-local example. Nothing is submitted.