{"description":"Runs on the existing requirement item. Interpret a requirement, determine supported applicability, map obligations to controls and evidence, and approve the mapping record. Deliver the reviewed result and open actions to the responsible register owner and the named companion procedure.","edges":[{"id":"e-requirement-applicability-requirement-mapping-closure","source":"requirement-applicability","target":"requirement-mapping-closure"}],"isPublic":true,"itemTypeSlug":"requirement","metadata":{"capabilities":["requirement-applicability-control-mapping"],"controlVerbs":{"UC-GOV-03":"operates"},"controls":["UC-GOV-03"],"department":"compliance-legal","domains":["reg"],"kind":"requirement-applicability-control-mapping","library":{"aliases":[{"source":"studio-seed","sourceTemplateId":"coworkcanvas:template:requirement-applicability-control-mapping"}],"canonicalUrl":"https://workflow-library.com/all/?w=reg-requirement-applicability-mapping","contentDigest":"sha256:c6a77fafa7954fc1ced64cfa665002a87a264cdd3a24bdbbee9800443523ec9a","prerequisites":{"anchorItemType":{"slug":"requirement"},"evidenceDestinations":[{"description":"Restricted native step results, attached documents, durable item fields and native approvals.","id":"review-evidence"}],"handoffs":[{"direction":"output","name":"Reviewed register result and open actions","sourceTemplateId":"workflow-library:reg-impact-analysis-obligation-mapping"}],"roles":[{"contribution":"expertise","description":"Legal or regulatory specialist. Determine applicability and scope.","id":"reviewer-1","nodeIds":["requirement-applicability"]},{"contribution":"approval","description":"Compliance owner. Approve requirement mapping record.","id":"reviewer-2","nodeIds":["requirement-mapping-closure"]}],"status":"declared"},"provenance":[{"source":"brain/scripts/studio-seed","sourceTemplateId":"coworkcanvas:template:requirement-applicability-control-mapping"}],"releaseId":"sha256:c6a77fafa7954fc1ced64cfa665002a87a264cdd3a24bdbbee9800443523ec9a","schemaVersion":1,"sourceTemplateId":"workflow-library:reg-requirement-applicability-mapping"},"lineOfDefense":"monitor","mappingStatus":"mapped","risks":[],"slug":"reg-requirement-applicability-mapping","source":"coworkcanvas-gallery","standards":[],"teams":["compliance-legal"]},"name":"Requirement Applicability & Control Mapping","nodes":[{"data":{"instructions":"**Objective**\nDetermine applicability and scope. The reviewer decides from the complete package described below.\n\n**Inputs**\n1. Review the Requirement item, authoritative law, regulation, standard, contract, policy, guidance, amendments, definitions, legal or compliance interpretation, organizational profile, and prior mapping.\n2. Use the interpreted obligation, corporate and legal-entity profile, products and services, customer and contract terms, data inventory, locations, thresholds, licenses, process and system maps, and specialist advice.\n\n**Procedure**\n1. Verify the authoritative citation and effective text, parse mandatory and conditional clauses, identify actors and triggering conditions, distinguish guidance from obligation, surface ambiguity, and obtain specialist interpretation where needed.\n2. Test each triggering condition against supported organizational facts, evaluate exemptions and thresholds, identify partial or phased scope, distinguish current from prospective applicability, challenge unsupported exclusions, and define reassessment triggers.\n\n**Record in AssureSwarm**\n1. Capture the authority reference, effective date, exact clause location, interpreted obligation, defined terms, triggering conditions, exceptions, dependencies, interpretation owner, assumptions, and unresolved ambiguity.\n2. Document the applicability decision and rationale, in-scope and excluded entities or activities, triggering facts, thresholds, exemptions, effective period, cited evidence, assumptions, owner, and reassessment triggers.\n\n**Exit criteria**\nLegal or regulatory specialist provides expertise: The obligation is traceable to authoritative text, assumptions and ambiguity are explicit, and the interpretation is specific enough for an applicability decision. The applicability decision is reproducible from authoritative criteria and organizational evidence, while exclusions, partial scope, and unresolved questions remain explicit.","kind":"task","label":"Determine applicability and scope","requiredApprovals":1},"id":"requirement-applicability"},{"data":{"controls":["UC-GOV-03"],"instructions":"**Objective**\nApprove requirement mapping record. The reviewer decides from the complete package described below.\n\n**Inputs**\n1. Use the applicability record, clause decomposition, control library, policy and process records, system responsibilities, test results, monitoring, prior assessments, exceptions, issues, and evidence-retention requirements.\n2. Review every stage result, authoritative references, organizational evidence, specialist interpretations, mappings, control and test support, linked issues, exceptions, and open ambiguity.\n\n**Procedure**\n1. Decompose obligations into testable elements, map preventive and detective coverage, verify control ownership and frequency, inspect current evidence, identify overlaps and gaps, distinguish design from operating support, and create linked action records.\n2. Trace applicability and coverage decisions to sources, verify every applicable element is mapped or identified as a gap, reconcile linked records and owners, retain contrary evidence, and return unsupported conclusions for correction.\n\n**Record in AssureSwarm**\n1. Record mapping status and rationale by obligation element, linked controls and owners, policies and processes, evidence and testing references, coverage limitations, gaps, compensating measures, linked issues, and due dates.\n2. Capture the authorized reviewer, review summary, authority and effective date, applicability result, mapping status, linked controls and issues, limitations, reassessment trigger, owners, due dates, and evidence references. Also record requirement mapping summary.\n\n**Exit criteria**\nCompliance owner provides approval: An approver accepts that mappings are specific and evidence-based, applicable elements are accounted for, and design or operating gaps remain visible for action. The authorized reviewer accepts the requirement mapping as a traceable analysis record, downstream records can be maintained consistently, and closure does not establish compliance or assurance.","kind":"task","label":"Approve requirement mapping record","requiredApprovals":1},"id":"requirement-mapping-closure"}],"sourceTemplateId":"workflow-library:reg-requirement-applicability-mapping"}