Build · Create · Writing & Content

Build a Compliance Control and Evidence Register

The founder gets a structured control register that maps each required control to its framework, the evidence artifact that satisfies it, its present/missing status, and an owner, so the documentation and controls needed to pass a compliance review are enumerated and tracked rather than improvised.

You receive: A JSON object: { frameworks: [enum(soc2|gdpr|hipaa|iso27001|pci_dss)], controls: [{ controlId, framework, controlStatement, evidenceArtifact, status: enum(in_place|in_progress|missing), owner }], gapsCount: int, byFramework: [{ framework, total, inPlace }] }

Part of Choose Business Model

What's verified: STUD verifies the register is structurally complete and consistent: each required framework covered to the minimum control count, every control carrying evidence + owner + status, the gap count matching statuses, and per-framework rollups matching the controls. STUD does NOT certify the controls actually satisfy SOC 2 / GDPR / HIPAA, that the evidence artifacts are valid, or that the company is compliant. A real audit is a qualified-reviewer activity; STUD checks the register's completeness, not legal/regulatory sufficiency.

{
 "buyerParamKeys": [
  "requireEvidenceEach",
  "requireOwnerEach",
  "requiredFrameworks"
 ],
 "checkNames": [
  "format_parses",
  "top_level_shape",
  "frameworks_listed",
  "control_shape",
  "unique_ids",
  "framework_coverage",
  "gaps_count",
  "byframework_consistency",
  "evidence_required",
  "owner_required"
 ],
 "constants": {},
 "deliverableLabel": "compliance_control_evidence_register",
 "documentKeys": [
  "byFramework",
  "controlId",
  "controlStatement",
  "controls",
  "evidenceArtifact",
  "framework",
  "framework_set_mismatch",
  "frameworks",
  "gapsCount",
  "inPlace",
  "owner",
  "row_count",
  "status",
  "total"
 ],
 "enumLiterals": [
  [
   "in_place",
   "in_progress",
   "missing"
  ],
  [
   "soc2",
   "gdpr",
   "hipaa",
   "iso27001",
   "pci_dss"
  ],
  [
   "yes",
   "true",
   "1"
  ]
 ],
 "submission": "a JSON document (submitted as a string), validated as data; every check below must pass",
 "tier": "doc-validator"
}