build-a-controls-evidence-map

Connect control claims to owners, systems, tests, and current evidence. Use when assurance, audits, customer reviews, governance, or risk decisions require proof that controls are designed and operating.

Jump to install

Repository: protosphinx/sphinxstack
Last source activity: July 29, 2026 at 13:55
Detected SKILL.md language: English
Stars: 1
Forks: 0

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/protosphinx/sphinxstack --skill build-a-controls-evidence-map

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

2 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

build-a-controls-evidence-map

Make control claims testable. Policy text can support intent, but operating effectiveness needs evidence from the systems and people performing the control.

Procedure

Define framework, scope, period, entities, environments, assertion owner, and intended audience.

Normalize overlapping requirements into control objectives without losing source traceability.

For each objective, document risk, control activity, frequency, population, performer, reviewer, and enforcement point.

Distinguish manual, automated, inherited, complementary, detective, preventive, and compensating controls.

Attach evidence sources with period, collection method, owner, retention, sensitivity, and integrity checks.

Define design and operating tests, including sample logic and exception handling.

Reconcile claimed populations to authoritative inventories before selecting samples.

Mark evidence as current, stale, incomplete, contradictory, planned, or unavailable.

Track gaps to remediation or time-bounded risk acceptance; never backdate missing performance.

Refresh the map after scope, system, owner, control, or requirement changes.

Guardrails

Do not claim compliance merely because every requirement has a row.

Protect credentials, personal data, security findings, and vendor confidential material.

Screenshots need source, date, scope, and corroboration where state can change.

Separate evidence collection from independent evaluation when assurance rules require it.

Done

Requirements retain source-to-control traceability

Control populations, owners, tests, and evidence are explicit

Stale, missing, and conflicting proof remains visible

Remediation and risk acceptance are auditable

name	build-a-controls-evidence-map
category	data
description	Connect control claims to owners, systems, tests, and current evidence. Use when assurance, audits, customer reviews, governance, or risk decisions require proof that controls are designed and operating.