Governance, risk, compliance and IT operations services whose deliverables feed each other.
Control Register – Compliance assessment · Thalewyn
Control Register Your control register: every control with its owner, status, expected evidence and next review.
Lists the reference controls (ISO/IEC 27001 Annex A) and your own controls with their owner, implementation status (from a selected questionnaire or assessment, or stated by you), the evidence expected and the date of their next review. The register other services read for gaps, the SoA and evidence.
Columns of the register Control Title Theme Owner Status Expected evidence Next review Source / notes
1 Reference and own controls
The reference controls, grouped by theme, plus the controls specific to your organisation.
2 Owner and status
Who is responsible for each control and where it stands today.
3 Evidence and review
What an auditor will look for, and when each control is reviewed next.
What you provide How the controls are assessed Controls not applicable — Annex A references, e.g. “8.25”, with the reason in the notes. 3 options — Only needed if you do not select a compliance questionnaire as a source. Annex A references, e.g. “5.15”, “8.5”. Controls in place, Controls partly in place, Controls not in place
Your own controls — Your controls outside the reference list, one row each, e.g. Weekly firewall rule review; Network lead; in place Review of each control Roles and owners
— Who is responsible for which area. Owners in the result are taken from here; where no role covers an area, the owner is left for you to fill.
Additional context — Anything the service should take into account. Title — As it will appear on the result. Author — Shown as the author of the deliverable; never filled in by the AI. 
