Document controls
Describe how a risk is addressed and how the measure will be checked.
Controls record the measures used to address the system’s risks. Give each measure enough detail for another person to understand what happens in practice.
Add the measure
Open Controls and describe the measure, the responsibility for carrying it out, and the risk it addresses. Examples include human oversight, logging, operational restrictions, and review procedures; choose what is appropriate to your use.
Use the control types that apply. A typed human-oversight or logging control can meet a matching checklist expectation and appears under Met by.
Define the evidence needed
State how you will check the measure. A process document may establish how review is meant to work; a recorded observation or test result may establish whether it worked in the examined case.
Add the necessary requirement in Testing & Evidence. Review documents and outside proof substantively rather than relying on a comment or citation alone.