Unified Checklist
| Control | Name | Status | Framework coverage | Owner | Deadline | Priority | Evidence | Tasks | Gap/delta |
|---|---|---|---|---|---|---|---|---|---|
| CTRL-IAM-001 | Privileged access management | IMPLEMENTED | Framework A (ISO-like) A.5.2 PARTIAL — delta: ISO requires annual privileged access review; PAM currently enforces continuous authz only Framework B (NIS2-like) NIS2-IAM PARTIAL — delta: NIS2 expects semi-annual review of privileged accounts Framework C (CSF-like) PR.AA-01 FULL Framework C (CSF-like) RC.RP-01 SUPPORTING — delta: Full recovery plan / BCP still required beyond IAM | admin@wayfold.local | 2026-10-07 | HIGH | 1 | 0 | ISO requires annual privileged access review; PAM currently enforces continuous authz only; NIS2 expects semi-annual review of privileged accounts; Full recovery plan / BCP still required beyond IAM |
| CTRL-IAM-002 | Access control policy baseline | IN_PROGRESS | Framework A (ISO-like) A.5.1 FULL | 2026-09-07 | MEDIUM | 0 | 1 | ||
| CTRL-IR-001 | Incident response runbook | NOT_IMPLEMENTED | Framework B (NIS2-like) NIS2-IR FULL | HIGH | 0 | 0 |
Unmapped requirements
- Framework A (ISO-like)
A.9.9— Exotic logging format - Framework B (NIS2-like)
NIS2-X9— Sector-specific reporting channel
Framework readiness
| Framework | Version | FULLY | PARTIAL | NOT | UNMAPPED | N/A | Impl readiness |
|---|---|---|---|---|---|---|---|
| Framework A (ISO-like) | 2013.1 | 0 | 2 | 0 | 1 | 0 | 0% |
| Framework B (NIS2-like) | 2026.1 | 0 | 1 | 1 | 1 | 0 | 0% |
| Framework C (CSF-like) | 2.0 | 1 | 1 | 0 | 0 | 0 | 50% |
Control impact
- Impacts 4 requirements across 3 frameworks (3 open-gap signals); status=IMPLEMENTED
- Impacts 1 requirements across 1 frameworks (1 open-gap signals); status=IN_PROGRESS
- Impacts 1 requirements across 1 frameworks (1 open-gap signals); status=NOT_IMPLEMENTED