Controls · The control set · Element
The controls
Each control, with what it is meant to prevent or catch.
The part
What it is
A control with no stated risk behind it is usually a procedure that was added after an incident and never questioned.
Controls should map to requirements, and requirements with no control are the actual gaps.
The smallest level
The attributes it carries
Each attribute is one of the framework’s shared types. What a date is, and how it is written, is defined once for the whole model — the note here says what it means in this particular place.