Regulation is prose and controls are prose, and comparing them is reading work that nobody has capacity for until an audit forces it. Controls go stale silently.
Every flagged control, assessed by a compliance professional. The output is a shortlist, never a conclusion.
Modify a control, or conclude that one does or does not need changing.
Newly issued regulatory text; existing control register with framework mappings; jurisdictional scope
Shortlist of controls potentially affected, each with the specific regulatory text and the reasoning
The domain supports the pattern and no vendor in this model sells it. That is a statement about the market rather than about the pattern; v_agent_gaps lists them.