Control Mapping Template

Purpose

This template provides a structured artefact for project teams to copy into their delivery workspace, Statement of Work pack, assurance pack or customer governance process.

Template

Field	Entry
Project	[Project name]
Customer	[Customer name]
Statement of Work	[SoW reference]
Security owner	[Name / role]
Technical owner	[Name / role]
Data owner	[Name / role]
Supplier owner	[Name / role]
Classification	[OFFICIAL / OFFICIAL-SENSITIVE / SECRET / TOP SECRET / customer classification]
Applicable frameworks	[Secure by Design / CSM / Def Stan / CAF / ISO / Cyber Essentials / JSP / customer policy]
Scope	[Systems, services, data, users, suppliers, environments]
Out of scope	[Explicit exclusions]
Assumptions	[Assumptions]
Dependencies	[Dependencies]
Risks	[Risks]
Evidence location	[Repository / folder / assurance tool]

Control Record

ID	Requirement	Control	Owner	Evidence	Status	Review date
SEC-001	[Requirement]	[Control]	[Owner]	[Evidence]	[Status]	[Date]

Approval Record

Decision	Approver	Date	Evidence
[Decision]	[Name / role]	[Date]	[Link]

Completion Checklist

• Scope confirmed

• Owner confirmed

• Requirements captured

• Controls mapped

• Evidence attached

• Supplier impact checked

• Risk reviewed

• Approval recorded

• Next review scheduled