Control packs
A pack is one reading of a regulatory regime, published as data: what a pack is, and what ships. The rules that cite your controls come from a pack that ships, a pack you write, or the rules your deployment already has.
Where the rules come from
Section titled “Where the rules come from”A control identifier is an opaque string the gateway carries and never reads, so the simplest route needs no pack at all. Put your own framework’s identifiers on your own rules and every decision those rules make carries them onto the record, with nothing to wait for from a release.
Take a shipped pack when somebody has already read the text you are held to, and reviewing that reading is less work than writing one. → Start from a control pack
Write a pack when the regime is not among the ones that ship, or when several deployments in one organisation should decide the same way without rules being copied between documents. A pack of your own is added exactly the way a shipped one is. → Write a control pack
Add the base pack before the ones that build on it
Section titled “Add the base pack before the ones that build on it”sa-pdpl carries the rules the other Saudi packs attach their
identifiers to. pack add refuses a pack whose dependency is absent
and names the one to add first, so the order is enforced rather than
remembered.
Two regimes that want the same thing done share one rule. One decision then carries both regimes’ identifiers onto the record, which is how a single trail answers to two frameworks without deciding twice.
Read what a pack leaves to you
Section titled “Read what a pack leaves to you”Every pack page ends with what it does not cover. Classifying documents, keeping a register of information assets and maintaining a data catalog stay with the entity in all of them, because a gateway sees requests and not a data estate.
Then prove the rules in your own document
Section titled “Then prove the rules in your own document”The suite a pack ships runs against the pack’s own rules. Once add
has copied them in, the document is yours, the pack is not consulted
again, and the cases that prove the rules are yours to keep.
→ Test your rules before they ship
Related
Section titled “Related”The audit trail is where a control identifier ends up: a field on the record of every decision the citing rule made, so the trail answers for a control without anybody parsing bodies to find out.