bmad-plus 0.7.5 → 0.9.0

package/src/bmad-plus/packs/pack-shield/shared/audit-report-template.md

@@ -1,103 +1,103 @@
-# 📋 Audit Report Template
-
-> **Pack:** Shield (GRC Audit) — Shared Templates
-> **Purpose:** Standardized compliance audit report format
-> **Version:** 1.0.0
-
----
-
-## Compliance Audit Report
-
-### Cover Page
-
-| Field | Value |
-|-------|-------|
-| **Report Title** | [Framework] Compliance Audit Report |
-| **Organization** | [NAME] |
-| **Framework(s)** | [FRAMEWORK VERSION] |
-| **Audit Type** | Internal / External / AI-Assisted |
-| **Scope** | [Description of audit scope] |
-| **Period** | [Start Date] to [End Date] |
-| **Report Date** | [DATE] |
-| **Prepared by** | [NAME] |
-| **Classification** | Confidential |
-
----
-
-### 1. Executive Summary
-
-**Overall Compliance Posture:** 🔴 Non-Compliant / 🟡 Partially Compliant / 🟢 Compliant
-
-**Key Findings:**
-- X critical findings requiring immediate action
-- X high-priority gaps requiring remediation within 30 days
-- X medium-priority improvements recommended
-- X low-priority best-practice suggestions
-
----
-
-### 2. Scope & Methodology
-
-**In Scope:**
-- [Systems, applications, data stores]
-- [Processes, departments, locations]
-- [Data types covered]
-
-**Out of Scope:**
-- [Excluded items with justification]
-
-**Methodology:**
-- [Audit standard used]
-- [Evidence collection methods]
-- [Sampling approach if applicable]
-
----
-
-### 3. Findings
-
-| # | Severity | Reference | Finding | Risk | Recommendation | Owner | Due Date |
-|---|----------|-----------|---------|------|----------------|-------|----------|
-| 1 | 🔴 Critical | [Art./Cl.] | [Description] | [Risk] | [Action] | [Name] | [Date] |
-| 2 | 🟡 High | [Art./Cl.] | [Description] | [Risk] | [Action] | [Name] | [Date] |
-| 3 | 🟢 Medium | [Art./Cl.] | [Description] | [Risk] | [Action] | [Name] | [Date] |
-
-**Severity Definitions:**
-- 🔴 **Critical**: Direct regulatory violation, immediate penalty risk
-- 🟡 **High**: Significant compliance gap, requires near-term remediation
-- 🟢 **Medium**: Best practice improvement, no immediate violation risk
-- ⚪ **Low**: Enhancement opportunity, industry best practice
-
----
-
-### 4. Compliance Summary by Domain
-
-| Domain | Controls Tested | Compliant | Partial | Non-Compliant | Score |
-|--------|----------------|-----------|---------|---------------|-------|
-| [Domain 1] | X | X | X | X | X% |
-| [Domain 2] | X | X | X | X | X% |
-| **Total** | **X** | **X** | **X** | **X** | **X%** |
-
----
-
-### 5. Recommendations & Remediation Plan
-
-| Priority | Action | Framework Ref | Effort | Timeline | Dependencies |
-|----------|--------|--------------|--------|----------|-------------|
-| 1 | [Action] | [Ref] | [Est.] | [When] | [What] |
-
----
-
-### 6. Appendices
-
-- **A**: Evidence inventory
-- **B**: Detailed control testing results
-- **C**: Interview/assessment notes
-- **D**: Previous audit comparison (if applicable)
-
----
-
-### Document Control
-
-| Version | Date | Author | Changes |
-|---------|------|--------|---------|
-| 1.0 | [Date] | [Name] | Initial audit report |
+# 📋 Audit Report Template
+
+> **Pack:** Shield (GRC Audit) — Shared Templates
+> **Purpose:** Standardized compliance audit report format
+> **Version:** 1.0.0
+
+---
+
+## Compliance Audit Report
+
+### Cover Page
+
+| Field | Value |
+|-------|-------|
+| **Report Title** | [Framework] Compliance Audit Report |
+| **Organization** | [NAME] |
+| **Framework(s)** | [FRAMEWORK VERSION] |
+| **Audit Type** | Internal / External / AI-Assisted |
+| **Scope** | [Description of audit scope] |
+| **Period** | [Start Date] to [End Date] |
+| **Report Date** | [DATE] |
+| **Prepared by** | [NAME] |
+| **Classification** | Confidential |
+
+---
+
+### 1. Executive Summary
+
+**Overall Compliance Posture:** 🔴 Non-Compliant / 🟡 Partially Compliant / 🟢 Compliant
+
+**Key Findings:**
+- X critical findings requiring immediate action
+- X high-priority gaps requiring remediation within 30 days
+- X medium-priority improvements recommended
+- X low-priority best-practice suggestions
+
+---
+
+### 2. Scope & Methodology
+
+**In Scope:**
+- [Systems, applications, data stores]
+- [Processes, departments, locations]
+- [Data types covered]
+
+**Out of Scope:**
+- [Excluded items with justification]
+
+**Methodology:**
+- [Audit standard used]
+- [Evidence collection methods]
+- [Sampling approach if applicable]
+
+---
+
+### 3. Findings
+
+| # | Severity | Reference | Finding | Risk | Recommendation | Owner | Due Date |
+|---|----------|-----------|---------|------|----------------|-------|----------|
+| 1 | 🔴 Critical | [Art./Cl.] | [Description] | [Risk] | [Action] | [Name] | [Date] |
+| 2 | 🟡 High | [Art./Cl.] | [Description] | [Risk] | [Action] | [Name] | [Date] |
+| 3 | 🟢 Medium | [Art./Cl.] | [Description] | [Risk] | [Action] | [Name] | [Date] |
+
+**Severity Definitions:**
+- 🔴 **Critical**: Direct regulatory violation, immediate penalty risk
+- 🟡 **High**: Significant compliance gap, requires near-term remediation
+- 🟢 **Medium**: Best practice improvement, no immediate violation risk
+- ⚪ **Low**: Enhancement opportunity, industry best practice
+
+---
+
+### 4. Compliance Summary by Domain
+
+| Domain | Controls Tested | Compliant | Partial | Non-Compliant | Score |
+|--------|----------------|-----------|---------|---------------|-------|
+| [Domain 1] | X | X | X | X | X% |
+| [Domain 2] | X | X | X | X | X% |
+| **Total** | **X** | **X** | **X** | **X** | **X%** |
+
+---
+
+### 5. Recommendations & Remediation Plan
+
+| Priority | Action | Framework Ref | Effort | Timeline | Dependencies |
+|----------|--------|--------------|--------|----------|-------------|
+| 1 | [Action] | [Ref] | [Est.] | [When] | [What] |
+
+---
+
+### 6. Appendices
+
+- **A**: Evidence inventory
+- **B**: Detailed control testing results
+- **C**: Interview/assessment notes
+- **D**: Previous audit comparison (if applicable)
+
+---
+
+### Document Control
+
+| Version | Date | Author | Changes |
+|---------|------|--------|---------|
+| 1.0 | [Date] | [Name] | Initial audit report |

package/src/bmad-plus/packs/pack-shield/shared/cross-framework-mapper.md

@@ -1,103 +1,103 @@
-# 🔄 Cross-Framework Control Mapper
-
-> **Pack:** Shield (GRC Audit) — Shared Templates
-> **Purpose:** Map controls between compliance frameworks to identify overlaps and gaps
-> **Version:** 1.0.0
-
----
-
-## How to Use
-
-When performing a multi-framework compliance analysis, use this template to create a unified control mapping. This reveals:
-- **Common controls** — implement once, satisfy multiple frameworks
-- **Framework-specific requirements** — unique obligations per standard
-- **Gap areas** — controls required by one framework but absent from another
-
----
-
-## Common Framework Pairings
-
-### Privacy Alignment Matrix
-| Control Area | GDPR | CCPA/CPRA | LGPD | DPDPA | ISO 27701 |
-|-------------|------|-----------|------|-------|-----------|
-| Lawful basis | Art. 6 | N/A (no basis concept) | Art. 7 (10 bases) | Sec. 6-7 (2 bases) | Cl. 6.1 |
-| Privacy notice | Art. 13-14 | §1798.100 | Art. 9 | Sec. 5 / Rule 3 | A.1.3.3 |
-| Consent | Art. 7 | Opt-out model | Art. 8 | Sec. 6 | A.1.3.1 |
-| Data subject rights | Art. 15-22 | §1798.100-125 | Art. 17-22 | Sec. 11-14 | A.1.3.5-11 |
-| DPO/responsible | Art. 37-39 | N/A | Art. 41 | Sec. 10 (SDF only) | Cl. 5 |
-| Breach notification | Art. 33-34 (72h) | §1798.150 (breach only) | Art. 48 (3 days) | Sec. 8 (72h) | A.3.11-12 |
-| International transfer | Art. 44-49 | N/A | Art. 33-36 | Sec. 16 (blacklist) | A.1.5.2-5 |
-| DPIA | Art. 35 | N/A (risk assessment CPRA) | Art. 38 | Sec. 10 (SDF) | A.1.2.6 |
-| Penalties max | €20M / 4% | $7,500/violation | R$50M / 2% | ₹250 crore | N/A (cert) |
-
-### Cybersecurity Triad
-| Control Area | ISO 27001 (2022) | NIST CSF 2.0 | CIS Controls v8 |
-|-------------|-----------------|-------------|-----------------|
-| Risk assessment | Cl. 6.1 | GV.RM | IG1: 1.1 |
-| Asset management | A.5.9-5.14 | ID.AM | CIS 1, 2 |
-| Access control | A.5.15-5.18, A.8.2-8.5 | PR.AA | CIS 5, 6 |
-| Awareness training | Cl. 7.2-7.3 | PR.AT | CIS 14 |
-| Incident response | A.5.24-5.28 | RS.MA | CIS 17 |
-| Logging/monitoring | A.8.15-8.16 | DE.CM | CIS 8 |
-| Vulnerability management | A.8.8 | ID.RA | CIS 7 |
-| Data protection | A.8.10-8.12 | PR.DS | CIS 3 |
-| Configuration | A.8.9 | PR.PS | CIS 4 |
-| Business continuity | A.5.29-5.30 | RC.RP | CIS 11 |
-
-### US Federal Alignment
-| Control Area | NIST 800-53 | FedRAMP | CMMC 2.0 |
-|-------------|-------------|---------|----------|
-| Access Control | AC family | AC (enhanced) | AC domain |
-| Audit & Accountability | AU family | AU (enhanced) | AU domain |
-| Configuration Management | CM family | CM (enhanced) | CM domain |
-| Identification & Auth | IA family | IA (enhanced) | IA domain |
-| Incident Response | IR family | IR (enhanced) | IR domain |
-| Risk Assessment | RA family | RA (enhanced) | RA domain |
-| System & Comms Protection | SC family | SC (enhanced) | SC domain |
-| System & Info Integrity | SI family | SI (enhanced) | SI domain |
-
-### AI Governance Triad
-| Control Area | EU AI Act | ISO 42001 | NIST AI RMF |
-|-------------|-----------|-----------|-------------|
-| Risk classification | Art. 6, Annex III | Cl. 6.1 | MAP function |
-| Data governance | Art. 10 | A.6.2.4 | MAP 2.3 |
-| Transparency | Art. 13 | A.6.2.6 | GOVERN 1.7 |
-| Human oversight | Art. 14 | A.6.2.5 | GOVERN 1.3 |
-| Accuracy/robustness | Art. 15 | A.6.2.7 | MEASURE 2.x |
-| Technical documentation | Art. 11, Annex IV | Cl. 7.5 | GOVERN 1.5 |
-| Conformity assessment | Art. 43 | Certification | MANAGE function |
-| Incident reporting | Art. 73 | A.6.2.8 | MANAGE 4.x |
-
----
-
-## Mapping Output Format
-
-When generating a cross-framework mapping, use this structure:
-
-```markdown
-## Cross-Framework Compliance Map
-
-### Frameworks Analyzed
-[List all frameworks with versions]
-
-### Unified Control Matrix
-
-| # | Control Area | [Framework A] | [Framework B] | [Framework C] | Implementation Status |
-|---|-------------|--------------|--------------|--------------|----------------------|
-| 1 | [Area] | [Ref] | [Ref] | [Ref] | ✅ / 🟡 / ❌ |
-
-### Common Controls (Implement Once)
-[List controls that satisfy 2+ frameworks simultaneously]
-
-### Framework-Specific Requirements
-[List unique requirements per framework]
-
-### Recommended Implementation Order
-[Priority-ranked list considering overlap maximization]
-```
-
----
-
-## Escalation
-
-> When mapping complex multi-framework environments, recommend engaging a qualified compliance consultant who can validate the mappings against the organization's specific context.
+# 🔄 Cross-Framework Control Mapper
+
+> **Pack:** Shield (GRC Audit) — Shared Templates
+> **Purpose:** Map controls between compliance frameworks to identify overlaps and gaps
+> **Version:** 1.0.0
+
+---
+
+## How to Use
+
+When performing a multi-framework compliance analysis, use this template to create a unified control mapping. This reveals:
+- **Common controls** — implement once, satisfy multiple frameworks
+- **Framework-specific requirements** — unique obligations per standard
+- **Gap areas** — controls required by one framework but absent from another
+
+---
+
+## Common Framework Pairings
+
+### Privacy Alignment Matrix
+| Control Area | GDPR | CCPA/CPRA | LGPD | DPDPA | ISO 27701 |
+|-------------|------|-----------|------|-------|-----------|
+| Lawful basis | Art. 6 | N/A (no basis concept) | Art. 7 (10 bases) | Sec. 6-7 (2 bases) | Cl. 6.1 |
+| Privacy notice | Art. 13-14 | §1798.100 | Art. 9 | Sec. 5 / Rule 3 | A.1.3.3 |
+| Consent | Art. 7 | Opt-out model | Art. 8 | Sec. 6 | A.1.3.1 |
+| Data subject rights | Art. 15-22 | §1798.100-125 | Art. 17-22 | Sec. 11-14 | A.1.3.5-11 |
+| DPO/responsible | Art. 37-39 | N/A | Art. 41 | Sec. 10 (SDF only) | Cl. 5 |
+| Breach notification | Art. 33-34 (72h) | §1798.150 (breach only) | Art. 48 (3 days) | Sec. 8 (72h) | A.3.11-12 |
+| International transfer | Art. 44-49 | N/A | Art. 33-36 | Sec. 16 (blacklist) | A.1.5.2-5 |
+| DPIA | Art. 35 | N/A (risk assessment CPRA) | Art. 38 | Sec. 10 (SDF) | A.1.2.6 |
+| Penalties max | €20M / 4% | $7,500/violation | R$50M / 2% | ₹250 crore | N/A (cert) |
+
+### Cybersecurity Triad
+| Control Area | ISO 27001 (2022) | NIST CSF 2.0 | CIS Controls v8 |
+|-------------|-----------------|-------------|-----------------|
+| Risk assessment | Cl. 6.1 | GV.RM | IG1: 1.1 |
+| Asset management | A.5.9-5.14 | ID.AM | CIS 1, 2 |
+| Access control | A.5.15-5.18, A.8.2-8.5 | PR.AA | CIS 5, 6 |
+| Awareness training | Cl. 7.2-7.3 | PR.AT | CIS 14 |
+| Incident response | A.5.24-5.28 | RS.MA | CIS 17 |
+| Logging/monitoring | A.8.15-8.16 | DE.CM | CIS 8 |
+| Vulnerability management | A.8.8 | ID.RA | CIS 7 |
+| Data protection | A.8.10-8.12 | PR.DS | CIS 3 |
+| Configuration | A.8.9 | PR.PS | CIS 4 |
+| Business continuity | A.5.29-5.30 | RC.RP | CIS 11 |
+
+### US Federal Alignment
+| Control Area | NIST 800-53 | FedRAMP | CMMC 2.0 |
+|-------------|-------------|---------|----------|
+| Access Control | AC family | AC (enhanced) | AC domain |
+| Audit & Accountability | AU family | AU (enhanced) | AU domain |
+| Configuration Management | CM family | CM (enhanced) | CM domain |
+| Identification & Auth | IA family | IA (enhanced) | IA domain |
+| Incident Response | IR family | IR (enhanced) | IR domain |
+| Risk Assessment | RA family | RA (enhanced) | RA domain |
+| System & Comms Protection | SC family | SC (enhanced) | SC domain |
+| System & Info Integrity | SI family | SI (enhanced) | SI domain |
+
+### AI Governance Triad
+| Control Area | EU AI Act | ISO 42001 | NIST AI RMF |
+|-------------|-----------|-----------|-------------|
+| Risk classification | Art. 6, Annex III | Cl. 6.1 | MAP function |
+| Data governance | Art. 10 | A.6.2.4 | MAP 2.3 |
+| Transparency | Art. 13 | A.6.2.6 | GOVERN 1.7 |
+| Human oversight | Art. 14 | A.6.2.5 | GOVERN 1.3 |
+| Accuracy/robustness | Art. 15 | A.6.2.7 | MEASURE 2.x |
+| Technical documentation | Art. 11, Annex IV | Cl. 7.5 | GOVERN 1.5 |
+| Conformity assessment | Art. 43 | Certification | MANAGE function |
+| Incident reporting | Art. 73 | A.6.2.8 | MANAGE 4.x |
+
+---
+
+## Mapping Output Format
+
+When generating a cross-framework mapping, use this structure:
+
+```markdown
+## Cross-Framework Compliance Map
+
+### Frameworks Analyzed
+[List all frameworks with versions]
+
+### Unified Control Matrix
+
+| # | Control Area | [Framework A] | [Framework B] | [Framework C] | Implementation Status |
+|---|-------------|--------------|--------------|--------------|----------------------|
+| 1 | [Area] | [Ref] | [Ref] | [Ref] | ✅ / 🟡 / ❌ |
+
+### Common Controls (Implement Once)
+[List controls that satisfy 2+ frameworks simultaneously]
+
+### Framework-Specific Requirements
+[List unique requirements per framework]
+
+### Recommended Implementation Order
+[Priority-ranked list considering overlap maximization]
+```
+
+---
+
+## Escalation
+
+> When mapping complex multi-framework environments, recommend engaging a qualified compliance consultant who can validate the mappings against the organization's specific context.

package/src/bmad-plus/packs/pack-shield/shared/gap-analysis-template.md

@@ -1,83 +1,83 @@
-# 📊 Gap Analysis Template
-
-> **Pack:** Shield (GRC Audit) — Shared Templates
-> **Purpose:** Standardized gap analysis format for any compliance framework
-> **Version:** 1.0.0
-
----
-
-## Gap Analysis Report
-
-### 1. Executive Summary
-
-| Item | Detail |
-|------|--------|
-| **Organization** | [NAME] |
-| **Framework(s)** | [FRAMEWORK VERSION] |
-| **Scope** | [Systems, processes, departments covered] |
-| **Assessment Date** | [DATE] |
-| **Assessor** | [NAME / AI-assisted] |
-| **Overall Maturity** | 🔴 Critical / 🟡 Developing / 🟢 Mature |
-
-### 2. Maturity Scoring
-
-| Level | Score | Description |
-|-------|-------|-------------|
-| **Non-existent** | 0 | No awareness, no controls |
-| **Ad-hoc** | 1 | Informal, reactive, person-dependent |
-| **Repeatable** | 2 | Documented but inconsistently applied |
-| **Defined** | 3 | Standardized processes, consistently applied |
-| **Managed** | 4 | Measured, monitored, continuously improved |
-| **Optimized** | 5 | Automated, integrated, industry-leading |
-
-### 3. Detailed Gap Analysis
-
-| # | Requirement | Reference | Status | Current Evidence | Gap | Priority | Remediation |
-|---|------------|-----------|--------|-----------------|-----|----------|-------------|
-| 1 | [Requirement] | [Art./Cl.] | ✅/🟡/❌ | [Evidence] | [Gap description] | 🔴/🟡/🟢 | [Action needed] |
-
-**Status definitions:**
-- ✅ **Implemented** — fully in place with documented evidence
-- 🟡 **Partial** — some evidence exists but gaps remain
-- ❌ **Not Implemented** — no evidence of implementation
-- **N/A** — documented exclusion with justification
-
-**Priority definitions:**
-- 🔴 **Critical** — direct violation risk, regulatory penalty exposure
-- 🟡 **High** — significant gap requiring near-term remediation
-- 🟢 **Medium** — improvement opportunity, best practice
-
-### 4. Summary Statistics
-
-| Status | Count | Percentage |
-|--------|-------|------------|
-| ✅ Implemented | X | X% |
-| 🟡 Partial | X | X% |
-| ❌ Not Implemented | X | X% |
-| N/A | X | X% |
-| **Total** | **X** | **100%** |
-
-### 5. Remediation Roadmap
-
-| Phase | Timeline | Actions | Resources | Dependencies |
-|-------|----------|---------|-----------|-------------|
-| Quick Wins | 0-30 days | [Actions] | [Resources] | [None] |
-| Short-term | 1-3 months | [Actions] | [Resources] | [Dependencies] |
-| Medium-term | 3-6 months | [Actions] | [Resources] | [Dependencies] |
-| Long-term | 6-12 months | [Actions] | [Resources] | [Dependencies] |
-
-### 6. Risk Register (from gaps)
-
-| # | Gap | Likelihood | Impact | Risk Score | Treatment |
-|---|-----|-----------|--------|------------|-----------|
-| 1 | [Gap] | 1-5 | 1-5 | L×I | Accept/Avoid/Transfer/Mitigate |
-
----
-
-## Usage Notes
-
-- Adapt the requirement rows to the specific framework being assessed
-- For multi-framework assessments, add a "Framework" column
-- Always include the specific article/clause/control reference
-- Document evidence sources for implemented controls
-- For partial implementations, specify what is missing
+# 📊 Gap Analysis Template
+
+> **Pack:** Shield (GRC Audit) — Shared Templates
+> **Purpose:** Standardized gap analysis format for any compliance framework
+> **Version:** 1.0.0
+
+---
+
+## Gap Analysis Report
+
+### 1. Executive Summary
+
+| Item | Detail |
+|------|--------|
+| **Organization** | [NAME] |
+| **Framework(s)** | [FRAMEWORK VERSION] |
+| **Scope** | [Systems, processes, departments covered] |
+| **Assessment Date** | [DATE] |
+| **Assessor** | [NAME / AI-assisted] |
+| **Overall Maturity** | 🔴 Critical / 🟡 Developing / 🟢 Mature |
+
+### 2. Maturity Scoring
+
+| Level | Score | Description |
+|-------|-------|-------------|
+| **Non-existent** | 0 | No awareness, no controls |
+| **Ad-hoc** | 1 | Informal, reactive, person-dependent |
+| **Repeatable** | 2 | Documented but inconsistently applied |
+| **Defined** | 3 | Standardized processes, consistently applied |
+| **Managed** | 4 | Measured, monitored, continuously improved |
+| **Optimized** | 5 | Automated, integrated, industry-leading |
+
+### 3. Detailed Gap Analysis
+
+| # | Requirement | Reference | Status | Current Evidence | Gap | Priority | Remediation |
+|---|------------|-----------|--------|-----------------|-----|----------|-------------|
+| 1 | [Requirement] | [Art./Cl.] | ✅/🟡/❌ | [Evidence] | [Gap description] | 🔴/🟡/🟢 | [Action needed] |
+
+**Status definitions:**
+- ✅ **Implemented** — fully in place with documented evidence
+- 🟡 **Partial** — some evidence exists but gaps remain
+- ❌ **Not Implemented** — no evidence of implementation
+- **N/A** — documented exclusion with justification
+
+**Priority definitions:**
+- 🔴 **Critical** — direct violation risk, regulatory penalty exposure
+- 🟡 **High** — significant gap requiring near-term remediation
+- 🟢 **Medium** — improvement opportunity, best practice
+
+### 4. Summary Statistics
+
+| Status | Count | Percentage |
+|--------|-------|------------|
+| ✅ Implemented | X | X% |
+| 🟡 Partial | X | X% |
+| ❌ Not Implemented | X | X% |
+| N/A | X | X% |
+| **Total** | **X** | **100%** |
+
+### 5. Remediation Roadmap
+
+| Phase | Timeline | Actions | Resources | Dependencies |
+|-------|----------|---------|-----------|-------------|
+| Quick Wins | 0-30 days | [Actions] | [Resources] | [None] |
+| Short-term | 1-3 months | [Actions] | [Resources] | [Dependencies] |
+| Medium-term | 3-6 months | [Actions] | [Resources] | [Dependencies] |
+| Long-term | 6-12 months | [Actions] | [Resources] | [Dependencies] |
+
+### 6. Risk Register (from gaps)
+
+| # | Gap | Likelihood | Impact | Risk Score | Treatment |
+|---|-----|-----------|--------|------------|-----------|
+| 1 | [Gap] | 1-5 | 1-5 | L×I | Accept/Avoid/Transfer/Mitigate |
+
+---
+
+## Usage Notes
+
+- Adapt the requirement rows to the specific framework being assessed
+- For multi-framework assessments, add a "Framework" column
+- Always include the specific article/clause/control reference
+- Document evidence sources for implemented controls
+- For partial implementations, specify what is missing