Standards, controls and their history

The first part of the loop is reachable through the API.

• Standards can be imported, with their requirements.
• Controls can be created, changed and moved through their lifecycle — and discarded while they never took effect.
• Mappings connect a control to the requirements it answers, readable from either end.
• Every change is audited and readable as history.

A mapping means somebody intends a control to address a requirement. It does not mean the requirement is met, so the filter is called mapped, not covered.

The API describes itself:

GET /api/v1/openapi.json

Evidence and files are next.