{"catalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","download":{"releaseId":"sha256:3692243f0928ec11d6ec512f7a73e9421a7175749ce3c8d8de588dc7a8555112","slug":"controls-design","url":"/assets/agent_workflow-controls-design-7c5457b3.90faa4a66ba9aeb2.json"},"kind":"record","record":{"attributes":{"department":"operations","domain":"controls","lineOfDefense":"operate"},"canonicalUrl":"https://evidenceflows.com/workflows/all/?w=controls-design","description":"This instance runs against the Control item it creates: drafted at the objective step and committed to the Risk & Control Matrix (RCM) at record-the-control, so the archived instance is that control's design audit trail. It consumes no upstream workflow — a control is motivated by an existing Risk item or an audit Issue (finding/deficiency), which it links to rather than rebuilds. Design one new control end to end: control objective and attributes, risk mapping to the register, evidence and test-approach design, RCM record creation, disposition, packaging, and archival. The named deliverable is a new, uniquely identified control record in the RCM (a Control item) carrying a design determination statement, plus its test plan. In scope: designing and recording a single new control so it is operable and testable. Out of scope: executing the control's operating-effectiveness tests and remediating deficiencies, which are handed off downstream to the Security Control Assessment & POA&M Remediation workflow.","details":{"canonicalUrl":"https://evidenceflows.com/workflows/all/?w=controls-design","capabilities":[],"controls":["UC-ACCESS-15"],"domains":["controls"],"lineOfDefense":"operate","mappingStatus":"mapped","releaseId":"sha256:3692243f0928ec11d6ec512f7a73e9421a7175749ce3c8d8de588dc7a8555112","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:controls-design","standards":["nist-800-53","iso-27001"],"teams":["operations","risk-management"]},"download":{"releaseId":"sha256:3692243f0928ec11d6ec512f7a73e9421a7175749ce3c8d8de588dc7a8555112"},"history":{"digest":"29003c73a19dbda3ed33a91143d6b095ae4dacdabb6e568e52e089f22f337d58","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-10-04T21:48:26Z","updatedRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4"},"id":"wf:C4","mapUrl":"https://evidenceflows.com/?v=1&node=wf%3AC4","slug":"controls-design","sourceIds":["coso-ic"],"sourceUrl":null,"title":"Control Design","type":"workflow"},"relationships":[{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:43475dfb7425d14278b1e6235a1f64da359783004e9a2836edb1f63b335f7555","properties":{},"sourceDetailPath":"/data/v1/records/wf-c4-4c0ca700.json","sourceId":"wf:C4","targetDetailPath":"/data/v1/records/uc-uc-access-15-84699cae.json","targetId":"uc:UC-ACCESS-15","type":"operates"}],"schemaVersion":1}