Map key requirements from [RegulatoryFramework] in [Region] to specific classification and handling controls. For each obligation, indicate the impacted classification level(s), control objective, and evidence artifact. Calibrate depth based on [RiskTolerance] and propose an [AuditFrequency] cadence per control.
Output format:
“Obligation-to-Control Map” (JSON array with fields: obligation_id, text, classification_levels[], control_id, control_text, evidence, owner_role, frequency).
“Gaps & Remediation Plan” (Markdown table with gap, risk, remediation action, ETA).
“Evidence Catalog” (bullets listing logs, labels, access reports, DLP alerts).
Include cross-references to policy sections and demonstrate traceability suitable for regulator or client due diligence.