Control Crosswalk

Derived from control-register.md — the spine of the data room: 64 controls across five families, each crosswalked to SOC 2 (Trust Services Criteria), ISO 27001:2022 Annex A, and UK GDPR. Framework mappings are provisional; GDPR mappings are [counsel required] before external reliance.

Status distribution

Statuses follow not started → designed → implemented → verified → operational, under the honesty rule: a drafted policy alone never advances a control past designed.

pie showData title Control status distribution (64 controls)
  "implemented" : 30
  "designed" : 17
  "not started" : 15
  "operational" : 2

Family	Controls	operational	implemented	designed	not started
SEC — Security	17	—	14	—	3
PRIV — Privacy & data protection	17	—	4	7	6
SAF — Trust & safety	7	—	5	—	2
ML — ML governance	10	—	3	4	3
GOV/OPS — Governance & operations	13	2	4	6	1
Total	64	2	30	17	15

How the families map to the frameworks

Edges show where each family's controls predominantly land; the per-control, per-clause mapping is in the register itself.

flowchart LR
  %% source: control-register.md (family-level rollup of the mapping columns)
  subgraph fam["Partile control families (64)"]
    SEC["SEC — Security (17)<br/>sessions, authz, isolation, rate limits,<br/>secrets, IAM, agent-comms hardening"]
    PRIV["PRIV — Privacy (17)<br/>RoPA, retention, erasure, consent,<br/>minimization, on-device-by-design"]
    SAF["SAF — Trust & Safety (7)<br/>blocks, reports, no-location-reveal"]
    ML["ML — ML governance (10)<br/>event tiers, Art 9 constraint,<br/>anonymization boundary"]
    GOV["GOV/OPS — Governance & Ops (13)<br/>decision log, policies, backups,<br/>change mgmt, remediation"]
  end

  subgraph soc2["SOC 2 (TSC)"]
    CC["CC1–CC9 Common Criteria"]
    P["P — Privacy criteria"]
    A["A — Availability"]
  end

  subgraph iso["ISO 27001:2022 Annex A"]
    A5["A.5 Organizational"]
    A8["A.8 Technological"]
    A7["A.7 Physical — scoped out<br/>with recorded rationale (GOV-05)"]
  end

  subgraph gdpr["UK GDPR"]
    art5["Art 5 — principles & accountability"]
    basis["Art 6–9 — basis, consent, special category"]
    rights["Art 13–22 — transparency & rights"]
    sec32["Art 24–35 — security, DPIA, breach"]
    tx["Art 44–49 — international transfers"]
  end

  SEC --> CC
  SEC --> A8
  SEC --> sec32
  PRIV --> P
  PRIV --> A5
  PRIV --> art5
  PRIV --> basis
  PRIV --> rights
  PRIV --> tx
  SAF --> CC
  SAF --> A8
  SAF --> art5
  ML --> P
  ML --> A5
  ML --> basis
  ML --> rights
  GOV --> CC
  GOV --> A
  GOV --> A5
  GOV --> sec32
  GOV -. "N/A register" .-> A7

Reading the register

Each row in control-register.md carries: the control statement, status, an owner role (DIR / INFRA / OPS / MOBILE / COUNSEL — roles, not people), an evidence link (code path, merged PR, register, policy, or a named Tier-2 restricted artifact), a last-verified date, and the three framework mappings. Controls scoped out entirely (physical/ office) are recorded with rationale in the not-applicable register.