Obligations
Requirements & tasks
Requirements describe what must be satisfied. Tasks describe work a person needs to complete.
Keep source and work distinct
- Requirement or obligation: an expectation traceable to a framework, regulation, policy, or approved governance source.
- Task: an assigned action with an owner, status, and due date.
- Control: the recurring operational measure that helps satisfy the requirement.
How they connect
One requirement may create several tasks, such as defining a control, collecting evidence, completing an assessment, or requesting a decision. Completing a task records progress; it does not by itself prove the underlying obligation is satisfied.
Use traceability
- 1Review the requirement and why it applies.
- 2Create or accept the necessary tasks from the Governance Plan or framework workflow.
- 3Assign accountable owners and due dates.
- 4Link the resulting control, assurance result, or evidence back to the source.