Framework mapping is the least glamorous part of TPRM, and the most consequential. Get it wrong and every downstream assessment is off by degrees.
The Mapping Problem
SOC 2's trust services criteria are written for auditors, not vendors. Translating them into questions a vendor can answer — with the right specificity — is where most templates break down.
The Prompt is Not the Product
The value isn't the model call; it's the review workflow around it. Every generated question gets a proposed intent, evidence type and follow-up branch — surfaced for a human reviewer in seconds.
// simplified control → question shape
type MappedQuestion = {
controlId: string;
question: string;
evidence: 'policy' | 'config' | 'attestation';
followups: string[];
};Reviewers accept, edit or reject each mapping. The accepted set becomes the template — versioned, auditable, and reusable across every vendor of that tier.
