New requirements

Implement a new regulation or standard by reusing and linking what already exists, then drive the rest with tasks and plans.

Typical requirementsNIS2DORACRAISO 27001

Stage 1 of 5
Import
Clauses are imported verbatim and mapped to clauses already covered by other standards.
Requirements
Links used
1. Requirements maps to Requirements
WINGMAN and AI support
Proposes clause-to-clause mappings.
Decides: The compliance lead confirms.
Stage 2 of 5
Gap analysis
Existing controls and their evidence are looked up for each clause.
Requirements Controls Evidence
Links used
1. Requirements met by Controls
2. Controls proven by Evidence
WINGMAN and AI support
Marks each clause covered, partly covered or open.
Decides: Control owners confirm.
Stage 3 of 5
Context
The risks, assets and documents the new clauses touch are linked, so impact is visible.
Requirements Controls Risks Assets Documents
Links used
1. Controls reduces Risks
2. Controls protects Assets
3. Requirements interpreted in Documents
WINGMAN and AI support
Finds affected assets and policies.
Decides: Owners confirm.
Stage 4 of 5
Implement
Open clauses become controls to build, tasks and a plan with an accountable role.
Controls Tasks Plans Roles
Links used
1. Controls improved by Tasks
2. Tasks part of Plans
3. Roles accountable for Plans
WINGMAN and AI support
Drafts the implementation plan.
Decides: The accountable role approves.
Stage 5 of 5
Prove
Evidence is collected and an audit tests the new clauses.
Controls Evidence Audits Requirements
Links used
1. Controls proven by Evidence
2. Audits tests Requirements
WINGMAN and AI support
Tracks evidence expiry.
Decides: The auditor concludes.

Screens for this stage · Stage 1: Import

Requirements **A contractual requirement mapped to standard clauses** A customer contract clause (report incidents within 72 h) is met by one control and mapped to ISO 27001 A.5.26 and NIS2 Article 21, so one control satisfies three sources.

Screens for this stage · Stage 2: Gap analysis

The Brief **Gaps to close and the organisation's temperature** Eleven register checks run on every record: risks without an owner or score, requirements without a control, tasks overdue by more than 30 days, vulnerabilities past the patching SLA, unapproved documents. Each gap links to the records behind it.

Screens for this stage · Stage 3: Context

Graph **The whole model, clustered** 228 nodes and 310 edges: risks, requirements, controls, assets and tasks as clusters, with the links between them. Start from any entity type, choose the depth, find a node, save a view.

Controls **A control, the policy behind it and the clauses it meets** Enforced MFA on all Google Workspace accounts: fully compliant, documented in the technical security policy, applied to two assets, meeting ISO 27001 A.8.5 and A.5.17.

Sector angles

What this use case looks like under specific regulations.

NIS2

When the law or the regulation changes, the new clauses are mapped to controls already in place and only the real gaps become tasks.

Financial sector

New supervisory expectations or MiCA requirements are mapped to existing controls before anyone writes a new policy.

AI governance

New guidance, standards and implementing acts are mapped onto existing controls instead of starting a new programme.

CRA

Harmonised standards and guidance under the CRA are mapped onto controls already in place.

GDPR

New guidance from supervisory authorities and the EDPB is mapped to existing measures.

Videos

**ISMS implementation with WINGMAN AI** Building an information security management system in WINGMAN, from requirements and scope to risks, controls, owners and the review cycle.

Plays from youtube-nocookie.com. YouTube sets no cookies until you press play.

Other use cases

Management review

Prepare the ISO 27001 management review and NIS2 management body oversight with complete inputs, logged decisions and planned follow-up.

GDPR and DPIA

Keep processing chains and their risks current, and support data protection impact assessments.

EU AI Act

Keep an AI use case registry and link each use case to its obligations, risks and controls.

All use cases