Build
Create regulatory, policy, standards universe
Identify
Recognise the controls inventory
Map
Lineage from regulatory to controls
Rationalise
Combine or remove redundant, non-key, related controls
De-duplicate
Remove identical
controls
Prioritise
Understand the relative priority of controls against key risks
Automate
Automate critical
manual controls
Complete
Close any control gaps