Tailor control applicability

Marks controls as applicable or not applicable for the organization and records a grounded justification for the assessor.

Requires Do mode. Fibo writes back to the platform, one change at a time, and confirms first.

Example prompts

• "We do not develop software, mark the secure development controls not applicable"
• "Why is A.14 flagged as questionable for us?"
• "Reaffirm our applicability decisions for this quarter"

What you get back

A preview of exactly which controls change, then a recorded applicability assertion with the reasoning and a 90-day reaffirmation date.

Limits

Bulk applicability changes require a dry run and explicit confirmation. Justifications must be grounded in the entity profile, not invented.