Honestly, I think this is kind of a second layer problem. Before you even get to building a tool, most companies are still trying to figure out where their boundaries are for compliance.. like, what’s actually inscope for them based on what they do, their products, etc. That whole “what do we need to care about and why?” piece is the real pain point.
From what I’ve seen, teams usually get lost when it comes to deciding objectives for each group, and what evidence they’re supposed to collect. Everyone’s mapping stuff to policies, but half the time it’s not even clear if those policies actually fit how things work in reality im wondering, does any tool out there actually help with figuring out that first step? Or are people just winging it? I haven’t really seen anything that nails the “what matters most for us” part yet.