You describe the environment. Everything COMPASS builds comes from what you entered.
What you capture decides:
-
Which standards apply, and which controls under them
-
How many tasks each control creates, and what each one points at — business services, products, third-party applications, IT infrastructure hosting, infrastructure and security, vendors
-
The testing procedures used to check each task
-
Which integrations can be built to collect evidence automatically
The care you take here is what the programme is built on. A complete, accurate environment means every system gets its tasks, every task asks for evidence that exists, and the programme runs the same way every cycle — one entity or thirty.
Anything left out stays invisible. A system that never made it in never gets its tasks, so nothing tells you it's missing. Hosting described loosely leads to tests asking for evidence nobody has. Both show up at audit time.
Attention to detail here is what gives you the right compliance program.