Map the questions before you map the controls.

This tool does not determine legal status. It produces a structured issue list to take into qualified legal/regulatory and architecture review.