Based on the recommendation, specify high level auditable controls for each requirement. The controls are further detailed in non-technical terms. Take into consideration the current ability to demonstrate compliance, how compliance is achieved, and to what degree. This information is available from the assessment.