Requirements describe obligations or expected outcomes; controls describe safeguards used to meet those outcomes and manage risk. Their relationship is central to understanding a framework or policy assessment.
This section explains both concepts. In practice, document each requirement's source and applicability, then connect it to the implemented controls and the evidence used to review their effectiveness.