A practical starting list for mapping obligations across security, privacy, risk, audit and regulated operations.
A baseline is not a maturity score and it is not a promise that every control is finished. It is a shared picture of the commitments that matter, the owners behind them and the evidence that would make a reasonable challenge answerable.
Bring together customer commitments, regulation, internal policy, contractual requirements and the organisation's own risk appetite. Remove duplicates, but preserve the reason each obligation exists. This gives teams a common language before they debate tooling.
For each important commitment, ask: who does the work, how often, what proves it happened, and what happens when it does not? If an answer depends on a heroic individual or a spreadsheet no one owns, the baseline has found useful work.
Review the baseline when the business changes, not only before an audit. New suppliers, products, data flows and AI use cases should have a visible route into the map. A modest monthly review is often more valuable than a large annual refresh.