Control Ownership Split

Control Ownership Split separates the compliance controls a platform actually operates from the judgment layer an agency must retain. Automation vendors run continuous monitoring, evidence capture, and policy templates, but they cannot decide which client commitments, subprocessors, or contractual promises fall inside a control boundary. That interpretation work is the agency's defensible asset. A retainer built only on running a vendor dashboard is priced against the vendor's seat cost; a retainer built on scoping controls to each client's actual data flows survives a platform swap. The split matters because framework lock-in is real: a client certified under one vendor's control mapping may need remapping when the agency moves to another. Agencies that document their own control rationale can migrate between platforms without restarting the audit. The practical test is simple: if the vendor disappeared tomorrow, which artifacts would the agency still own?