Both. GRCPulse ships a control library across procurement and supply chain, payments and finance, cyber, and construction, and the Controls Recommender proposes more. You can also bring your own. Framework names in generic material are illustrative, so the obligation set for a regulated jurisdiction is confirmed with your team.