Mods gave me the green light to post this. Thank you, moderators!

I work in compliance and audit, and I'm also a grad student. A course assignment this term has me doing customer discovery interviews, which means finding out whether a problem I believe in is actually a problem for anyone else. There's no product, nothing for sale, and no company behind this. Just me trying to check my own thinking before I get attached to it.

Here's the assumption I'm testing: for lean compliance teams, mapping overlapping requirements across frameworks, and keeping those mappings current, is a significant ongoing pain.

I believe that because it's what I see in my own work. Which is exactly why I might be wrong about it. It's entirely possible this is a minor annoyance that I've inflated because it's in front of me, and that the real pain is somewhere else entirely: evidence collection, getting other teams to respond, auditors asking the same thing five ways, or something I haven't thought of.

If you own SOC 2, ISO 27001, HIPAA, PCI, 800-171, or anything similar at your org, I would genuinely love your take. It's a written questionnaire, all free text, about 20 minutes. No email collection, no sign in, and nothing identifying appears in what I submit for the course. There's a section on AI at the end too, both governing it and using it for compliance work, because I'm curious whether that's landed on anyone's plate yet or is still mostly noise.

Link: https://docs.google.com/forms/d/e/1FAIpQLSdu1hyTNW5kPb9k9At-akL48ls2q8VeKYcts2hWwzDAcgpjng/viewform

And honestly, if you'd rather just tell me in the comments that I've got this wrong, please do. That's the most useful thing that could happen here. "This isn't a real problem, here's what actually eats my week" is the answer I'm most hoping to get, and the one I'd learn the most from.

Happy to post back what I find either way.