[Verse 1]
When your controls need complex logic trees
Nested conditions and dependencies
OpenControl's simple structure breaks apart
Can't handle branching paths or complex charts
YAML fields just aren't designed to show
How different rules together ebb and flow
[Chorus]
Five places where it fails to shine
Complex logic, real-time, design
Reasoning relationships in your head
Multiple frameworks leave you misled
OpenControl has its place to be
But know these limits, one through three through five
[Verse 2]
Real-time enforcement needs immediate response
Active monitoring that never confronts
But OpenControl just documents the plan
It can't step in when violations span
Static descriptions of what should occur
Won't stop the breach when systems defer
[Chorus]
Five places where it fails to shine
Complex logic, real-time, design
Reasoning relationships in your head
Multiple frameworks leave you misled
OpenControl has its place to be
But know these limits, one through three through five
[Bridge]
When you need to trace the connections
Between controls and their reflections
OpenControl shows individual parts
But reasoning links? That's where it departs
No inference engine built inside
Just separate docs that coincide
[Verse 3]
Beyond NIST's familiar ground
Other frameworks can't be found
ISO, COBIT, custom schemes
OpenControl can't bridge these themes
One standard format, one single way
Leaves other compliance rules at bay
[Chorus]
Five places where it fails to shine
Complex logic, real-time, design
Reasoning relationships in your head
Multiple frameworks leave you misled
OpenControl has its place to be
But know these limits, one through three through five
[Outro]
Choose your tools with wisdom clear
Know the boundaries, crystal clear
OpenControl serves documentation well
But complex needs require more to tell