Some security profiles impose the obligation to meet some controls. It is a matter of compliance, and it may be conditional (e.g., if you have external communications, you shall …). When these compliance requirements are known, PILAR adds an applicability column

For instance, for GDPR: