Some security profiles impose the obligation to meet some controls. It is a matter of compliance, and it may be conditional (e.g. if you have external communications, you shall …). When these compliance requirements are known, PILAR adds an applicability column.