About

A framework is a compliance standard, such as SOC 2, ISO 27001 or CMMC, that has been added to a client's account. Use the framework switcher in the sidebar to choose which framework you are working in, read how far along the client is on the Overview page, bring in a new framework from the catalog, or remove one you no longer need.

The choice you make in the switcher decides what Scope, Documents, Objectives, Plan of Action, Evidence, Audits and Reports show. The pages under Manage (Risks, Controls, Assets, People, Vendors and Trust) do not change when you switch frameworks.

Switch between frameworks

1. In the sidebar, select the framework name under Monitor. This is the switcher.
2. Select All Frameworks to see every framework together, or select one framework by name.

The switcher lists:

• Add framework, at the top, followed by a divider.
• All Frameworks.
• Each of the client's frameworks, by name.

Read the All Frameworks overview

With All Frameworks chosen and Overview selected, you see one card for each framework, two across. Each card shows:

• The framework's logo and name, with a Version line when a version is recorded.
• A donut showing the percent compliant, with the count underneath (for example "30 / 121 compliant").
• A bar for each status: Not Assessed, Compliant, Partially Compliant, In Review, Not Compliant and Not Applicable, each shown as a count out of the total.
• Links to the framework's Overview, Objectives, Evidence and Reports.
• Icons at the top right for the framework's actions.

Requirements that are Not Applicable (out of scope) are left out of the compliance percentage. Frameworks that your MSP created and shared with you show a "Managed in the MSP Admin Portal" badge. For CMMC frameworks, the card also shows a "SPRS Score" button that opens Objectives.

To open one framework's Overview, select its card or its name.

Read a framework's Overview

Select a framework in the switcher, then select Overview in the sidebar. The page is titled with the framework name, for example "SOC 2 Overview", and shows:

• Compliance Overview: the percent compliant, with a bar for each status.
• Assessment Answering Progress: how many questions are answered, split into Yes, Partially, No, Not Answered and Not Applicable.
• Progress History: how the framework has changed over the last 30, 60 and 90 days. Use the dropdown to choose Objectives, Action Items, Evidence or Documents. A "--" means there is no data that far back.
• Progress cards for Auto Audit, Action Items, Evidence and Documents. Select a card to go to that list.

Add a framework from the catalog

The catalog lists the frameworks you can add. Frameworks you have already added are marked Imported and cannot be added a second time.

1. Select the framework name in the sidebar, then select Add framework. The page is titled "Add framework".
2. Find the framework you want. Use the tabs, or type in Search frameworks:
   • All: every framework in the catalog.
   • ControlMap: the frameworks ControlMap provides.
   • Custom: frameworks your MSP has shared with you. This tab only appears if your MSP has shared any.
   • Imported: frameworks you have already added.
3. On the framework's card, select Import content. To read about a framework first, select the info icon on its card to see its description, how many requirements and sections it has, and how many versions are available.
4. If the framework has more than one version, a window titled "Choose a [framework name] version" opens first. Pick a version, then select Select version.
5. In the window titled "Configure [framework name]", set up the import:
   • Program name: starts as the framework's name. You can change it.
   • Program scope: shown when the framework has several scopes, such as the levels of CMMC. Required scopes are ticked and locked, and at least one scope must be ticked.
   • Enable CIS CSAT assessment: shown for CIS frameworks only.
   • Enable maturity assessment: shown for every framework. On CIS frameworks it is marked "Deprecated".
6. Select Start import. A message says the framework is being imported, and you land on that framework's Objectives page.

The person who starts the import becomes the framework's owner.

Add a custom framework shared by your MSP

Frameworks that your MSP has created and published for you appear in the catalog under the Custom tab, and also under All, with a "Partner managed" label on the card. Add them with the same steps as above. After the import, the framework shows its version and the "Managed in the MSP Admin Portal" badge on the All Frameworks overview.

Delete a framework

Deleting is the only way to take a framework out. There is no archive, and a delete cannot be undone.

1. Open the framework's Overview, or find its card on the All Frameworks overview.
2. Select the delete icon (the trash can) at the top right.
3. When asked to confirm, type delete and confirm.

After you delete a framework from its Overview page, you return to the All Frameworks overview.

Other framework actions

The same icons on a framework's Overview or card also let you:

• Edit the framework: change its name, logo, owner and the CIS CSAT and maturity assessment settings. Audit-type frameworks also have audit period dates.
• Refresh Control Mappings: refresh how controls map to the framework. You are asked to confirm first.
• Jump Start: on the All Frameworks cards, copy matching assessment answers from another framework you choose.