About

Compliance services help your clients show that they protect their data and systems the way a recognised standard says they should. You assess a client against that standard, close the gaps you find, keep proof of the work, and repeat it, so the client can show customers, insurers and auditors that their security stands up. This article explains the ideas behind those services and where ControlMap fits in.

What cybersecurity compliance is

Cybersecurity compliance is an ongoing process, not a one-off project. It has three parts:

• Aligning a client's security policies and procedures with an industry standard, called a framework.
• Reducing risk by regularly assessing the client against that framework and monitoring how they are doing.
• Keeping the client free of compliance violations by fixing gaps as they appear.

Why your clients need it

• Lower risk of a cyber attack, because a framework sets out the security measures to have in place.
• Fewer regulatory problems, because rules change and falling short can be costly.
• More trust from customers, who want to know their information is protected.

Who needs it

Any client that stores sensitive data is a candidate. Some clients are required to comply:

• Government contractors, who work to CMMC.
• Service organizations, who are often asked for a SOC 2 report.
• Clients in regulated industries such as finance and healthcare.

Other clients choose a framework such as ISO 27001 or CIS Controls to show that they hold themselves to a high standard.

The key ideas

Every compliance program follows the same chain, and an auditor checks each link:

• Framework: the standard or regulation, such as SOC 2.
• Requirements: what the framework says must be satisfied.
• Controls: the measures a client puts in place to meet those requirements.
• Evidence: proof that the controls are in place and working.
• Assessment: your judgement of whether the evidence is enough.
• Audit: a formal check by an internal or external auditor.

Auditors look for evidence that is enough to prove the requirement and recent enough to be trusted, a documented plan for every gap, and every in-scope requirement addressed. A requirement that was never assessed counts against the client.

How ControlMap supports the work

ControlMap gives you one place to run this chain for each client:

• Frameworks: a client adds the standards they work to. In the sidebar, open the framework switcher and select Add framework to bring one in from the catalog.
• Objectives: each framework requirement appears as an objective. Open Objectives in the sidebar to set each objective's status: Not Assessed, Not Compliant, Partially Compliant, In Review, Compliant or Not Applicable.
• Assessment questions: on Objectives › By Questions, answer Yes, No, Partially or N/A. Answering No or Partially offers to create an action item for the gap.
• Proof and follow-up: link documents, evidence and action items to each objective, so every requirement shows what supports it.
• Progress: each framework's Overview page shows the percent compliant and how many objectives are in each status.

Compliance percentages count only the requirements that are in scope. An objective set to Not Applicable is taken out of scope and left out of the percentage.

Where to go next

To work through a framework in detail, see the articles about frameworks and objectives in this Help Center.