About

This article walks through a cybersecurity compliance program from start to finish in ControlMap: add a framework, assess it, write your policies, collect evidence, track what needs fixing, watch your connected tools, and run an audit. Each step tells you where to click in the sidebar and which article to read next for the details.

The steps follow the order most teams work in. They are not locked. You can return to any step at any time, and several run side by side once the program is under way.

The workflow at a glance

The steps and where to find them:

1. Add a framework: the framework switcher › Add framework
2. Assess your objectives: Objectives
3. Write and approve your policies: Documents
4. Collect evidence: Evidence
5. Track what needs fixing: Plan of Action
6. Watch your connected tools: Monitor
7. Run an audit: Audits

Step 1: Add a framework

A framework is the compliance standard you are working toward, such as SOC 2 or ISO 27001. Everything else in the program is organised around it.

To add one:

1. In the sidebar, select the framework switcher, then select Add framework.
2. Find the framework with the tabs or the Search frameworks box, then select Import content on its card.
3. If the framework has more than one version, pick one and select Select version.
4. In the Configure window, check the Program name and the scope, then select Start import.

When the import starts, you land on the framework's Objectives page.

Read next: "Add and switch frameworks".

Step 2: Assess your objectives

Objectives are the requirements of the framework. Assessing them means setting a status for each one and answering the assessment questions behind it. This shows where you already meet the standard and where you have gaps.

To start, in the sidebar go to your framework section and select Objectives. The page has two tabs, By Objectives and By Questions. From there you can:

• Set a status on an objective: Not Assessed, Not Compliant, Partially Compliant, In Review, Compliant or Not Applicable.
• Answer the assessment questions in By Questions with Yes, No, Partially or N/A.
• Take an objective that does not apply out of scope. Setting it to Not Applicable does this.

When you mark an objective Not Compliant or Partially Compliant, or answer a question No or Partially, ControlMap asks "Create an action item?". Tick Also add in POAM if you want the item on your Plan of Action (step 5).

Read next: "Objectives and assessments".

Step 3: Write and approve your policies

Policies, procedures and governance documents are the written side of your program. They show an auditor how your company runs its security practices.

To create them, in the sidebar go to your framework section and select Documents. Then:

1. Choose the Policies, Procedures or Governance tab.
2. Select Actions, then Add Policy (or Add Procedure or Add Document). To start from a ready-made document, select Add from template instead.
3. Link the document to the objectives it supports. You can pick objectives when you create it, or use the Mappings tab afterwards.
4. When the document is final, change its status to Approved and set the next review date.

Read next: "Documents".

Step 4: Collect evidence

Evidence is the proof that a requirement is being met: files, links and notes. Each evidence item is linked to the objectives it supports, so an auditor can follow the chain from requirement to proof.

To add some, in the sidebar go to your framework section and select Evidence. Then:

1. Select Create evidence, then Manual evidence.
2. Enter a name, then use the chips to set the owner, assignee, schedule and objectives. Choose Perform once, or Set repeating schedule for evidence you need to collect again and again.
3. Select Save.
4. Upload the files with the upload icon on the evidence row.

Evidence that comes from a connected tool is collected for you (see step 6).

Read next: "Evidence".

Step 5: Track what needs fixing

Plan of Action is your Plan of Action and Milestones. It lists the action items you are tracking for remediation, who owns each one and when it is due. It answers the question an auditor asks: what is weak, and what are you doing about it?

To review it, in the sidebar go to your framework section and select Plan of Action. You can:

• Open an item to set its owner, priority, planned dates and milestones.
• Change an item's status from the list.
• Select Create POAM to add a new item. Tick Include this action item in POA&M so it shows on this page.

Read next: "Plan of Action".

Step 6: Watch your connected tools

Monitor shows the data that your connected tools bring into ControlMap: automated compliance checks, assets, vulnerabilities and user accounts. It is how your program stays up to date between audits.

To use it, in the sidebar select Monitor, in the top group above the framework section. Then:

1. Open the Integrations tab and select Add Integration to connect a tool.
2. Once the first scan has run, review the Dashboard and Compliance Checks tabs to see what is passing and what is failing.

Read next: "Monitor", then "Connect an integration".

Step 7: Run an audit

An audit turns a framework into a list of data requests, one for each requirement. You gather the evidence for each request and send it to your auditor, who reviews it and approves it.

To run one, in the sidebar go to your framework section and select Audits. Then:

1. Select Create Audit and choose Audit a framework, Audit a control set or Third party audit.
2. Enter the audit name, the owner, the auditors and the start and end dates, then select Create audit.
3. Open each data request, make sure the evidence is attached, and set its status to Completed.
4. Select Submit to auditor. The request needs an auditor assigned first.
5. When all requests are done, open the audit's row menu and select Mark completed.

Auditors must already exist as users with the Auditor role before you can assign them.

Read next: "Audits".

Keep the program current

A compliance program does not end with the audit. Keep these pages in view:

• Overview, in your framework section: how far along you are, by status.
• Risks and Controls, in the Manage group: these cover your whole company, not just one framework.
• Reports, in your framework section: the reports you can generate.

Read next: "Find your way around the new experience", "Risks", "Controls" and "Reports".