Getting started
Concepts
The few ideas everything else rests on: common controls, expected evidence, computed state, score.
Common controls
A common control is a measure ("Management of authentication secrets", for example) that answers several requirements, in several frameworks. You attach its evidence, tests, tasks and risks to it once; they then serve everywhere it applies. The app's catalog holds 164 of them.
This is what saves you from doing the same work for ISO 27001, then for SOC 2, then for the next one. See the Controls page.
Expected evidence
Each control says which evidence is expected of it, and at which frequency it must be renewed. A piece of evidence can be a file, a reference, or the frozen result of a Jira query, with a fingerprint.
Evidence older than its frequency is stale. It counts neither for the control's state, nor for the score, nor for the rule "no closing without evidence". See Evidence.
State is computed, never typed
The state of a control is deduced from what the app knows: implemented or not, evidence current or not, tests passing or not. Nobody sets it by hand. That is what lets you discuss the score with facts rather than impressions.
The readiness score
The readiness of a framework is the share of applicable requirements held by controls in place, a half-held requirement counting for half. The detail of the calculation is in The readiness score.
From a finding to a Jira ticket
An assessment brings gaps to light; each gap becomes a task of the action plan, with, if you wish, its Jira ticket in the project of your choice. Statuses stay in step between the app and Jira.
A log you can verify
Every important change is written to the audit log, chained to the previous one by a fingerprint: any edit to the history shows when you verify. See Security and privacy.
Was this page helpful?