Frameworks and controls

Choose your frameworks

1. Open Compliance. Frameworks are grouped by how likely they are to apply to you, each with the reasons why.
2. Press Adopt (or, for a regulation, decide whether it applies). Say Why: it is recorded with your name and the date, and kept in the framework’s history. You can set a date to look at it again.
3. Press Requirement by requirement to work through it.

Requirement by requirement

• Decide which of these apply to you. A requirement that does not apply needs a reason; that reason is shown beside your coverage on the Trust Center and looked at again after a year.
• Say what covers each requirement: press Map a control. One control can answer requirements in several frameworks, so evidence collected once counts in each.
• Finish the controls you have mapped until the requirement is Settled.

A mapping Trusterio suggests does not count until a person confirms it.

When a control counts

A control covers a requirement only when all five of these hold. Its page says which one is missing:

• Implemented: a check has passed.
• Working: no check is failing now.
• Checked recently: a passing result still inside its validity.
• Evidence attached: a file, or a note of where it lives. A title alone is not enough.
• Mapped to a requirement.

Your readiness

For each framework: the requirements covered, out of those that apply. Overall readiness, on the Overview, is the average of your frameworks. A requirement set aside, with its reason, leaves the count.