Frameworks

A framework is a published standard with a control set attached. Adopting one brings its controls into your organization, where they get owners, status and evidence.

Adopting a framework

Pick the frameworks you are working towards under Compliance → Frameworks. Adoption is a per-organization decision: the framework and its controls are shared, published data, while everything you record against them is yours.

Removing a framework marks the adoption as removed rather than deleting the work. The evidence and comments you accumulated stay, so re-adopting later picks up where you left off.

Applicability

Not every control applies to every organization. Each control can be marked:

• Applicable — the default; no record needed.
• Not applicable — with a justification.
• Under review — you have not decided yet.

Those decisions are what produce a Statement of Applicability, so the justification matters as much as the flag.

Coverage and readiness

Control status

Each control carries a status you set — not started, in progress, implemented or not applicable — and a derived status computed from the evidence attached to it. The derived one can also be failing, where an automated check exists and says no, or at risk, where the evidence backing it is missing or expired.

Framework readiness

Readiness rolls up from the controls: a percentage plus a qualitative state — passing, partial, failing, needs evidence, stale or not applicable. A control counts as passing above an 80% readiness threshold, and only if the evidence types marked required for it have been validated.

The gate matters: a control can be 90% covered and still not pass because a required piece of evidence has never been reviewed.

Working a framework

The practical loop is:

1. Adopt the framework.
2. Mark what does not apply, with reasons.
3. Assign owners to what does.
4. Attach evidence, control by control.
5. Watch readiness rise and keep expiring evidence from pulling it back down.

Auditor access

When an audit comes round, invite the auditor and scope the engagement to specific frameworks and a date range. The auditor sees those frameworks, their controls and the evidence behind them — and nothing outside the engagement.