Controls and compliance frameworks¶

RiskVault's compliance catalogue connects risks to controls your organization owns and maintains. Those controls, in turn, map to requirements from selected external frameworks. Analysts link the risk once to the relevant organization control instead of repeating ISO, CIS, or other framework tags on every record.

Risk
  └─ linked to a specific version of an organization control
       └─ adopted from an SCF catalogue control, or created in-house
            └─ mapped to requirements in selected frameworks

Understand the terminology¶

Catalogue release

An imported, immutable Secure Controls Framework (SCF) version. New releases are stored beside old ones; they never overwrite historical data. Exactly one release can be active.

Platform control

An organization-owned control with a stable key such as CTL-0042. It may be adopted from SCF or created as a homegrown control. Its published versions do not change in place.

Framework selection

The framework versions your organization currently cares about, such as ISO 27001:2022 or CIS Controls 8.1. Only selected frameworks appear in risk tools and reporting.

Control link

A connection from a risk to an exact platform-control version. The version is pinned so the historical record remains true even after the control changes.

Compliance snapshot

A frozen record of the linked-control framework footprint at a point in time. It records mappings, not proof of effectiveness or a declaration of compliance.

For that reason, RiskVault uses words such as linked, mapped, adopted, and unmapped rather than claiming a requirement is satisfied.

Where controls appear¶

• Risk Edit > Compliance Frameworks contains the editable Linked Controls card.
• Risk Details shows linked controls read-only.
• Catalogue browse pages let authorized users explore source and organization controls.
• Administration > Configuration Hub > Compliance Catalog contains release, framework, control, and cutover management.

Image needed: Risk Compliance Frameworks sub-tab with the Linked Controls card, framework footprint, and snapshot history labeled.

Before linking controls¶

The organization needs an active catalogue release, selected frameworks, and adopted platform controls. A new risk must be saved as a draft before controls can be linked.

Viewing linked controls requires View access to the risk. Changing them requires Edit access and an editable Control Links field in the current workflow state. In the standard workflow, this is normally review and validation work. The server enforces the same rule as the page.

Search and link controls¶

1. Open the saved risk in Edit.
2. Select the Assessment phase, then Compliance Frameworks.
3. In Linked Controls, search by platform-control key, title, domain, or source ID.
4. Review whether the result is an adopted organization control, an unadopted source control, or retired.
5. Select an adopted active control. It appears as an unsaved chip.
6. Add or remove other staged controls.
7. Select Save control links.
8. Confirm the unsaved indicator disappears.

If you leave or reload while the card says Unsaved control link changes, those staged changes are lost.

Image needed: Linked Controls search results with an adopted linkable control, a Not yet adopted result, a retired result, and an unsaved chip.

Browse by framework requirement¶

Use this route when you know a requirement but not the matching control.

1. Change the picker to Browse by framework.
2. Choose one of the organization's selected frameworks.
3. Choose a requirement, such as ISO 27001 5.17.
4. Review controls mapped to that requirement.
5. Add eligible adopted controls.
6. Save control links.

Only active, adopted platform controls are linkable. Retired controls remain visible for context but cannot be newly linked.

Request adoption¶

A source-catalogue control marked Not yet adopted is not yet one of the organization's controls.

1. Review its title, source ID, and mapped requirements.
2. Select Request adoption.
3. Confirm the pending indicator appears.
4. Wait for a control steward to review the request.
5. After adoption, return to the risk, search again, link the new platform control, and save.

Requesting adoption sends work to control stewards; it does not create or link a control automatically.

Review a linked-control chip¶

Select a saved chip to see:

• stable control key and title;
• the exact pinned version;
• requirements mapped for selected frameworks;
• link and version history;
• advisories about changes in the active catalogue.

To unlink, use the chip's remove action and select Save control links. Unlinking closes the active link rather than erasing its history.

Handle version and catalogue advisories¶

Newer version available¶

The organization control changed after it was linked.

1. Review the newer control text and mapping.
2. Decide whether the risk should use the new version.
3. Select Re-affirm on one chip, or Re-affirm all after reviewing every affected link.
4. Confirm the chip now shows the current version.

RiskVault never updates pinned links silently.

No longer in the source catalogue¶

The organization's control remains valid and usable, but its SCF ancestor is absent from the active release. Review the notice and ask a control steward whether a replacement is needed.

Split by the catalogue¶

The source control now has multiple possible successors. RiskVault does not guess. Review the advisory, link the appropriate successor control or controls, save, then retire the old relationship when appropriate.

Framework footprint¶

The footprint summarizes which selected framework requirements the risk currently touches through saved control links. It is read-only and changes when links or mappings change.

Do not interpret footprint coverage as control effectiveness. A mapped requirement can still require testing, evidence, or remediation outside this screen.

Record a snapshot¶

1. Save all link changes first.
2. Review the current framework footprint.
3. Select Record snapshot.
4. Confirm the dated snapshot appears in history.
5. Open it and verify the expected control versions and mapped requirements.

The standard workflow can also record a snapshot automatically during validation. Administrators can change that automation.

Take a manual snapshot after a significant mapping review, after re-affirming controls, or before an audit when a durable point-in-time record is useful.

Troubleshooting controls¶

The modern Linked Controls card is missing

The feature may not be active, cutover may be incomplete, or your organization may still use legacy pickers.

The card is read-only

Confirm Edit access and that Control Links is editable in the current workflow state.

A result is disabled

Not yet adopted controls need steward adoption. Retired controls cannot be newly linked.

My changes disappeared

Staged chips are not saved until Save control links is selected.

A snapshot does not include my new link

Save the control links first, then record a new snapshot.

Re-affirm is available

A newer version exists. Review it before explicitly moving the pinned link.

Administrators and control stewards should continue to Compliance catalogue administration.