Frameworks and controls
One control library, scored and tracked against each framework.
Every control has a framework, an owner and an implementation status. Here is how the library is built, how progress is measured, and where your cyber expert steps in.
Multi-factor authentication for remote access
Example- Framework
- NIST CSF 2.0
- Owner
- IT Manager
- Implementation
- Mostly implemented
- Reviewed with
- Your cyber expert
Anatomy of a control
What every control carries.
The framework’s own reference. Each control keeps the identifier printed in its source framework, so what you show an auditor matches the publication.
An owner, a status and a justification. These are yours to edit, along with notes and guidance.
A history. A timeline records who changed what and when.
Scoring
How progress against a framework is measured.
Each control has an implementation status, and the statuses roll up into one compliance percentage per framework. The starting point comes from your risk assessment. You and your cyber expert can adjust it, and the platform marks any override.
Implementation status
- Fully implementedIn place and working.
- Mostly implementedLargely in place with small gaps.
- Partially implementedSome of it in place, with real work left.
- Not implementedNothing in place yet.
- Not applicableDoes not apply to your business, so it is left out of your compliance status.
From statuses to one percentage
Example- MFA for remote accessFully implemented
- Quarterly access reviewsFully implemented
- Logging reviewed weeklyMostly implemented
- Vendor reviews before onboardingPartially implemented
- Physical access to the data roomNot applicable
The statuses roll up into a single compliance percentage for the framework. A control that does not apply is left out, so it neither helps nor hurts.
The same treatment drives the compliance status shown on your dashboards, and the lowest-scoring controls are flagged as at risk. See reporting and dashboards.
Mapping
Where the framework link shows up.
The framework link connects controls, policies, evidence and issues, so one piece of work counts everywhere it applies.
Controls
A control can point to related controls in other frameworks, so work recorded once can be traced to more than one. Your cyber expert confirms the coverage for your frameworks at kickoff.
Policies
A policy can be tied to a framework and linked to the controls it supports.
Documents
Each evidence document can be tied to a framework and a control.
Issues
When VectraIQ drafts an issue, it suggests the best-fit framework and control, which you can change.
A framework appears in your account once a risk assessment has been completed for it. The full buyer-facing list, and what readiness looks like for each, is on the frameworks page.
Day to day
The control list, day to day.
A few summary figures sit above a searchable list of every control.
How many controls
Controls in scope and the frameworks they cover.
Implementation status
The share that are fully, mostly, partially or not implemented.
Controls at risk
Controls scoring poorly enough to need attention first.
Average score
Where your control set stands overall.
Search and filter by framework or implementation status, then export what you see.
Who does what
Scores are inputs. People decide what they mean.
VectraIQ and the platform
Scores controls from assessment answers, applies the same status rules to every framework, and keeps dashboards in step with every change.
Your expert team
Confirms which frameworks and controls are in scope at kickoff, reviews overrides and justifications with owners, and decides which gaps to close first.
Evidence and policies attach to these controls, covered under audit and compliance. The same expert-directed model is described in the managed program.
Questions, answered.
Which frameworks are in the library?
The buyer-facing list, including what readiness involves for each, is on our frameworks page. This page covers how the library works once a framework is in your account.
Can I override a control score?
Yes. A control starts with the score from your assessment, and an authorized user can enter a different one. The platform marks any overridden score, so a manual number never passes as a calculated one.
Do vendor assessments add controls to this list?
No. This list shows controls from your own risk assessments. Vendor assessments are handled under third-party risk.
How do scores compare across frameworks?
Every control is scored on the same scale and rated the same way, so one framework’s compliance status can be read next to another’s.
More in the platform
Explore the rest of the platform.
- Risk assessmentsRun a risk assessment, score it, and turn the findings into issues and risks.
- Third-party riskAssess vendors, tier them by criticality and keep watching them between reviews.
- Risk managementA risk register with owners, treatment and progress, rolled up into dashboards.
- Audit and compliancePolicies, controls and evidence kept current, so audit prep is a review.
- Reporting and dashboardsExecutive dashboards and board reports drafted for your cyber expert to finalize.
- VectraIQThe AI inside the platform: ask where you stand, get insights, draft reports.
Do the work once, count it everywhere.
Tell us which frameworks you answer to and a lead expert will show how one control set would cover them.