Controls is your register of security measures: what you do to treat your risks, who is responsible, and how far each measure is. It is the base for your readiness score and the Frameworks page.
How to add a control
- Open Controls in the menu, then Add control.
- Fill in Control (a short name), Description, Category (Organizational, People, Physical or Technological), Owner and Status.
- Under Framework reference, enter codes only, for example ISO 27001 A.5.15 or NIS2 21(2)(d).
- Set a Next review date if the control should be checked regularly.
- Click Save control. It gets a number such as C-12.
To start quickly, click Add NIS2 measures: this adds the ten measures of NIS2 Article 21(2) that are not yet in your register. You can also add ready-made controls from Library.
How to follow and link controls
- Change the Status as the work goes on: Not started, In progress, Implemented or Not applicable. The page shows how many are implemented; not applicable ones are not counted.
- On a control's page, choose the Risks it treats and click Save links.
- Proof such as documents or certificates is added in Evidence, where you choose the Control it supports; it then shows on the control's page.
What members can do
Members can see all controls and add new ones. Changing, linking and deleting controls needs an owner or admin (or a custom role with that permission).
Tips
- Controls with a Next review date appear in Tasks as Control review. When the date has passed, the control's owner gets one reminder (or the owners and admins if no owner is set).
- Every change is recorded in the audit log and shown under History. Numbers are never reused, even after a delete.
- Package limits: Free 25 controls, Supplier 60, Professional and higher unlimited.
On a control, Add evidence attaches proof, Automatic evidence shows results of automatic checks, and Check a document with AI compares a document with the control (this uses credits).