📋 GRC compliance for CMMC 2.0, CPCSC, CPA Canada, IIROC…SaaS discovery for data governanceFree enriched web chat widget🚀 Enriched remote support without your laptop

Run your first compliance assessment

Choose your frameworks, record who holds each role, and work through your first compliance assessment to sign-off.

A Lavawall® task guide: 7 steps across 5 console pages.

Before you start

  • Who can do this: Anyone with a GRC role that can view compliance data; running checks and asking for exceptions needs edit rights; approving exceptions needs an approver
  • Plan: GRC Compliance Platform (included in Complete). See pricing.
  • Where to start: open Automatic Compliance Checks in your console.
Seven steps: enable a framework, record who holds compliance roles, start a unified assessment, answer questions and attach evidence, run automatic checks for live evidence, send the assessment for sign-off, and, for MSPs, compare clients in the portfolio.
The same steps are listed below, with links to each page's article.

Steps

  1. Enable your frameworks. Pick the level and a target date

    Choose which security, privacy and industry frameworks apply to your organization, at what level, and by when you want to be compliant.

    From the article: How to enable a framework

    1. Search for the framework or use the region filter.
    2. Turn on the switch on its card.
    3. If the card shows Implementation Level, choose the level you are aiming for. Select Compare all levels to see what each adds.
    4. If it shows Audit Scope, tick every scope that applies.
    5. Optionally set a Target compliance date.

    Open Compliance Frameworks in your console →

  2. Record who holds each role. Privacy Officer, external auditor

    Keep one list of everyone who holds a compliance role, such as your Privacy Officer or external auditor, whether or not they have a console login.

    From the article: How to assign a compliance role

    1. Select Set GRC roles (the star icon) on the person's row.
    2. Choose one or more roles. Hold Ctrl (or Cmd) to choose more than one.
    3. Select Save roles.

    Open Compliance Contacts in your console →

  3. Start a unified assessment. Answer each control once for all frameworks

    Work through a compliance questionnaire, answer each control once, attach evidence, and get the result signed off.

    From the article: How to start an assessment

    1. Select New Assessment.
    2. Choose Start Unified Assessment to cover all your enabled frameworks at once, or select one questionnaire below.
    3. Enter an Assessment Name (for example "Q1 2026 CIS Assessment") and an optional Due Date.
    4. Select Create & Start.

    Open Compliance Assessments in your console →

  4. Answer and attach evidence. Use Findings to see the gaps

    From the article: How to attach evidence

    1. On the question, select Attach Evidence and choose the file.
    2. The file appears under the question. Remove it with the bin icon if you added the wrong one.

    Open Compliance Assessments in your console →

  5. Run automatic checks. Live evidence from connected data

    Test your controls against live data Lavawall already collects, see exactly which accounts or devices fail, and keep a dated history an auditor can rely on.

    From the article: How to run the checks

    1. Select Run all checks, or the play button on one check's row.
    2. Wait for the message to finish; the table and tiles update.

    Open Automatic Compliance Checks in your console →

  6. Send for sign-off. An approver signs it off and it locks

    From the article: How to send for sign-off and sign off

    1. When every question is answered, select Send for sign-off. The assessment cannot be changed while it waits.
    2. An approver selects Sign off to lock it, or Return for changes. The sender can Withdraw it.
    3. A signed-off assessment can be unlocked by someone allowed to do so, which records who did it.

    Open Compliance Assessments in your console →

  7. MSPs: compare clients. Filter to 'Needs attention'

    See the compliance position of every client you manage on one page, and spot the ones that need attention first.

    From the article: How to find the clients that need attention

    1. In the filter, choose Needs attention (any issue).
    2. Sort by Readiness or Overdue tasks.
    3. Select a client's name to open its compliance dashboard.

    Open Client Compliance Portfolio in your console →

When you are done

The assessment is answered, evidenced, and signed off, and MSPs can compare it with their other clients.

Articles for the pages in this guide

  • Automatic Compliance Checks: Test your controls against live data Lavawall already collects, see exactly which accounts or devices fail, and keep a dated history an auditor can rely on.
  • Client Compliance Portfolio: See the compliance position of every client you manage on one page, and spot the ones that need attention first.
  • Compliance Assessments: Work through a compliance questionnaire, answer each control once, attach evidence, and get the result signed off.
  • Compliance Contacts: Keep one list of everyone who holds a compliance role, such as your Privacy Officer or external auditor, whether or not they have a console login.
  • Compliance Frameworks: Choose which security, privacy and industry frameworks apply to your organization, at what level, and by when you want to be compliant.

Still need help?

Search the support centre, or contact our support team and tell us which step you are on:

← All task guides

We use privacy-friendly, cookieless analytics to count visits, and one cookie to run our live chat. Both load only if you accept. We do not use advertising trackers, and we do not profile you across other websites. The essential cookies that keep the site working are always on. See our privacy policy.