📋 GRC compliance for CMMC 2.0, CPCSC, CPA Canada, IIROC…SaaS discovery for data governanceFree enriched web chat widget🚀 Enriched remote support without your laptop

Controls (Control Design)

Work through every control in your chosen frameworks: see its status, owner, design, supporting documents and evidence at a glance, and open any control to write or review its design.

Where to find it
Compliance (GRC) › Controls
Who can use it
Anyone with a GRC role that can view compliance data; setting the engagement and bulk changes need a role that can edit; locking an engagement needs a role that can approve; the CSV export needs a role that can export
Plan
Compliance (GRC) platform
For
Everyone

What the page is for

The Controls page is the working list of the controls that apply to your company. Each row shows the control code and name, implementation status, function and type, how many documents and pieces of evidence support it, whether automatic checks cover it, who owns it and when its next review is due. A coloured dot shows whether its design is approved, in draft or not written yet.

At the top, the engagement bar records what you are working towards, for example a SOC 2 Type I "as at" date or a Type II period. Type I and Type II want different evidence for the same control, so setting the engagement tells each control's detail page which evidence to lead with. Once a report has been issued, the engagement can be locked so its dates and type can no longer change.

A progress bar shows how many controls are implemented, in progress, not applicable or not started, and how many designs are approved, in draft or unwritten. Clicking a control opens its Control Detail page.

What you see

The Controls (Control Design) page, with the engagement bar, filters, progress summary, list tools, bulk bar and control list numbered 1 to 6.
The Controls (Control Design) page. Numbers match the list below.
  1. Engagement bar: the current engagement (name, framework, Type I or II and dates, or "No engagement set"), with Set the engagement or Change, and Lock.
  2. Filters: Framework, the report type, Status, Type, Search, My controls and Review overdue.
  3. Progress summary: the implementation bar and percentage, and design counts: designs approved, drafts, unwritten and "evidenced by configuration".
  4. List tools: a quick filter box, Expand the list and Export this list (CSV).
  5. Bulk bar: with rows selected: Owner, Status and Review schedule, then Apply to selected.
  6. Control list: each control with its design dot, code, name, status, function, type, document, evidence and automatic-check counts, owner and review date.

How to set the engagement

  1. Select Set the engagement (or Change).
  2. In The engagement, choose the Framework and enter a Name.
  3. Choose the Report type (Type I or Type II) and enter the Period start and Period end (Type I uses a single "as at" date).
  4. Select Save. There is one engagement per framework; changing the framework starts a new one.
  5. After the report is issued, select Lock so the engagement's dates and type can no longer change.

How to find the controls you need

  1. Choose a Framework, and optionally a Status and Type.
  2. Tick My controls to see only yours, or Review overdue to see controls past their review date.
  3. Type in the quick filter box to narrow the list further.
  4. Click a control to open its detail page.

How to update many controls at once

  1. Select Expand the list to show the full table with tick boxes (Control, Name, Type, Function, Frameworks, Status, Design, Owner, Review, Docs).
  2. Tick the controls to change.
  3. Choose an Owner, a Status and a Review schedule (every 30, 90 or 180 days, every year, or no schedule). Leave any list on "leave as is" to keep current values.
  4. Select Apply to selected. Select Back to the working list when done.

How to export the list

  1. Set the filters you want.
  2. Select Export this list (CSV). It exports exactly the controls the filters produced, not the whole library.

Tips

  • Filters live in the page address, so a filtered list can be bookmarked or shared.
  • Green, amber and grey dots show approved, draft and unwritten designs.
  • "Evidenced by configuration" counts controls with at least one automatic check mapped to them.
  • Design progress is not the same as implementation: a control can be implemented before its design is written up.

Troubleshooting

  • "Nothing matches these filters." Select Clear them.
  • "No controls are mapped to …" Choose another framework, or clear the framework filter.
  • "No engagement set." Select Set the engagement so the detail pages know which evidence to lead with.
  • Change is greyed out. The engagement is locked, or your GRC role cannot change it.

Task guides that use this page

Still need help?

Search the support centre, or contact our support team and tell us which page you were on.

Names, companies, devices and figures in the pictures are examples. Other product and company names are trademarks of their respective owners.

We use privacy-friendly, cookieless analytics to count visits, and one cookie to run our live chat. Both load only if you accept. We do not use advertising trackers, and we do not profile you across other websites. The essential cookies that keep the site working are always on. See our privacy policy.