Table of Contents
On the Compliance Dashboard, you can find a visual representation of the frameworks that you are establishing or maintaining compliance against. On your compliance journey, implementing and maintaining controls is a foundational step in earning trust with your customers. Controls are not just a "set it and forget it" measure, rather they are efforts that should be used to continuously monitor the effectiveness of your compliance program. Controls are the backbone of your IT security and data protection efforts.
Criteria need attention when:
The criteria is active AND
The criteria has active, linked controls that need attention or
The criteria has sub-criteria that needs attention or
The criteria does not have any sub-criteria and does not have any active, linked controls
Criteria are satisfied when:
The criteria is active AND
The criteria has all of its active, linked controls satisfied or
The criteria has sub-criteria that are all satisfied
Impact of linked controls
Having controls active and in place help determine whether or not you satisfy specific framework criteria. The status of your control will dictate whether or not a framework criteria is satisfied or needs attention. If a criteria has any active linked control(s) with a needs attention status, then the criteria will also be shown as needs attention. If all of the active linked controls have a satisfied status, then the linked criteria will also have a satisfied status.
In this example, the linked controls under Establishes Requirements for Vendor and Business Partner Engagements for SOC 2 are in needs attention status. Therefore, the criteria is also in needs attention status.
Nested criteria
If a criteria has sub-criteria, it's likely that the parent criteria will not have any linked controls. For this reason, criteria inherit the status of any of their sub-criteria. In this example, Vendor Risk Management criteria has a needs attention status because its sub-criteria have needs attention statuses.
Once a criteria has all of its active linked controls and active sub-criteria satisfied, then the criteria will be satisfied.
Deactivating criteria and nested criteria
You may encounter a scenario where criteria are not applicable to your organization. For example, some HIPAA criteria may be applicable to 'covered entities' and your organization is not one, or some ISO 27701:2019 criteria are applicable to Processors and your organization is a Controller. In these scenarios, the criteria can be deactivated.
Alternatively, you may encounter a scenario where nested criteria may be deactivated so that you have a better sense of what needs attention. This often appears with SOC 2 and can be addressed by understanding the concept of control coverage.
Pro Tip: For SOC 2, it is very rare for a Common Criteria (those found nested under Security, that have a 2-digit number associated with them, for example CC 1.1 or CC 4.2) to be not applicable. It is more likely that a 3-digit criteria will be not applicable. Please contact your Customer Success Manager to discuss this scenario.
If you see a nested criteria that needs attention, open the related controls. If the controls are not applicable to the organization, then it is likely the nested criteria can be deactivated. This can be confusing, so feel free to chat with our Customer Success team to learn more if this scenario is applicable to you.
For example, these physical access controls: Visitor Sign-In, Badge Access System, and Data Center Physical Access, may not be applicable to a SaaS startup, so this nested criteria (Creates or Modifies Physical Access) may be deactivated.
Pro Tip: Remember, inactive criteria and any linked controls and evidence attachments will not be included in an audit export.
Coverage analysis
Your coverage analysis is a calculation of all of your active criteria for the framework. This chart indicates your coverage percentage based on the number of satisfied criteria over your total active criteria. This may include active nested criteria that may be candidates for deactivation (see above).
You can also find this coverage progress in the headers for your framework in the Compliance Dashboard.
Pro Tip: Regularly reviewing your controls to ensure they are operating successfully will help maintain your compliance coverage!