Appearance
Controls & Assurance
What your organisation actually does about its obligations, and how you know it is working.
Pages in this area
| Page | Route | What it does |
|---|---|---|
| Control Register | /controls | The canonical control register |
| Control Crosswalk | /crosswalk | Governed obligation-to-control mappings |
| Control Assessment | /assess | Design, operating effectiveness and testing |
| Evidence Register | /evidence | Manually held evidence artefacts |
| Evidence Fabric | /evidence/fabric | Connections, collectors, runs and assertions |
| Continuous Assurance | /assurance | Indicators and deterministic evaluation |
| Integration Catalogue | /integrations/catalogue | Read-only directory of 22 catalogued integrations (20 available, 2 planned) |
| Security Tool Integrations | /integrations/security-tools | Operational scanner ingestion (Tenable, Nessus, Nipper, Qualys) and report imports |
| Cloud & Identity Discovery | /integrations/discovery | Cloud resource and identity sync (Entra ID, Azure, AWS, Prowler) |
Documentation for this area
| Article | What it covers |
|---|---|
| Controls & Assurance overview | The whole domain |
| Control Register | Fields, origin, lifecycle and good descriptions |
| Control Crosswalk | What a mapping asserts, and what it does not |
| Relationship Types | The eight semantics, with worked examples |
| Crosswalk Import | Importing catalogues as governed proposals |
| Evidence Fabric | The whole evidence graph |
| Indicators | Deterministic rules and immutable results |
| Control Effectiveness | Derivation and mandatory failure gating |
| Integration Catalogue | Catalogue of 22 enterprise integrations, availability statuses, and ship-dark gates |
| Security Tool Integrations | Operational scanner connections, governed report imports, and scanner provenance in Assets & Findings |
| Cloud & Identity Discovery | Cloud resources, Entra ID sync, and projection into assurance scopes |
Scanner & Discovery Provenance into Assets and Findings
Observations ingested from native security scanners (Tenable, Qualys, Nessus, Titania Nipper) and cloud discovery feeds (AWS, Azure, Entra ID, Prowler) project structured provenance across the enterprise:
- Discovered Assets (
AST-): Discovered hosts, instances, and identities flow into the Asset Inventory tagged with discovery source, scanner sensor ID, and last-seen timestamps. Scanner-discovered assets undergo human review (asset.discovery_review) before inventory admission. - Scanner Findings (
SFN-YYYY-NNNN): Vulnerabilities, benchmark deviations, and configuration gaps are ingested as technical scanner findings (SFN-) with immutable scanner provenance (source_scanner,scanner_rule_id, CVSS scores). Through governed triage and promotion, an SFN is promoted to a formal compliance finding (FND-YYYY-NNNN) for action plan remediation or risk acceptance ($\text{SFN} \longrightarrow \text{governed triage/promotion} \longrightarrow \text{FND}$).
The rule that governs this whole area
Mapping a control to a requirement never satisfies the requirement. Evidence existing is not evidence coverage. Coverage is not effectiveness. Effectiveness is not satisfaction.
Permissions and entitlement
- Control Assurance (
control_assurance): Control register, crosswalk, assessment and manual evidence. - Continuous Assurance (
continuous_assurance): Connections, collectors, indicators and automated evaluation. Core GRC works in full without the latter. - Security Tool Integrations (
integrations_security_tools): Operational scanner connections, report imports, and findings triage (integration.read,integration.manage,integration.import,integration.confirm). Ships dark when disabled. - Cloud & Identity Discovery (
cloud_discovery): Cloud resource and identity discovery (discovery.read,discovery.manage). Ships dark when disabled. - Integration Catalogue (
integrations_catalogue): Read-only integration directory (integration.read).