Compliance and controls
One control set, mapped to every framework you answer to, with the evidence collected once.
Compliance in Vendorica is a chain, and each link is a register you can open on its own:
A framework states obligations. Adopting it scaffolds controls — the things you actually do. A control is documented by a policy and proven by evidence. An audit tests whether the proof holds, and anything that does not becomes a finding with an owner and a deadline.
The reason it is worth doing in that order is that the middle link is shared. One control usually satisfies clauses in several frameworks at once, so the evidence behind it is collected once and answers all of them.
In this section
- Adopting a framework
Turning a regime into a control set you can work
- Working with controls
Owners, status, tests and what “needs evidence” means
- Evidence
Uploads, attestations and automated collection — and expiry
- Policies
Drafting, approval, publication and the review cycle
- Audits and findings
Running an engagement, and closing what it raises
- Assets and asset groups
The inventory your control tests are scoped against
- Publishing a Trust Center
Answering the security review before it is sent