Adopting a framework

Compliance → Frameworks is the catalogue. Adopting one is the single action that turns Vendorica from an empty product into one that knows what you are supposed to be doing.

Adopt one

1. Open the catalogue and find the framework you answer to. If you are an EU financial entity, that is almost certainly DORA — and probably ISO 27001 alongside it.

2. Choose Adopt, and set its applicability: which parts of the framework bind you. Not every organization is in scope for every section, and saying so now keeps the control set honest rather than aspirational.

3. Wait for the controls. Adoption creates a control for each requirement in scope. On a large framework this takes a moment; the framework page shows the adoption status — Adopted, Paused or Deactivated.

Controls come from frameworks

You cannot write a control from scratch today. That is deliberate: a control with no citation behind it is a task, and tasks belong in task sets. If your obligation has no framework in the catalogue, author one — the catalogue page has a Create custom framework route for exactly that, with your own citations and objectives.

Then read the citation tree

A framework’s detail page shows its citations as a tree, each one carrying the status of the control behind it — ok, needs evidence, expiring soon, expired. This is the view to use in a readiness conversation, because it is organised the way the auditor’s document is, not the way your internal control library is.

Coverage per framework, all of it drawn from one shared control set.

Why the second framework is much cheaper than the first

Controls are mapped to citations, and one control can be mapped to several. Adopt ISO 27001 after SOC 2 and much of what you have already done answers it — the same access-review control, the same evidence, cited by two regimes.

The crosswalk: evidence collected once satisfies every framework that maps to the control it proves.

Mappings come from three places, and the control’s Framework mappings tab says which: from framework adoption, manually added, or AI suggested. An AI suggestion is a proposal for you to accept, not a mapping already made.

Pausing rather than deleting

If a framework stops applying, pause or deactivate the adoption rather than trying to unpick it. The controls and their evidence stay where they are, which is what you want when a supervisor asks about a period during which it did apply.

What to do next

Open Controls and assign owners. An unowned control set is a list; an owned one is a programme.