Compliance Auditing

Premium Feature

Requires Premium (or Self-Hosted).

Compliance Auditing tracks a workspace against published security frameworks at the objective level. Enable the frameworks that apply, work through each objective in the assessment tree, record a status and notes, attach evidence, and follow progress and gaps.

Supported Frameworks

Framework	Hierarchy	Objectives
HIPAA Security Rule	CFR section → standard → implementation specification	57
CMMC Level 1	Domain → practice → assessment objective	59
NIST CSF 2.0	Function → category → subcategory	106

Every objective carries the verbatim requirement, assessment objectives, examine, interview, and test criteria, background information, examples, considerations, and key references. Each one links to the official publication and to a downloadable copy of the document it was authored from.

Selecting Frameworks

1. Open the Compliance section of your workspace.
2. On the Frameworks tab, click Activate on each framework you need. Any number can be active at once.

Each framework card lists its reference documents with a download link.

To deactivate a framework, click Deactivate and confirm. This removes the workspace's statuses, notes, and evidence links for that framework. Uploaded files stay in the Files tab.

Permissions

Activating and deactivating frameworks, setting statuses, writing notes, and uploading or deleting evidence is available to Owners, Editors, and Remediation Analysts. Viewers can read everything but cannot make changes.

Assessing Objectives

The Assessment tab shows a framework dropdown, a search box, a status filter, and the framework tree. Expand controls and subcontrols in the tree and select an objective to open it.

The objective pane shows, top to bottom:

1. The title, code, and previous and next buttons that step through objectives in tree order.
2. The status dropdown, an optional Responsibility field, and notes, each with its own Save.
3. The evidence list with download and delete, and an Upload evidence button.
4. The requirement, quoted from the official document, with View official source and Download official document links, plus related documents for the framework.
5. The objective content: Assessment Objectives, Examine Criteria, Interview Criteria, Test, Information, Examples, Potential Assessment Considerations, and Key References.

Status values

Status
Not assessed
Compliant
Partially Compliant
Non-Compliant

Notes are limited to 10,000 characters and are encrypted at rest with the workspace's data encryption key. Each save records who made it and when.

Search and filter

The search box matches objective, subcontrol, and control codes and titles. Matching a control or subcontrol keeps everything beneath it. The Show only filter narrows the tree to objectives at one status. Rollup counts on controls and subcontrols always show the full framework, not the filtered view.

Evidence

1. Select an objective and click Upload evidence.
2. Choose a file, then give it a name (required, up to 255 characters) and an optional description (up to 5,000 characters).
3. The file is stored encrypted, linked to the objective, and listed in the Files tab as an evidence document.

Evidence descriptions are encrypted at rest. Deleting evidence removes both the link and the stored file.

Progress

The Progress tab shows, per active framework, the percentage of objectives marked Compliant, counts for each status, and a bar per control. Expand a control to see a bar per subcontrol. Partially compliant objectives do not count toward the percentage.

Gap Analysis

The Gap Analysis tab lists every objective that is not Compliant, grouped by control and subcontrol, with its status and whether evidence is attached. The summary shows total gaps, not assessed, and non-compliant counts. Click a gap to open that objective in the Assessment tab.

Exporting Compliance Data

Export a framework's assessment to CSV from the workspace Export tab. Columns include framework, control and subcontrol codes and titles, objective code and title, status, notes, and evidence count. Every objective is included, assessed or not.