Frameworks describe what controls must achieve, and each organization designs its own to meet them. A control is only demonstrable if it leaves evidence each time it operates.
See control mapping and audit evidence.
Read more
Related terms
- Control mapping
- Control mapping is linking each control to every framework requirement it satisfies, so one control and its evidence serve several frameworks at once.
- Compensating control
- A compensating control is an alternative control that addresses a risk when the expected control cannot be implemented as described.
- Audit evidence
- Audit evidence is the record that a control operated as described, such as an approved change ticket, an access review record or a restore test result.