Platform · Controls and compliance

Every framework requirement is linked to a control, an owner, a test and its evidence.

Frameworks are broken down into requirements. Each requirement is covered by one or more controls worded for the company's profile. Each control has an owner, a periodic test and the evidence that demonstrates it, with a validity date. The status of each framework is calculated from test outcomes and evidence validity.

Let's talk Starting assessment

Data for illustrative purposes only, not real

The problem

01

A gap analysis is a snapshot

Done once a year, it describes the status on that day. Later changes to systems, vendors and people do not appear in it.

02

Controls copied from a template

A generic list does not describe how the company operates, and the auditor asks for evidence of controls nobody performs.

03

Status rebuilt by hand

Establishing where things stand takes days of checks across separate spreadsheets, one per framework.

What it does

Framework requirements, company controls, tests and evidence with expiry dates, in one register.

  • Frameworks broken down into requirements

    NIS2, ISO/IEC 27001, DORA, GDPR, the AI Act and other frameworks, with the text of each requirement in its official form.

  • Controls worded for the profile

    The selection and wording of controls depend on the company's sector, size, systems in use and vendors.

  • Cross-framework mapping

    A control is linked to every requirement it meets: for example, multi-factor authentication covers NIS2 art. 21.2(j) and the corresponding ISO/IEC 27001 Annex A control.

  • Periodic tests

    Each test has a frequency and an outcome. A failed test raises a corrective action with an owner and a deadline.

  • Evidence with validity

    Each evidence item records author, date and expiry. The owner is alerted before it lapses.

  • Change history

    Every change to controls, tests and evidence is recorded with date and author. The status on a past date can be reconstructed.

The outcome

  • A control register with owner, test and evidence for each control
  • The status of each framework, calculated from test outcomes and evidence validity
  • A list of evidence nearing expiry, with date and owner

Related frameworks

Other capabilities

A thirty-minute presentation based on the organisation's scope.

It starts from the frameworks in scope and how the work is organised today. In thirty minutes, EVIDEVO is shown working in that context.

Let's talk