Getting started
Set up your first compliance program
Start with an appropriate framework, then assign controls and collect evidence for the work in scope.
Before you start
Who this is for: Owners, administrators, and authorized compliance operators.
- Your organization has been provisioned and your membership is active.
- Agree internally which framework and scope the organization intends to manage.
Follow these steps
Confirm the workspace and people
Open the correct organization and identify the people who will own controls, provide evidence, and review submissions. Give contributors the access needed for their responsibilities. Avoid beginning with uploads before deciding which work they support.
Add the framework
Open Compliance, then Frameworks, and choose Add framework. Review an available catalog framework and any scope choices shown in the enablement screen. Enable only the agreed framework and scope; adding a framework creates organizational implementation work.
Review implementation controls
Open Controls and inspect the requirements linked to each relevant control. Assign responsibility and record implementation information through the available control actions. Use the requirement relationships to understand coverage instead of treating every framework row as a separate activity.
Start evidence work
Open the relevant tests or create an evidence request with a clear assignee and due date. For an eligible document-supply test, use Supply evidence. Review submissions and outstanding work separately; a successful upload alone does not establish approved evidence or complete framework readiness.
What you should see
The program has a selected framework, identifiable implementation work, and a route for collecting and reviewing supporting evidence.
If something doesn’t look right
Add framework is unavailable
Ask an administrator to verify framework-enablement permission. Read access alone cannot enable a framework.
There are no requirements for a new control
Enable the appropriate framework first. The new-control form derives controls from organization requirements.
Progress is lower than expected
Inspect linked controls, test results, and pending evidence reviews rather than interpreting a framework percentage as a certification result.
Still need a little help?
Ask the assistant about these steps, or tell our team where you got stuck.
Contact support