Obligations
Not everything you're on the hook for comes from a framework. A customer contract promises a four-hour incident notification. A regulator requires annual penetration testing. The board directed that privileged access be reviewed quarterly. Your own policy says vendor reviews happen before renewal.
None of those are CMMC or ISO controls, and all of them are real commitments somebody will eventually ask you to prove. The Obligations tab is where they live.
Record an obligation
Click Create Obligation. A Title and a Statement (the plain-English commitment) are required. You can also set a Source, a Status, a Priority, a Jurisdiction such as "US" or "EU", and a Due date.
An obligation's type comes from its source. SolveGRC recognizes fourteen source types: Framework, Regulation, Law, Contract, Customer, Insurance, Privacy, DPA, Trust Center, Policy, Board, Internal, Vendor, and MSP. There is currently no screen for adding sources, so you can only pick from sources that already exist, or leave the obligation with No source.
See what backs it
Open an obligation to see its detail sheet. It lists the Defined Controls and Unified Controls mapped to it, and you can remove a mapping there. There is currently no screen for adding a mapping. The Obligation Coverage widget summarizes how many of your obligations have controls behind them.
An obligation with no control behind it is a promise nobody is operating. Those are worth finding before a customer or regulator finds them for you, and they're the reason to keep this list honest rather than aspirational.
How this connects
- Controls are what an obligation is mapped to — see Assess controls.
- Evidence proves the control behind the obligation — see Evidence overview.