Frameworks & Controls

The Frameworks module is where you decide which compliance frameworks your organization answers to (CMMC, NIST, CIS, and others from the catalog) and where you watch your standing against each of them. Activating a framework builds a per-control assessment worklist for your organization; working that worklist in the Assessments module produces a compliance score, a gap list, and an evidence trail per framework. Controls sit alongside as the register of what your organization actually implements, mapped back to the framework requirements they satisfy.

The Active Frameworks tab: each activated framework is an expandable row, and expanding one reveals its compliance score card — the percent-compliant headline, the in-scope progress bar, the 'satisfied via crosswalk / evidenced' chip, and the trend sparkline.

The lifecycle at a glance

Compliance work in SolveGRC follows one loop, and each stage has its own page in this guide:

1. Activate and scope. Pick a framework from the catalog and activate it. Activation seeds an assessment for every control in the framework, and the Applicability tab lets you record what does not apply. Approved "not applicable", "scoped out", and "retired" decisions leave the score.
2. Assess controls. In the Assessments module, set a compliance status on each control, attach the evidence behind your judgment, and let AI suggest verdicts you confirm or override.
3. Crosswalks. Requirements that mean the same thing across frameworks are linked through a unified control catalog, so one implemented control can count toward equivalent requirements in other frameworks, through mappings SolveGRC has approved.
4. Prove it. Scores, gaps, and linked evidence flow onward into compliance reports and audit engagements, and controls you mark not compliant can be escalated to the Risk Register as signals.

How this connects

Frameworks is a hub, not an island. It consumes:

• Framework activations you choose from the global catalog.
• Control assessments worked in the Assessments module.
• Evidence links made in Assessments and in each framework's control tree.

From those it produces your compliance score per framework, gap lists, and crosswalk equivalences between frameworks, which feed:

• Compliance reports, for the numbers you show leadership and customers.
• Audit scoping, so an engagement starts from the frameworks you actually run.
• Risk signals from gaps. To track a gap as a risk, use the escalate button on a control marked Not Compliant or Likely Not Compliant (its tooltip reads "Escalate code to the Risk Register for tracking", and you need permission to create risks). It opens Escalate to Risk Register and sends a signal to the Risks Signals tab, where someone links it to a risk or creates one. Setting the status alone does not create a signal.

Two automations do the heavy lifting: activating a framework seeds an assessment for every control it contains, and crosswalks give credit to requirements you haven't assessed directly, when one of your implemented controls maps to them through an approved mapping.

The Controls module completes the picture. It holds the register of controls your organization defines, each with a lifecycle state and its mappings to unified controls. Those mappings are how your controls earn crosswalk credit in each framework.

Before you start

• Access to the modules. Frameworks, Assessments, and Controls each appear in the sidebar only if your role has read permission for them, and activating frameworks or editing controls needs the matching create and update permissions. If something is missing, ask an administrator.
• The right organization selected. Activation always targets the organization you currently have selected, and the confirmation dialog names it before you commit. If you manage several organizations, check the name in that dialog.

Build the evidence base early

Assessments are only as convincing as the evidence behind them. Loading your policies, procedures, and prior audit artifacts into Documents before you start assessing (each processed upload is registered as evidence automatically) means every verdict can carry a link to proof, and the AI analysis has material to reason from.

Frameworks and Assessments are two rooms of one workflow

The Frameworks module is where you activate and read scores; the Assessments module is where the per-control work happens. The Analyze Compliance action on an active framework takes you straight from one to the other.