Skip to main content

Controls and evidence

A parsed diagram is a picture of your infrastructure. This page is about turning it into proof: which controls each element supports, which cloud assets corroborate it, and the approval that registers the whole thing as evidence with an integrity hash.

Control suggestions​

After parsing, SolveGRC proposes controls for the diagram's elements, one pass per framework you have activated, choosing from that framework's real assessable controls so every suggestion can later become an evidence link. The rule it works to is narrow on purpose: an element is mapped only where it genuinely supports the control. A firewall evidences segmentation and boundary controls, a VPN evidences remote-access controls, an intrusion detection system evidences monitoring and detection, a database evidences the data-at-rest controls it enforces access to; identity elements map to access-governance controls. At most three controls per element, nothing below 50% confidence, and a one-sentence rationale that cites the element's type, zone and name.

Nothing is confirmed for you. Suggestions arrive as pending on the Controls tab under the diagram, grouped by node with the reference code, title, rationale and confidence. Confirm or dismiss them one at a time or select several and act in bulk; filter by pending, confirmed or dismissed. Generate re-runs the suggester once the diagram is approved. The Controls Summary above the list counts confirmed, pending and dismissed mappings, how many confirmed ones are linked to evidence, node coverage, and the spread by framework and node type.

Mapping by hand​

Two ways to add what the suggester missed:

  • Add Control Mapping (bottom of the Controls tab) picks a framework, a control and a node and requires a rationale. Manual mappings are confirmed at once and marked as manual.
  • Link to Control, from a node's quick-info popover, from the Evidence menu, or with several nodes selected (Ctrl+M toggles multi-select), opens the linker: pick a framework, search controls by code or title, choose a link strength (primary, supporting, partial, compensating) and add an optional rationale. Connections and zones can be linked the same way.

The Evidence menu in the toolbar also toggles the evidence badges drawn on nodes that carry mappings and the Node Evidence panel (Ctrl+E), which lists the controls linked to the selected nodes and lets you remove them.

Asset corroboration​

Asset Corroboration on the diagram's Evidence tab matches diagram nodes to the cloud inventory discovered by Cloud Posture. A corroborated node is evidence backed by live infrastructure, not just a drawing. The matcher is deterministic and explains itself: a match needs a compatible cloud service for the node's type (a database node against a database service, a load balancer against a load balancer) plus a name or hostname signal, every suggestion states its reason, and an ambiguous tie produces no suggestion. Find matches runs it; it also runs on its own after parsing.

Confirm or reject each suggestion. Once both ends of a connection are confirmed, that connection is projected into the shared dependency graph that continuity planning reads, so the diagram starts informing business impact analysis as well as compliance.

Approving the diagram​

Approve appears once a diagram is parsed and all edits are saved. It:

  1. computes a SHA-256 integrity hash over the topology as approved;
  2. stores the topology and diagram source as artifacts;
  3. registers an evidence item in the Evidence Locker, "Network Topology: your diagram's title", carrying the hash and the node, connection and zone counts;
  4. records a version in the diagram's history marked as the approval.

The Overview tab then shows the evidence link, the hash (click to copy) and the approval time. Any later change to the topology is a new version; the approved evidence keeps the hash of what was approved.

With the diagram approved, Link to Evidence on the Controls tab creates an evidence link from the diagram's evidence item to every confirmed control. Links arrive pending validation. Where a control's reference code cannot be resolved to exactly one framework control, the link is skipped and the reason is written onto the suggestion so it does not vanish quietly.

The Evidence Links list shows each link with its control, type, confidence and status, and who validated it. Validate (with optional notes), Reject (a reason is required) or Reset to Pending, singly or for up to 50 links at once; every decision lands in the audit log. Filter by pending, validated or rejected. These are the links that count toward the control's evidence in Frameworks.