A framework is a list of requirements, such as the NDPA's or ISO 27001's. Your controls meet them. Mapping a control onto a requirement is how Asiri knows what covers what. Until something is mapped, a framework is an intention rather than something you are working to.
Who can do this
- Anyone who can edit records, which is an owner, editor or contributor, can map and unmap controls.
- An owner or editor can add a framework of your own and its requirements.
Find it
Open a programme and press Framework & mapped controls. Press All frameworks to see every framework in your workspace.
Read the coverage
Each requirement shows its coverage:
- Met: every control mapped to it is in place.
- Partial: a control is mapped, but not every mapped control is in place.
- Unmapped: nothing is mapped yet.
- Outside your access: mapped to something you cannot see.
Map a control
On a requirement, under Map an existing control, choose the control and press Map control. To undo it, press Remove mapping.
Record your controls first under Records & controls → Security controls.
Add your own framework
If your plan includes custom frameworks:
- On Frameworks, press Map a framework.
- Give What it is called, Who issues it and Version, if it has one.
- Press Map the framework.
- Open it and, under Add a requirement, give each Requirement code and Requirement title. If a clause restates a law, give the Section of law it restates. Press Add requirement.
Most clauses of your own framework are your rule rather than a statute's. Point one at a section only where it restates one. A framework cannot be mapped until its first requirement is recorded.
Common questions
"Do I need to map the NDPA myself?" No. The NDPA is built into Asiri. You map your controls onto its requirements.
"What does a low coverage figure mean?" Work not yet recorded against those requirements. It is not a finding that they have been failed.
"Does mapping a control mean we comply?" No. Mapping does not assert compliance. It records which control answers each requirement.