The security controls register lists the measures that protect personal data, such as encryption, access limits, logging and backups. Each measure has an owner, a checking cadence, and evidence. Measures mapped to a framework count towards its coverage. A measure that fails pulls down every requirement resting on it.
Who can do this
An owner, editor or contributor of your workspace can add measures, change them and record evidence. A viewer can read the register.
Find the register
Open Records & controls → Security controls. The figures at the top include In force, Partly there or unverified, Failing or missing and Ever tested. Measures that are not protecting anything, and measures that are claimed and unverified, are listed first.
Add a measure
Press Add a measure.
- Under Control details, say What it is and What it prevents.
- Under Control type, choose Keeping it unreadable, Limiting who can see it, Knowing what happened or Getting it back.
- Under Ownership & review, choose Who owns it and How often it gets checked: Every 3 months, Every 6 months, Every year, or Never — assumed to work.
- Under Independent testing, answer whether somebody other than the person who operates it has tested it. If Yes, somebody has, give the date under Tested on. If nobody knows when, choose Not yet.
- Under Evidence summary, describe What you could show an auditor.
Press Add the measure.
A measure nobody has tested is recorded as assumed, however it was entered. An auditor will not rely on it until someone owns it and tests it.
On the measure
The page shows Who owns it, Last tested, Checking cadence and the Evidence description, the requirements it satisfies, and the frameworks it counts under. If a requirement fails on this measure alone, the page says so. Fixing it closes that requirement by itself.
To give it an owner or correct it, use Give it an owner, or Change this record under History and corrections. The register keeps its history, so nothing overwrites anything.
Record evidence
Press Record evidence for it.
- Say What it is, for example a firewall rule export.
- Choose How well it is attested:
- Read from a system: you read it out of the system itself, such as an export or a console screen.
- Shape checked, not the fact: you checked the setting exists, not that it is doing its job.
- Somebody said so: nothing has been looked at.
- Named, and not there: it was asked for and nobody could produce it.
- Optionally say Where it is: a file name, a link, or its place in the evidence library.
Press Record it. It is recorded with your name and today's date. The level is your claim, and nothing checks it.
Common questions
"Why does an owner matter so much?" A measure with no owner has nobody to ask when it stops working. That is usually how one moves from in force to failing without anyone noticing.
"Does the evidence description count as evidence?" It is a recorded description. Attach or record the evidence itself separately.