Control Library

The Control Library is firm-wide reference data — shared across every client and engagement, not tied to any one tenant. It’s where a Firm Administrator builds the master catalogue that engagements are later scoped against. It lives at /controls, /standards, and /evidence-types.

Controls

A Control is a single, assessable IAM practice (e.g. “Enforce MFA for all privileged accounts”). Each control belongs to exactly one pillar.

Field	Description
ID	System-formatted as `PILLAR-NNN` (e.g. `AUTH-001`), generated to match the control’s pillar.
Pillar	One of `Authentication`, `Governance`, `Lifecycle`, `PAM`.
Description	What the control requires.
Maturity descriptors	Five required descriptions, levels 1–5, written specifically for this control — there is no single global definition of “level 3”; each control author defines what each level looks like for that control (a CMMI-style scale, tailored per control). This is what assessors read when choosing a rating later.
Scoring weight	A positive number reflecting this control’s relative importance in weighted score calculations.
Evidence types	At least one required Evidence Type, marking what kind of proof is expected to support a rating of this control.
Status	`Active` or `Retired` — retiring a control is one-way; it can’t be reactivated.

Because maturity descriptors are authored per control, take care when writing them — they are the rubric an assessor will actually use when rating.

Standards & Standard Versions

A Standard (e.g. “NIST SP 800-63”) represents an external framework: its canonical name, issuing body, and description. Standards evolve, so each one has one or more Standard Versions (e.g. “Rev. 3”), each with its own version label, optional publication date, and a status of Active or Superseded.

Each version is broken down into Standard Controls — the individual clauses or requirements of that framework version (reference code, title, description) that your own Controls get mapped against.

Only Active standard versions can be selected when scoping a new engagement.

Evidence Types

An Evidence Type describes a category of proof (e.g. “Access review report”, “MFA configuration screenshot”). Fields:

Name and description
Default freshness window (in months) — how long evidence of this type stays “current” before it’s flagged stale. If left blank, a 12-month default applies.
Status: Active or Inactive

Every Control must be linked to at least one Evidence Type at creation, so assessors know what to collect when they start rating it.

Mappings

A Mapping links one Control to one Standard Control (a specific clause of a specific standard version), with:

Mapping strength — Full or Partial. This directly affects scoring: a full mapping earns 100% credit toward that standard’s compliance score, while a partial mapping earns a fraction set by the firm-wide Scoring Configuration.
An optional rationale explaining the mapping.

A control can map to multiple standard clauses across different standards — this is how one assessment produces compliance scores against several frameworks at once.