Adopting Frameworks

Overview

Once you are running Controls, a framework organizes them against a specific standard. Adopting a framework maps your controls to that standard's requirements, shows you where you are covered and where you have gaps, and lets you run an audit with outside auditors.

Concord supports these frameworks:

• SOC 2
• ISO/IEC 27001
• ISO/IEC 27701
• ISO/IEC 42001
• NIST AI Risk Management Framework
• NIST Privacy Framework
• GDPR
• CCPA/CPRA
• HIPAA Security Rule
• PCI DSS
• CMMC 2.0 Level 1
• SOX

Frameworks are a paid add-on to a Premium or Enterprise Trust plan. You buy them as framework packs sized to how many frameworks you want to run at once. See pricing.

Adopting a Framework

1. Go to Data Hub → Controls & Audits → Frameworks and choose Add Framework.
2. Pick the framework, and choose how many of its controls to bring in: Recommended, Advanced, or Custom.
3. Choose Adopt Framework. If you need a framework pack first, choose Buy & Adopt to buy it and adopt in one step. If you don't manage billing, you'll see Go to Billing instead.

Adopting a framework brings in the standard's requirements and computes coverage, so controls you already maintain immediately count toward the new framework.

Buying or Changing a Framework Pack From Billing

You can also manage your pack from Global Settings → Billing: on your Trust plan, choose Manage Add-Ons, and pick a pack size under Framework Packs. When you change pack sizes, the difference is prorated and applied to your next invoice.

Reading Coverage

Open an adopted framework and go to Coverage to see its requirements and the controls mapped to each one. Each requirement is Covered, Partial, Not Covered, or N/A, and you can filter by status. Work the gaps by adding or fixing the underlying controls and their evidence; coverage updates as your controls do.

Framework Status

Each adopted framework has a status you set on its Details tab: Planning, Active, Audit In Progress, Attested, or Archived.

Archiving a Framework

To stop running a framework, set its status to Archived on the Details tab. Archiving keeps your history and evidence. If you adopt the framework again later, it comes back with that work intact.

If you remove your framework pack entirely, framework pages are locked until you add a pack again.

Next Steps

• Auditor Access: set up an audit and invite your auditor.
• Controls and Evidence: the controls that satisfy these requirements.