Controls and Evidence

Overview

A Trust Center starts as a place to answer buyers' security questions. Controls turn it into a place to run your compliance program: you add a set of security and privacy controls, give each one an owner, and prove it with evidence that stays current. When you later adopt a framework such as SOC 2 or ISO 27001, the controls you already maintain show which requirements they cover.

Controls are available on the Premium and Enterprise Trust plans. Find them under Data Hub → Controls & Audits → Controls.

What a Control Is

A control is a named requirement you commit to and keep proving. Each control has:

• An owner: the person accountable for keeping it in good standing.
• One or more tests: each test is a single check, the specific thing being proved. A test has a cadence, which is how often its evidence needs refreshing: Continuous, Monthly, Quarterly, Semi Annual, or Annual.
• Evidence: what shows a test is passing. You attach it yourself, or it's collected automatically from connected systems (see Automated Control Checks).
• Two statuses:
  • Implementation status, which you set: Not Started, In Progress, or Implemented.
  • Evaluation status, computed from its tests: Pass when every required test has fresh, passing evidence, Needs Review when evidence is missing or has gone stale, Fail when a test fails, Not Evaluated before any test has run, or N/A.

Adding Controls

Go to Data Hub → Controls & Audits → Controls and open Add Controls to browse the library. Switch between Recommended, Advanced, and All to see more or fewer controls, then choose Add Control on the ones that fit your program, or select several and add them together. If a broader control you've already added covers one, you'll see Add Anyway.

You can run Controls on their own, before adopting any framework. They document your posture and can be published to your public Trust Center.

Adding Evidence

Open a control, go to its Evidence tab, and choose Add Evidence. You can:

• Document: attach a document from your library.
• Upload File: upload a file.
• External Link: link to evidence that lives somewhere else.

For controls that depend on your cloud infrastructure, connect your accounts and Concord records check results as evidence automatically. See Automated Control Checks.

Team members with a Limited role can add evidence to controls and comment on them, without being able to change the control itself. See User Roles & Permissions.

When a Test Fails

When a required test fails, Concord opens a task for the fix. A failure someone records by hand opens a task right away. An automated check has to fail twice in a row before it opens a task, so a one-off blip doesn't create noise. When the test passes again, the task is resolved.

Recording an Exception

When a control has a deficiency you're handling another way, choose Add Exception and record how it's being handled. An exception is Open, Remediated, or Accepted. Exceptions annotate a control's status for auditors; they never hide a failing result. An open exception on a single test closes itself when that test next passes. Accepted exceptions, and exceptions that cover the whole control, are closed by hand.

The Controls Dashboard

The Controls dashboard shows your program at a glance: how many frameworks and controls you have, the share of controls implemented, your pass rate, charts of control status and evaluation results, and the controls due for review soon. Use it to see where evidence has gone stale before an auditor or a buyer does.

Publishing Controls to Your Trust Center

You can publish controls to your public Trust Center so buyers can see the posture you maintain, not just the certifications you hold.

1. Open your Trust Center and go to its Controls settings.
2. Choose which controls are Public. You can separately choose which ones feed AI answers to questionnaires and RFPs.
3. Optionally turn on Show In-Progress Controls.

By default, only implemented controls with a passing check appear. With Show In-Progress Controls on, controls you're actively working on also appear, marked In Progress. Failing, unverified, and not-yet-implemented controls never appear. Each published control shows when it was last updated.

Next Steps

• Adopting Frameworks: map your controls to SOC 2, ISO 27001, and other frameworks, and see requirement coverage.
• Automated Control Checks: connect AWS, Microsoft Azure, or Google Cloud to test controls automatically.
• Auditor Access: give an auditor scoped, time-boxed access to review an audit.