Module Overview
The Compliance Management module enables organizations to assess and monitor compliance against industry-standard frameworks and regulatory requirements.
What is Compliance Management?
The Compliance Management module provides a structured approach to managing regulatory and standards compliance. Organizations can activate built-in frameworks (ISO, COBIT, NIST, etc.), create custom frameworks, and assess their compliance posture against each framework's control requirements.
Framework Library
Pre-loaded regulatory and standards frameworks ready for activation
Framework Activation
Enable or disable frameworks per organization with automatic control population
Compliance Scoring
Measure compliance percentage against each activated framework
Custom Frameworks
Create organization-specific frameworks for unique regulatory requirements
Compliance Management Workflow
Key Features
Multi-Framework Support
Manage multiple frameworks simultaneously. Each framework operates independently, allowing organizations to track compliance against multiple standards concurrently.
One-Click Activation
Activating a framework automatically populates the Control Library with all associated controls, eliminating manual setup.
Visual Compliance View
Each framework displays a compliance overview with control status breakdowns, making it easy to identify gaps and prioritize remediation.
Custom Framework Builder
Create bespoke compliance frameworks for organization-specific regulations, industry standards, or internal policies.
Framework Library
Built-In Frameworks
The system comes pre-loaded with industry-standard frameworks stored in the platform_frameworks table. These frameworks include control definitions in the platform_controls table that map to each framework's requirements.
| Framework | Description | Controls |
|---|---|---|
| ISO 27001 | Information security management system requirements | Pre-defined |
| COBIT 2019 | IT governance and management framework | Pre-defined |
| NIST CSF | Cybersecurity framework core functions | Pre-defined |
| SOX | Sarbanes-Oxley financial controls compliance | Pre-defined |
| PCI DSS | Payment card industry data security standard | Pre-defined |
| Custom | Organization-defined frameworks | User-defined |
Data Source
Frameworks are stored centrally in platform_frameworks and linked per-organization through the organization_frameworks junction table.
Framework Activation
How Activation Works
Framework activation is managed through the frameworks.php administration page. Only users with admin_settings_edit permission can activate or deactivate frameworks.
| Action | Process | Result |
|---|---|---|
| Activate | Inserts record in organization_frameworks and copies all platform controls to the organization's Control Library |
Framework appears in compliance dashboard; controls become testable |
| Deactivate | Deletes record from organization_frameworks and removes associated controls from the organization's Control Library |
Framework removed from compliance view; controls removed |
Compliance Assessment
Viewing Compliance
The view_framework_compliance.php page displays the compliance status for each activated framework, including overall compliance percentage, control status breakdown, and direct navigation to manage individual controls.
Compliance Assessment Cycle
Framework
Controls
Compliance
Gaps
Continuous Monitoring
Regularly reassess controls through the Control Library's testing cycle to maintain an accurate compliance posture.
Custom Frameworks
Creating Custom Frameworks
Organizations can create their own compliance frameworks for industry-specific regulations, internal standards, or client requirements through the frameworks.php administration page.
- Name & Description - Define the framework identity
- Custom Controls - Build controls specific to your framework requirements
- Organization-Scoped - Custom frameworks are visible only to your organization
- Full Lifecycle - Same assessment, testing, and reporting capabilities as built-in frameworks
Use Cases
Custom frameworks are ideal for client-specific compliance requirements, industry body regulations not in the standard library, internal governance standards, and specialized jurisdictional regulatory requirements.
Module Integrations
Control Library
Framework activation populates the Control Library with framework-specific controls. Control test results directly feed into compliance scores.
Audit Management
Compliance gaps can trigger audit engagements. Audit findings may reference specific framework control requirements.
Risk Management
Non-compliance with framework requirements represents a risk. Gaps can be linked to risk scenarios for integrated risk management.
Policy Library
Policies implement framework requirements. Acknowledgment tracking provides evidence of compliance with people-process aspects of frameworks.
Best Practices
Start with Relevant Frameworks
Activate only the frameworks that apply to your industry and regulatory environment to avoid unnecessary administrative overhead.
Regular Reassessment
Schedule periodic control testing cycles. Compliance is dynamic and should be reassessed at least quarterly for critical frameworks.
Link to Risk Register
Connect compliance gaps to risk scenarios to demonstrate the business impact of non-compliance and prioritize remediation.