Managing Controls

You can add controls from your library to describe the security measures against which you evaluate the inventory item or risk. The controls available in your library are determined by the contents of your organization's Controls Library. For more information, see Managing Control Implementations.

To add custom controls

To help remediate risks, you can create a new control instead of selecting an existing control in the Controls Library. Custom controls can be tailored to address unique risks, requirements, or processes specific to an organization that may not be fully covered by standard frameworks.

  1. On the IT & Security Risk Management menu, select Libraries > Controls Library.
    Note:

    This can also be accessed from the Compliance Automation module.

    The Controls Library screen appears.

  2. Click the Add New button.

    The Add New Custom Control modal appears.

  3. Complete the fields, as needed. For more information, see Create New Custom Control Screen Reference.
  4. Click the Save button to save the new control to the Controls Library . Click the Save and Add New button to save the custom control and immediately add a new custom control.

Create New Custom Control Screen Reference



Field
Description
Control ID Required

Enter a numerical value for the control ID.

Control Name Required

Enter a name for the control.

Status

Select the current status of the control.

Description

Enter a brief description of the control.

Implementation Guidance

Enter guidance to help users implement the control.

Standard / Framework

Choose the standard / framework related to the control.

Category

Select the control category.

To edit controls

You can control the ability to edit control implementation attributes when the control is in the Monitoring stage. This helps to control the changes made to controls once the initial implementation has been completed.

To allow changes to controls in the Monitoring stage, activate the Enable Control Implementations to be Edited When in Monitoring Stage setting in Global Settings. The setting can be located under the Risk & Controls > General menu.

  1. On the IT & Security Risk Management menu, select Controls.
    The Controls screen appears.
    Note:

    This can also be accessed from the Compliance Automation module.

  2. Open the control you would like to edit.
    The Control Details screen appears.

  3. Hover over a field you want to modify and click the Edit icon. Editable fields become available.
  4. Click the Save button.

To delete controls

  1. On the IT & Security Risk Management menu, select Controls.
    Note:

    This can also be accessed from the Compliance Automation module.

    The Controls screen appears.

  2. Click the checkbox for the controls in which you would like to delete.
    Note:

    You can also delete a control by clicking Controls on the IT & Security Risk Management menu and clicking the Context Menu of the control you want to delete. On the Context menu, select Delete Control.

  3. Click the Delete icon.
    The Delete Controls modal appears.

  4. Click the Confirm button.

To update the status of a control

  1. On the IT & Security Risk Management menu, select Controls.
    The Controls screen appears.
    Note:

    This can also be accessed from the Compliance Automation module.

  2. Click the checkbox for the controls in which you would like to update the status.
    Note:

    You can also update the status of a control by clicking Controls on the IT & Security Risk Management menu and clicking the Context Menu of the control you want to update. On the Context menu, select Update Status.

  3. Click the Update Control Status icon.
    The Update Status modal appears.

  4. Select the current status of the control.
  5. Click the Confirm button.

To assign control owners

  1. On the IT & Security Risk Management menu, select Controls.
    Note:

    This can also be accessed from the Compliance Automation module.

    The Controls screen appears.

  2. Click the checkbox for the controls in which you would like to assign the owner.
  3. Click the Assign Owners icon.
    The Assign Control Owner modal appears.

  4. Select the owners assigned to the control.
  5. Click the Save button.

To export controls to Excel

  1. On the IT & Security Risk Management menu, select Controls.
    The Controls screen appears.
    Note:

    This can also be accessed from the Compliance Automation product. Suggested controls will not be included in the export until they are accepted or implemented.

  2. Click the Export button.
    The Report Download modal appears.

  3. Click the Close button.
  4. A task notification will appear when your report is ready for download.

To comment on controls

You can easily share feedback and information on control implementations to improve collaboration with members of your team.

  1. On the IT & Security Risk Management menu, select Controls.
    The Controls screen appears.
    Note:

    This can also be accessed from the Compliance Automation module.

  2. Open the control in which you want to add a comment.

    The Control Details screen appears.

  3. Click the Comments link to open the Comments pane.


  4. Type your comments into the comment pane. You can mention users directly within comments using the icon to trigger both an in-app notification and email notification.
  5. Click the Add button.