Controls

One library, four pillars

The control library is the same across the platform, partitioned into four pillars: cyber, privacy, continuity, and AI. The Cyber Risk controls screen shows the cyber slice — the 107 controls native to NIST CSF 2.0 — with the maturity your organization declared in its self-assessment.

It is a shared reference table: the controls are the same for every organization. What is yours is the answer, the evidence, and the resulting maturity.

What maturity feeds

A control's maturity does not stay on this screen. It is the vulnerability component in every asset's risk, it is the basis for the residual of risks that relate that control, and it feeds adherence per regulatory requirement. One answered control moves three things.

Cross-coverage

Thirty-three of the cyber controls carry a cross-coverage note: the answer given there also serves as evidence for an equivalent control in another pillar. That is what avoids asking the respondent the same thing twice, without leaving the second pillar unanswered.

CVSS per control

Each control carries a severity weight that scales likelihood when it is answered NO. Controls with no severity data enter at the default value, and privacy controls use a fixed synthetic weight — because a legal obligation has no CVE, and therefore no technical severity to look up.