93 Compliance
← What a control matrix is

Example · the auditor's view in 93 Compliance

A control matrix, from requirement to proof

This is the control matrix 93 Compliance builds for Fernhollow Health, a fictional company we use for demos, for the audit period 2026-10-01 to 2026-12-31. Each row is a requirement. It shows the policy that covers it, the procedures that carry it out, how often they ran in the period, how the latest test rated the documents, and what's missing. Nothing here is made up for the page: it's the demo company's own data as of 2026-11-12, with complete rows listed first and draft/version tags trimmed from document names.

Requirements covered

16 of 39

Standards

7

Policies

8

Procedure runs

2

  • C1.1 · Identifying confidential information (confidentiality)Policy: Acceptable Use Policy; Access Control Policy; Data Retention and Disposal Policy; HIPAA Privacy and Security Policy; Information Security Policy; Remote Work and Device Policy; Vendor Management PolicyProcedures: New Hire Onboarding Procedure; Employee Offboarding Procedure; Quarterly Access Review Procedure; New Vendor Request and Approval ProcedureRuns: 2yellow
  • CC1.1 · Integrity and ethical valuesPolicy: Acceptable Use PolicyProcedures: Employee Offboarding Procedure; New Hire Onboarding ProcedureRuns: 2yellow
  • CC1.3 · Structure and responsibilitiesPolicy: Acceptable Use Policy; Access Control Policy; Data Retention and Disposal Policy; HIPAA Privacy and Security Policy; Incident Response Policy; Information Security Policy; Remote Work and Device Policy; Vendor Management PolicyProcedures: New Hire Onboarding Procedure; Employee Offboarding Procedure; Quarterly Access Review Procedure; Security Incident Response Procedure; New Vendor Request and Approval ProcedureRuns: 2green
  • CC1.4 · Competent peoplePolicy: Access Control Policy; Information Security PolicyProcedures: New Hire Onboarding Procedure; Employee Offboarding Procedure; Quarterly Access Review ProcedureRuns: 2yellow
  • CC1.5 · AccountabilityPolicy: Acceptable Use Policy; Access Control Policy; Incident Response Policy; Information Security Policy; Remote Work and Device PolicyProcedures: New Hire Onboarding Procedure; Employee Offboarding Procedure; Quarterly Access Review Procedure; Security Incident Response ProcedureRuns: 2yellow
  • CC2.2 · Internal communicationPolicy: Acceptable Use Policy; HIPAA Privacy and Security Policy; Incident Response Policy; Information Security PolicyProcedures: Security Incident Response Procedure; New Hire Onboarding ProcedureRuns: 1green
  • CC4.2 · Fixing deficienciesPolicy: Information Security PolicyProcedures: Employee Offboarding Procedure; Quarterly Access Review Procedure; Security Incident Response ProcedureRuns: 1yellow
  • CC5.3 · Policies and proceduresPolicy: Access Control Policy; Data Retention and Disposal Policy; Information Security Policy; Remote Work and Device Policy; Vendor Management PolicyProcedures: New Hire Onboarding Procedure; Employee Offboarding Procedure; Quarterly Access Review Procedure; New Vendor Request and Approval ProcedureRuns: 2green
  • CC6.1 · Logical access securityPolicy: Acceptable Use Policy; Access Control Policy; HIPAA Privacy and Security Policy; Information Security Policy; Remote Work and Device Policy; Vendor Management PolicyProcedures: New Hire Onboarding Procedure; Employee Offboarding Procedure; Quarterly Access Review Procedure; Security Incident Response Procedure; New Vendor Request and Approval ProcedureRuns: 2yellow
  • CC6.2 · User provisioningPolicy: Acceptable Use Policy; Access Control Policy; HIPAA Privacy and Security Policy; Information Security Policy; Remote Work and Device Policy; Vendor Management PolicyProcedures: New Hire Onboarding Procedure; Employee Offboarding Procedure; Quarterly Access Review Procedure; New Vendor Request and Approval ProcedureRuns: 2green
  • CC6.3 · Least privilege and access reviewsPolicy: Acceptable Use Policy; Access Control Policy; HIPAA Privacy and Security Policy; Information Security Policy; Remote Work and Device Policy; Vendor Management PolicyProcedures: New Hire Onboarding Procedure; Employee Offboarding Procedure; Quarterly Access Review Procedure; New Vendor Request and Approval ProcedureRuns: 2green
  • CC6.4 · Physical accessPolicy: Acceptable Use Policy; Access Control Policy; HIPAA Privacy and Security Policy; Remote Work and Device Policy; Vendor Management PolicyProcedures: New Hire Onboarding Procedure; Employee Offboarding Procedure; Quarterly Access Review Procedure; New Vendor Request and Approval ProcedureRuns: 2red
  • CC6.5 · Disposal of assetsPolicy: Acceptable Use Policy; Access Control Policy; Data Retention and Disposal Policy; Information Security Policy; Remote Work and Device Policy; Vendor Management PolicyProcedures: New Hire Onboarding Procedure; Employee Offboarding Procedure; Quarterly Access Review Procedure; Security Incident Response Procedure; New Vendor Request and Approval ProcedureRuns: 2yellow
  • CC7.2 · Monitoring for anomaliesPolicy: Acceptable Use Policy; Access Control Policy; Information Security Policy; Remote Work and Device PolicyProcedures: New Hire Onboarding Procedure; Employee Offboarding Procedure; Quarterly Access Review Procedure; Security Incident Response ProcedureRuns: 2yellow
  • CC8.1 · Change managementPolicy: Acceptable Use Policy; Access Control Policy; Information Security Policy; Vendor Management PolicyProcedures: New Hire Onboarding Procedure; Employee Offboarding Procedure; Quarterly Access Review Procedure; New Vendor Request and Approval ProcedureRuns: 2green
  • CC9.2 · Vendors and partnersPolicy: Access Control Policy; Data Retention and Disposal Policy; HIPAA Privacy and Security Policy; Incident Response Policy; Information Security Policy; Remote Work and Device Policy; Vendor Management PolicyProcedures: New Hire Onboarding Procedure; Employee Offboarding Procedure; Quarterly Access Review Procedure; Security Incident Response Procedure; New Vendor Request and Approval ProcedureRuns: 2yellow
  • A1.3 · Recovery testing (availability)Policy: Incident Response Policy; Information Security PolicyProcedures: Security Incident Response ProcedureRuns: 0yellowno runs in the period
  • C1.2 · Disposing of confidential information (confidentiality)Policy: Acceptable Use Policy; Data Retention and Disposal Policy; HIPAA Privacy and Security Policy; Information Security Policy; Vendor Management PolicyProcedures: New Vendor Request and Approval ProcedureRuns: 0greenno runs in the period
  • CC1.2 · Oversight of securityPolicy: HIPAA Privacy and Security Policy; Incident Response Policy; Information Security PolicyProcedures: Security Incident Response ProcedureRuns: 0redno runs in the period
  • CC2.3 · External communicationPolicy: HIPAA Privacy and Security Policy; Incident Response Policy; Information Security PolicyProcedures: Security Incident Response ProcedureRuns: 0yellowno runs in the period
  • CC3.2 · Risk assessmentPolicy: Data Retention and Disposal Policy; Information Security Policy; Vendor Management PolicyProcedures: New Vendor Request and Approval ProcedureRuns: 0greenno runs in the period
  • CC3.4 · Significant changesPolicy: Data Retention and Disposal Policy; Information Security Policy; Remote Work and Device Policy; Vendor Management PolicyProcedures: New Vendor Request and Approval ProcedureRuns: 0yellowno runs in the period
  • CC4.1 · Monitoring controlsPolicy: Information Security Policy; Vendor Management PolicyProcedures: Quarterly Access Review Procedure; Security Incident Response Procedure; New Vendor Request and Approval ProcedureRuns: 0yellowno runs in the period
  • CC7.3 · Evaluating security eventsPolicy: Incident Response PolicyProcedures: Security Incident Response ProcedureRuns: 0greenno runs in the period
  • CC7.4 · Incident responsePolicy: Acceptable Use Policy; Incident Response Policy; Information Security Policy; Remote Work and Device Policy; Vendor Management PolicyProcedures: Security Incident Response Procedure; New Vendor Request and Approval ProcedureRuns: 0greenno runs in the period
  • CC7.5 · Recovery from incidentsPolicy: Incident Response Policy; Information Security Policy; Remote Work and Device PolicyProcedures: Security Incident Response ProcedureRuns: 0yellowno runs in the period
  • P1-P8 · Privacy commitments (privacy)Policy: Acceptable Use Policy; HIPAA Privacy and Security Policy; Incident Response Policy; Information Security Policy; Vendor Management PolicyProcedures: Security Incident Response Procedure; New Vendor Request and Approval ProcedureRuns: 0yellowno runs in the period
  • A1.2 · Backups and recovery infrastructure (availability)Policy: Information Security PolicyProcedures: —Runs: 0yellowno procedure carries it out
  • CC2.1 · Information for controlsPolicy: Information Security PolicyProcedures: —Runs: 0yellowno procedure carries it out
  • CC3.1 · ObjectivesPolicy: Information Security PolicyProcedures: —Runs: 0yellowno procedure carries it out
  • CC6.6 · Outside threatsPolicy: Acceptable Use Policy; Information Security Policy; Remote Work and Device PolicyProcedures: —Runs: 0yellowno procedure carries it out
  • CC6.7 · Data in transit and removable mediaPolicy: Acceptable Use Policy; HIPAA Privacy and Security Policy; Information Security Policy; Remote Work and Device PolicyProcedures: —Runs: 0greenno procedure carries it out
  • CC6.8 · Malware and unauthorised softwarePolicy: Acceptable Use Policy; Remote Work and Device PolicyProcedures: —Runs: 0yellowno procedure carries it out
  • CC7.1 · Vulnerabilities and configurationPolicy: Acceptable Use Policy; Information Security Policy; Remote Work and Device PolicyProcedures: —Runs: 0yellowno procedure carries it out
  • CC9.1 · Business disruptionPolicy: Information Security PolicyProcedures: —Runs: 0yellowno procedure carries it out
  • A1.1 · Capacity (availability)Policy: —Procedures: —Runs: 0redno policy covers it
  • CC3.3 · Fraud riskPolicy: —Procedures: —Runs: 0redno policy covers it
  • CC5.1 · Choosing controlsPolicy: —Procedures: —Runs: 0redno policy covers it
  • CC5.2 · Technology controlsPolicy: —Procedures: —Runs: 0redno policy covers it

Test colours: green, the documents cover the requirement; yellow, they cover it partly; red, they don't. A gap is what an auditor would ask about: no policy covers the requirement, no procedure carries it out, or the procedure didn't run in the period.

Get your own control matrix

Build your policies and procedures, and 93 Compliance ties them to each requirement for you. The audit package and auditor access are free, with no card.

Start free