93 Compliance help Concepts
Requirements and frameworks
Your list of what policies must handle: from standards, a customer’s questionnaire, your own risk register, or suggestions.
The Risk tests tab holds your company’s list of risks and requirements: the things your policies should handle. It is the yardstick everything else is measured against.
- Standards adds plain-language summaries of SOC 2, HIPAA, PCI DSS, ISO 27001, GDPR or PIPEDA.
- Import takes a risk register or a customer’s security questionnaire, as a file or pasted text.
- Suggest risks proposes risks from what the assistant knows about your company.
- Add one for anything else.
Concept
Two different “requirements”
The Requirements tab is about training: what employees must do each period. Framework and customer requirements live on Risk tests.
Related
Risk tests
Check every risk and requirement against your documents, the way an auditor would, and fix what’s missing.
Customer security questionnaires
Answer a customer’s questionnaire from your own policies, then test your policies against it.
Training: listening, acknowledging, study games
What employees must do each period, how soon, and which audiobook formats count.
More in Concepts
- Policies, drafts and versions
- Requirements and frameworks
- Risk tests
- Controls and the control matrix
- Procedures, runs, steps and evidence
- Training: listening, acknowledging, study games
- Vendors and systems
- Customer security questionnaires
- Discovery: your website and how you work
- “How we really do it” reports