Skip to main content

Frameworks

A framework is the standard you assess against — a regulator's control set, an international standard, an industry programme. Vantage treats every framework the same way whatever country it comes from: a versioned tree of controls, each with a reference, requirement text and (where the publisher provides it) test guidance. The engine has no notion of a "home" jurisdiction; the packs are content.

Where frameworks come from​

  • The bundled library. Packs that ship with the product and load with one click from Frameworks → Browse library. Each pack says who publishes it (authority), where it applies (jurisdiction — a country code, or global), and which languages its control text ships in. A pack whose controls are English-only says so; when you work in Arabic the English requirement is shown with a translation pending marker rather than a blank. Bundled packs are generated from the publisher's workbook, never typed by hand, and the platform's tests check that the numbers on the card match the pack.
Some bundled requirements are marked truncated

A few packs are derived from a published PDF, and a handful of requirements lost the text that continued on the next page. Those controls carry a note — "Requirement text is truncated in this bundled pack — read the publisher's document before grading." — instead of presenting half a rule as the whole rule. Read the publisher's own document before grading one of them. The platform's tests fail the build if a requirement ends mid-sentence without that note.

  • Excel import. Your own or a regulator's workbook in the import template (download it from the Frameworks page). Use this for frameworks the library does not carry, or for internal control sets.
  • YAML import. For frameworks packaged in the intuitem/CISO Assistant format.

Whichever door a framework comes in through, it is global to the instance and importing needs a manager. Browsing the library is not restricted — anyone can open it to see what exists and ask a manager to load a pack.

Versions​

Standards get revised. When a new version of a framework you already have is imported — from the library, Excel or YAML — Vantage keeps both: the new one becomes the latest of the family, the earlier one stays exactly as it was, still backing every engagement that was assessed against it. Nothing is rewritten under a signed-off workpaper.

A framework's page lists the other versions in its family; opening one shows What changed between it and the version you are on, by control reference: controls added, removed, and changed (the requirement text differs, or a control stopped being assessable), plus how many are unchanged and would carry as they are.

Moving an engagement to a new version​

When a framework has moved on, the engagement says so under its name. Open the engagement's ⋯ menu, choose Migrate to version…, and pick the target. Before anything is created the dialog shows what the diff says will happen — how many controls carry as they are, how many need re-assessment, how many were added and removed. A new engagement is created on the new version; the original is untouched.

  • Controls that are unchanged between the versions arrive with their grades, conclusion and observation, in progress — exactly as a period roll-forward would carry them.
  • Controls whose text changed arrive ungraded, with last time's observation as a starting point, and are listed for re-assessment.
  • Added controls start empty; removed ones are listed so nothing disappears silently.
  • Findings are not carried: a version migration is not a new period. Use the roll-forward when you start next year's engagement.

Migrating needs a manager. A completed engagement is the usual place to migrate from — you finish the year on one version and move to the next for the following year — and nothing is written to it, so the signed-off record is untouched. A cancelled engagement cannot be migrated: an abandoned assessment's grades are not a basis to carry forward.

Putting an edition away​

Frameworks are instance-wide: loading one affects every organisation on the instance, and an instance accumulates editions nobody assesses against — a pack loaded to look at, a draft import, a regulation whose successor was never linked to it. Everyone starting an engagement then scrolls past all of them.

Archive an edition and it leaves the framework list and every picker, no new engagement or programme can be started on it, and it drops off the organisation posture report — which is the point: that report is what a board reads, and a standard you have stopped tracking should not be on it. What it does not do is touch anything that already uses it: those engagements keep their framework, their workpapers, their reports and their history, and read exactly as before. It is reversible — archived editions are listed under Archived at the bottom of the Frameworks page, with Restore.

Because it takes content away from every organisation on the instance, archiving and restoring need a super admin, the same as retiring a version. The confirmation tells you how many engagements already use the edition before you decide.

Crosswalks — reuse work across frameworks​

Many controls in one framework address the same requirement as controls in another. A crosswalk records that link. Vantage keeps three kinds:

  • Version links, generated automatically between versions of the same standard where the control reference is unchanged. On a new installation an administrator generates them once, with npm run db:seed:crosswalks — a fresh instance has no links until somebody either runs it or creates links by hand, which is worth knowing before you conclude the feature is empty.
  • Suggested links, produced by the mapping engine or — if your organisation has switched on AI assistance for compliance — proposed by the model. A suggestion carries a confidence and waits for a manager to ratify or reject it.
  • Manual links, created by a manager; these are ratified by the act of creating them.

Manage them from the framework's page: Crosswalks lists the links between this framework and another. A manager can ratify or reject each one, or Add link by picking a control on each side. Deleting a link needs an org admin — a rejected link stays readable as a decision somebody made, which is usually what you want; deleting removes the record of it. If your organisation has switched on AI assistance for compliance, Propose with AI asks the model for candidates — they arrive as suggestions for the same ratification step, never as decisions.

Version links are created for you: importing a bundled pack that replaces one you already hold links every control whose reference did not change.

Who can see a crosswalk​

The two kinds Vantage generates — version links and the mapping engine's suggestions — describe the frameworks themselves, so they are visible to everyone on the instance, exactly as the frameworks are.

A manual link and an AI proposal are different: they are a judgement your organisation made, and the rationale is yours. They are visible only inside the organisation that created them, and only that organisation can ratify, reject or delete one. Another organisation looking at the same two frameworks sees the generated links and none of your reasoning.

On a workpaper, Prior results on mapped controls shows what your organisation concluded on every control linked to the one you are assessing: which engagement, the grade, the conclusion, the observation. It is there to save you re-reading — nothing is inherited. You can copy an observation as a starting point; the grade is always yours to give.

  • Running an assessment — creating an engagement on a framework and carrying last year's work forward.
  • Gap analysis — measuring an engagement against a target profile.