RLCM: find the right screen¶
Every screen in this module, what each one is for, and where it lives. Use it to find the right screen quickly, and to confirm you are on the one a colleague means — several screens in this product have similar names and different jobs.
Screenshots come from a demonstration data set, so the figures are illustrative. Click any screenshot to open it at full resolution.
Assessed Controls¶
Controls that have been evaluated, with the evidence and the conclusion reached.
Assessment Templates¶
A reusable set of controls and questions, so two assessments of the same kind cover the same ground.
CCF Control Map¶
For one requirement, the controls already mapped and the ones not yet mapped, with Map and Unmap between them. Mapping changes coverage; it touches no assessment.
CCF Frameworks¶
The external standards you hold yourself to, each with its requirement count and the proportion of requirements mapped to at least one control. Compliance % here measures mapping, not passing.
CCF Requirements¶
One framework's clauses by section, each showing how many controls satisfy it. Unmapped (gaps) is the number to work down — every one is a clause you are held to and have no control for.
Compliance Assessments¶
Assessments in progress and completed, with their control status and review state.
Compliance Risks¶
Risks raised from control failures, tracked and treated separately from technical vulnerabilities.
Control Library¶
Every control available to assess against, across all frameworks.
Control Similarity¶
Matches a vendor questionnaire against controls already assessed, so overlapping questions are not asked twice.
Process Groups¶
Business processes controls are grouped against, so a failure can be reported by function rather than by clause.
RLCM Audit Categories¶
How compliance audits are classified for reporting.
RLCM Audit Management¶
Create and administer compliance audits, including scope and assigned assessors.
RLCM Audit Properties¶
Additional fields recorded against a compliance audit.
RLCM Audit Statuses¶
The states a compliance audit moves through, and the permitted transitions.
RLCM Dashboard¶
Compliance posture — findings by audit type, control age, and the top failing process groups and standards.
RLCM Domains¶
The top-level grouping above process groups.
RLCM General Configuration¶
Module-wide settings for compliance management.
RLCM Risk Statuses¶
The states a compliance risk moves through as it is treated.
Recurring Assessments¶
Standing instructions that raise an assessment automatically on a frequency, with its assignees already set. Titled "Purging Configurations" in the product; nothing on it deletes data.
Risk Levels¶
The rating scale used for compliance risk, separate from technical severity.
Risk Master¶
The catalogue of risks that can be raised, so wording stays consistent between assessments.
Risk Properties¶
Additional attributes recorded against a compliance risk.
Risk Rating Rules¶
How a control failure is turned into a risk rating.
Risk Register¶
The consolidated register — every open compliance risk with its rating, owner and treatment.
Section Controls¶
Which controls belong to which section of a standard.
Standard Sections¶
How a standard divides into sections, used for scoring and reporting at section level.
Standards¶
The frameworks in use — ISO 27001, PCI DSS, an internal baseline. Each carries its own controls.
TPRM Assessments¶
Assessments issued to vendors, and how far each has progressed.
TPRM Audit Statuses¶
The states a vendor assessment moves through.
TPRM Control Management¶
A vendor assessment being worked: each control, who it is waiting on, and what they have done with it.
TPRM Dashboard¶
Third-party risk posture across the vendor portfolio.
TPRM Findings¶
What a vendor assessment found, and what was asked of the vendor.
TPRM Question Library¶
Reusable questions for vendor assessments, so vendors are asked consistently.
TPRM Risks¶
Risks arising from a vendor relationship rather than from your own estate.
Unified Control Framework¶
One control mapped to the several frameworks that require it, so evidence is collected once and reused.
