WEBVTT 1 00:00:00.617 --> 00:00:12.193 Welcome to NxSAM training. This module covers R L C M - compliance assessment against a framework, rather than scanning for technical weaknesses. 2 00:00:12.464 --> 00:00:24.837 Everything else in the platform starts from a machine finding something. This module starts from a question someone has to answer: is this control in place, and can you show me. 3 00:00:25.426 --> 00:00:32.233 Four things nest inside each other, and the structure is worth getting right before anything else. 4 00:00:32.824 --> 00:00:50.261 A control is a single requirement - access is reviewed quarterly, backups are tested, privileged actions are logged. A section groups related controls. A template is a complete set of sections, which is what an assessment is run from. 5 00:00:50.857 --> 00:01:01.259 And an audit is one execution of a template against one scope, at one point in time. Templates persist; audits accumulate against them. 6 00:01:01.864 --> 00:01:11.353 The audit list shows each one with its information, its status, its progress, its findings, an assessment summary, and its audit score. 7 00:01:11.932 --> 00:01:25.812 Notice that Progress and Audit Score are separate columns. That is deliberate and it is the single most important thing to understand about this module, so we will come back to it properly once the rest is in place. 8 00:01:26.410 --> 00:01:38.252 There is a structural rule worth knowing, because it explains something people try to do and cannot. Within an audit, a control appears exactly once per section. 9 00:01:38.858 --> 00:01:55.836 So the same control can legitimately appear in two different sections of a template - assessed twice, in two contexts - but it cannot appear twice in the same section. That keeps every control result attributable to one place in the framework. 10 00:01:56.418 --> 00:02:02.332 Underneath the controls sits the part that makes this module worth the effort of setting up. 11 00:02:02.934 --> 00:02:19.073 A control is mapped to the standards it satisfies, and to a process group, and to a unified control framework reference. Each of those mappings is recorded once per standard, so a control's relationship to a framework is unambiguous. 12 00:02:19.670 --> 00:02:31.297 The reason to care is the thing every compliance team wants and few have. Assess the control once, and you have evidence against every framework that control maps to. 13 00:02:31.892 --> 00:02:49.279 Without a crosswalk, three frameworks asking for the same thing in three different words means three separate assessments, three sets of evidence, and three opportunities to answer inconsistently. With one, it means one assessment reported three ways. 14 00:02:49.843 --> 00:03:05.669 That crosswalk has a home of its own. A framework is loaded as its own list of requirements - the clauses of the standard, under the standard's own numbering - and each requirement is mapped to the controls in your library that satisfy it. 15 00:03:06.272 --> 00:03:19.818 The framework list: which standards you hold yourself to, the edition, who issues it, how many requirements it has, and Compliance percent - the share of those requirements mapped to at least one control. 16 00:03:20.403 --> 00:03:41.746 Read that percentage for what it is. A framework at one hundred percent has a control for every requirement. It says nothing about whether those controls are met - that is what the assessments say. A framework can be fully mapped and badly failed, or thinly mapped and passing everything it covers. 17 00:03:42.345 --> 00:04:01.108 Frameworks marked as system frameworks ship with the product and cannot be edited or deleted. Everything you add yourself can be - Add Framework asks for the name, a reference ID, the authority, type and version, and a validity period with a warning before it expires. 18 00:04:01.682 --> 00:04:05.411 Open a framework and you are looking at its clauses. 19 00:04:06.035 --> 00:04:18.117 The header gives the framework's shape at a glance: total requirements, how many are mapped to controls, how many are not - the gaps - and the average number of controls per requirement. 20 00:04:18.704 --> 00:04:34.602 Unmapped is the number to work down. Every requirement in it is a clause you are held to and have no control for. It is also the number an external assessor asks about first, because it is the one that cannot be argued. 21 00:04:35.220 --> 00:04:48.145 Each row is one clause: the standard's own reference code, its section, the requirement, and how many of your controls are mapped to it. Coverage says simply whether it has any. 22 00:04:48.720 --> 00:04:54.611 Requirements can be typed in one at a time, or uploaded as a CSV. 23 00:04:55.220 --> 00:05:09.584 Download Sample gives the exact layout the upload accepts, and every run is kept in the upload logs with what it accepted and what it rejected - so an upload that "did nothing" can be read rather than guessed at. 24 00:05:10.180 --> 00:05:14.323 Cancel that, and open the map for one requirement. 25 00:05:14.920 --> 00:05:26.306 Two lists. The controls already mapped to this requirement, and the ones not yet mapped - with Map and Unmap between them, and Select All for bulk moves. 26 00:05:26.906 --> 00:05:39.443 The unmapped side can be filtered by the control's priority and domain, so a requirement about access control is mapped from the access-control controls without scrolling the whole library. 27 00:05:40.042 --> 00:05:52.843 Mapping is reversible and touches no assessment. What it changes is the framework's compliance percentage and this requirement's coverage - both of which update the moment the map is saved. 28 00:05:53.479 --> 00:05:57.617 The control library is where those controls are kept. 29 00:05:58.217 --> 00:06:06.990 Each carries its control details, its answer and comments, the process groups and standards it belongs to, and its priority. 30 00:06:07.586 --> 00:06:19.742 Priority is worth setting deliberately rather than leaving at a default, because it is one of the two things the audit score is weighted by. We will see exactly how shortly. 31 00:06:20.347 --> 00:06:35.910 Controls can be added one at a time, uploaded in bulk from a spreadsheet, or changed in bulk once they exist - which matters, because a framework arrives as a document of several hundred requirements, not as something you type in. 32 00:06:36.509 --> 00:06:39.784 Running the audit is where the work happens. 33 00:06:40.382 --> 00:06:47.067 Each row is one control, and the eye beside it opens what that control actually asks for. 34 00:06:47.667 --> 00:06:50.679 Two fields matter more than the rest here. 35 00:06:51.259 --> 00:07:10.208 Evidence Requirement says what proof will be accepted - the signed document, the record of its last review, the person accountable for it. Testing Procedure says how it will be checked. A control missing either is not auditable; it is an opinion with a reference number. 36 00:07:10.808 --> 00:07:28.845 Control Type and Priority sit alongside them. Preventive, detective or corrective is not bureaucracy - it tells you what evidence could possibly exist. A preventive control leaves configuration behind; a detective one leaves logs. 37 00:07:29.477 --> 00:07:47.034 Controls are assigned to people, and the assignment records what role that person has on that control - assessor, reviewer, owner. One person holds one role on one control, which is what stops a review being signed off by the person who performed it. 38 00:07:47.636 --> 00:08:02.454 The screen has separate save actions for each of those roles, and filters for all controls, the ones assigned, and the ones already saved - which is how a lead tracks an assessment without asking anybody how they are getting on. 39 00:08:03.042 --> 00:08:10.469 Mark As N A is here too, and it deserves a proper explanation because people avoid it out of caution. 40 00:08:11.060 --> 00:08:27.822 Marking a control not applicable does not count against you. It is removed from the score entirely - from both what you have earned and what was available. It is not a failure; it is a statement that the question does not apply to this scope. 41 00:08:28.433 --> 00:08:42.508 Which means using it honestly is better than answering a question that does not apply. A cloud-only organisation should mark the data-centre controls not applicable and say why, rather than passing them. 42 00:08:43.101 --> 00:08:58.999 The audit itself moves through a defined set of states: not started, work in progress, on hold, completed - with review requested, changes requested and reverted for the review cycle, and requested and approved around the outside. 43 00:08:59.598 --> 00:09:17.322 Changes Requested and Reverted are the two worth understanding. Changes Requested sends work back without discarding it. Reverted takes a completed audit back to being open, which matters because it means a completed assessment is not immutable. 44 00:09:17.956 --> 00:09:24.593 A control that is not in place produces a finding, and findings here have their own lifecycle. 45 00:09:25.178 --> 00:09:42.177 New, to be patched, patch in progress, patched, not patched, on hold, re-opened, and validated. That is a longer list than most modules use, and each state exists because compliance findings genuinely sit in these places. 46 00:09:42.776 --> 00:09:57.114 Two are worth calling out. Not Patched is an explicit decision, not an absence of activity - it says this was looked at and will not be addressed, which is a different statement from a finding nobody has touched. 47 00:09:57.718 --> 00:10:15.032 And Validated is the state that matters to an auditor. Patched says somebody says they fixed it. Validated says somebody checked. In a compliance context those are not the same claim, and the module keeps them apart deliberately. 48 00:10:15.611 --> 00:10:21.002 Findings are then scored, and the scoring is configurable rather than fixed. 49 00:10:21.613 --> 00:10:37.172 Risk properties, their values, and the weighting between them are all defined by your organisation. Two organisations running the same framework can legitimately score the same finding differently, because they carry different risk. 50 00:10:37.771 --> 00:10:54.101 That is the point of making it configurable rather than shipping one opinion. But it has a consequence: a score only means something alongside the configuration that produced it, so changing the weighting changes history as well as the present. 51 00:10:54.697 --> 00:11:02.628 Weight configuration and the risk property master are where that lives, and they are worth agreeing once and changing rarely. 52 00:11:03.204 --> 00:11:09.547 Now the audit score itself, which is the number people quote and the one most often misread. 53 00:11:09.815 --> 00:11:25.089 It is really three numbers: what the audit has earned, what was available to earn, and the percentage between them. Every scored control contributes its weight to what was available, whether or not anyone has answered it. 54 00:11:25.699 --> 00:11:39.989 And a control's weight depends on what it turned out to be. A control that produced a finding is weighted by that finding's severity. A control that did not is weighted by the control's own priority. 55 00:11:40.579 --> 00:11:58.036 Two different scales, chosen by outcome, and both configurable here - which is why this screen has a tab for each. It means a critical finding costs you what a critical finding should, independently of how important the control was thought to be beforehand. 56 00:11:58.635 --> 00:12:12.613 Points are earned two ways. A control that passed earns its weight as soon as it has been assessed. A control that raised a finding earns its weight back only when that finding reaches a closed state. 57 00:12:13.209 --> 00:12:24.210 So remediation moves the score after the audit is finished, not just during it. The number keeps working as a tracker rather than freezing at completion. 58 00:12:24.833 --> 00:12:30.747 Which brings us to the consequence, and it is the thing to take away from this whole module. 59 00:12:31.326 --> 00:12:46.648 An unanswered control counts toward what was available and earns nothing. So a freshly-created audit scores near zero - not because the organisation is non-compliant, but because nobody has answered anything yet. 60 00:12:47.264 --> 00:12:57.570 Early in an audit, the score is a progress bar. A score climbing steadily through fieldwork is assessors working, not posture improving. 61 00:12:58.192 --> 00:13:15.173 Three rules follow directly. Do not compare two audits at different stages of completion. Do not report a score from an audit that is not finished. And read the Progress column alongside the score every single time. 62 00:13:15.777 --> 00:13:29.923 That is exactly why the product keeps them as separate columns. A score of thirty per cent at ninety per cent progress is a real problem. The same score at ten per cent progress is a Tuesday. 63 00:13:30.532 --> 00:13:33.974 Everything that failed collects in one place. 64 00:13:34.582 --> 00:13:44.410 Each row carries the audit and finding information, the control details behind it, the risk and the observations recorded against it, and its status. 65 00:13:45.039 --> 00:14:01.005 Keeping the control details on the row is what makes this usable outside the audit that produced it. A risk register that lists risks without the requirement they came from cannot be acted on by anyone who was not in the assessment. 66 00:14:01.634 --> 00:14:14.028 And because it spans audits, it answers the question a compliance function is actually asked: not how did this audit go, but what is outstanding across everything we have assessed. 67 00:14:14.611 --> 00:14:21.319 One practical detail that catches teams out, and it is a genuine constraint rather than a quirk. 68 00:14:21.587 --> 00:14:29.327 Documents attached to audits must have unique filenames across the whole system, not just within one audit. 69 00:14:29.925 --> 00:14:48.153 So two audits cannot both attach a file called evidence dot p d f. In practice that means naming evidence for what it proves and which audit it belongs to - better discipline anyway, and far easier to adopt deliberately than to discover halfway through an assessment. 70 00:14:48.734 --> 00:15:07.801 That is R L C M. Templates of sections of controls, mapped once to every framework they satisfy. Assessments with separated roles so review means something. Findings that distinguish patched from validated. And scoring your organisation defines. 71 00:15:08.425 --> 00:15:24.203 The crosswalk is what makes the setup worth it. Assess once, report against every framework that control satisfies - which is the difference between a compliance function that scales and one that repeats itself for every new standard. 72 00:15:24.828 --> 00:15:40.486 And one habit above all the others: never quote an audit score without its progress. An unfinished audit scores low because it is unfinished, and that number has ended up in more than one board pack it had no business being in.