> ## Documentation Index
> Fetch the complete documentation index at: https://docs.matproof.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Controls

> The building blocks of every compliance framework — track status, assign owners, and link evidence.

## What is a control?

A control is a specific security or operational requirement that a compliance framework mandates. Every framework is made up of controls — DORA has around 70, ISO 27001 has 93, and SOC 2 has roughly 60 criteria.

Examples of controls:

* "Implement multi-factor authentication for all privileged accounts"
* "Conduct annual penetration testing of critical systems"
* "Maintain a documented incident response plan"

When you activate a framework in Matproof, its full control set is automatically populated into your Controls module.

<Note>
  Controls are only visible when **Advanced Mode** is enabled for your organization. Go to **Settings → Organization** to enable it.
</Note>

## Control structure

Each control contains:

| Field                 | Description                                              |
| --------------------- | -------------------------------------------------------- |
| **Status**            | Not started / In progress / Implemented / Not applicable |
| **Owner**             | The team member responsible for this control             |
| **Evidence**          | Evidence tasks linked to this control                    |
| **Policies**          | Internal policies that satisfy this control              |
| **Risks**             | Risks that this control mitigates                        |
| **Framework mapping** | Which frameworks reference this control                  |

## How controls map to frameworks

Controls are the shared layer beneath multiple frameworks. A single control — like "Encrypt data at rest" — can satisfy requirements across DORA, ISO 27001, and SOC 2 simultaneously.

When you collect evidence for a control, all frameworks that reference it are updated automatically.

<Tip>
  If you are pursuing multiple certifications, prioritize controls that appear in more than one framework first. Check the **Framework mapping** field on each control to see overlap.
</Tip>

## Updating control status

1. Go to **Controls** and open a control
2. Click **Status** and select the current state
3. Add a note if needed (useful for partial implementations)

Status options:

<CardGroup cols={2}>
  <Card title="Not started" icon="circle">
    Control has not been addressed yet.
  </Card>

  <Card title="In progress" icon="circle-half-stroke">
    Implementation is underway but not complete.
  </Card>

  <Card title="Implemented" icon="circle-check">
    Control is fully implemented and evidenced.
  </Card>

  <Card title="Not applicable" icon="ban">
    Control does not apply to your organization's scope.
  </Card>
</CardGroup>

<Warning>
  Marking a control as **Not applicable** requires a justification note. Auditors will review these during assessments.
</Warning>

## Linking evidence

Evidence tasks are the primary way controls move to **Implemented** status.

To link evidence to a control:

1. Open the control
2. Click **Add evidence**
3. Select an existing evidence task or create a new one
4. Once the evidence task is marked complete, the control status updates automatically

You can link multiple evidence items to a single control. The control is considered implemented when all required evidence is collected and unexpired.

## Assigning owners

Every control should have an owner — the person accountable for implementation and ongoing compliance.

1. Open a control
2. Click **Owner** → search for a team member
3. The owner receives notifications when evidence expires or the control status changes

<Note>
  Owners do not need to collect evidence themselves. They are accountable for ensuring it gets done.
</Note>

## Filtering and searching

Use filters to focus on what matters:

| Filter              | Use case                                                 |
| ------------------- | -------------------------------------------------------- |
| **Framework**       | View controls for a specific framework (e.g., DORA only) |
| **Status**          | Find all controls that are not started or in progress    |
| **Owner**           | See what a specific person is responsible for            |
| **Evidence expiry** | Surface controls with expiring evidence                  |

## Exporting for audits

Before an audit, export your controls for review:

1. Go to **Controls**
2. Apply any filters (e.g., by framework)
3. Click **Export**
4. Choose CSV or the full evidence package (ZIP)

The export includes control names, statuses, owners, linked evidence, and policy references — matching the structure auditors expect.