Controls are the safeguards that satisfy your requirements, and evidence is the proof they operate. In ISO Mate you define a control, map it to the requirements, policies, and risks it addresses, then upload evidence files and link each one to a control. Controls, the Evidence Vault, and the Crosswalk all live in the sidebar Compliance group.
Create a control
- Go to Compliance > Controls and click Create. When AI creation is enabled for your account, the button also offers Create with AI.
- Enter an identifier, a title, and an optional description.
- Set the implementation status: Not Implemented, In Progress, or Implemented.
- Click Create Control.
The implementation status drives your compliance posture. A control moves from Not Implemented to In Progress as you work on it, and to Implemented once it is operating, which is reflected on the compliance dashboard.
Map controls to requirements, policies, and risks
On the control’s edit page, use the mapping panels to build the relationships that make a control meaningful:
- Requirements: search and select the requirements the control satisfies. One control can satisfy requirements across several frameworks.
- Policies: link the policies that document how the control is applied.
- Risks: link the risks the control treats in your risk register.
Because a single control can map to requirements in more than one framework, you implement it once and satisfy overlapping obligations everywhere it applies, which reduces duplicate effort.
See coverage in the Crosswalk
Open Compliance > Crosswalk to see how your controls map across multiple frameworks in one grid. The Crosswalk makes overlapping requirements obvious, so you can spot gaps and avoid documenting the same safeguard twice.
Upload evidence
- Go to Compliance > Evidence Vault and click Upload Evidence.
- Drag a file onto the drop zone or click to browse and select one.
- Give the evidence a name.
- Link the evidence to a control by searching for it. A control is required so the file is filed against the safeguard it supports.
- Optionally set an expiration date for time-sensitive evidence.
- Click Upload.
Evidence status and expiration
Each evidence file carries a status of Current, Expiring Soon, or Expired, derived from the expiration date you set. The compliance dashboard surfaces expiring evidence so you can refresh it before it lapses, which keeps your audit trail current.
Build audit-ready packages
Because every file is linked to a control, your evidence is already organized around the safeguards an auditor asks about. Open a control to see its linked evidence and procedures in one place, and download any file from the Evidence Vault when you assemble a review pack.
Next steps
Controls satisfy the requirements you set up in Setting Up Compliance Frameworks, and the policies you link here are rolled out and attested in Managing Policies and Attestations.
Want to see controls and evidence in action? Start your free 14-day trial.