Evidence package
Collected artifacts, source hashes and a manifest, with package signatures available for independent verification.
Compliance evidence and assuranceControl Frame
From evidence to confidence.
Connect control requirements to source evidence and a technical record an assessor can inspect.
GOVERN / Control Frame
Evidence operations
Make the assessment record useful to the next reviewer.
An assessment needs more than a folder of documents. Control Frame keeps the method, source, collection history and review standing with the evidence. Engineers can prepare material in the same record that control owners and assessors use to examine its relevance and accept it for the assessment.
Every control has a sourceExample
EvidenceRequirementsAssessor review
Evidence packageSource · hash · manifest
Source artifactRequirement
Access policySource + versionAccess control
System recordCollection periodConfiguration
Control testMethod + resultTest evidence
Source and method
Keep the requirement tied to its authority.
Framework versions and source-native requirements provide the assessment's reference point. Scoped procedures and accepted sources connect the control being reviewed to the material that can support it.
- The framework record names its source, version and product standing.
- Requirement mappings and crosswalks remain available for review alongside the underlying controls.
- A document's relevance depends on the assessment scope and evidence period.
Interactive example
Prepare an evidence review.
Change the source record, assessment period and review standing to see what belongs in the assessor's package.
Synthetic inputsComputed in this browser
Control FrameInteractive workspace
Choose a starting pointThen change any input to explore the difference.
01 / Set the context
Example assessment · quarterly access review
The reviewer needs a traceable version of the access-review record.
The example scope is the application access review for Q2.
A source artifact and an acceptance decision are separate evidence.
Authored examples for exploring the workflow. Your choices update only this demonstration.
02 / Inspect the basisEvidence review record
One review item remains
2 of 3 example checks met. Follow the evidence questions before carrying the example forward.
2 / 3 checks met
Review checks2 / 3 met
Source artifactMet
Access-review export v3 carries its source identifier, retained hash and collection history.Assessment relevanceMet
The export covers the declared application and Q2 evidence period.Control-owner reviewReview
The control owner's acceptance and relevance rationale are still an open request.
Next review step
Request a named control-owner decision with its relevance rationale.
Inspect the selected evidence
- Source artifact
- Access-review export v3 carries its source identifier, retained hash and collection history.
- Assessment relevance
- The export covers the declared application and Q2 evidence period.
- Control-owner review
- The control owner's acceptance and relevance rationale are still an open request.
Illustrative review record · human decisions and subsequent actions keep their own standing.
The product
Govern with evidence.
Control Frame organizes compliance around the evidence behind a control. Source lineage, signed manifests, requirement mapping and live control tests give reviewers a clear path from a stated requirement to the technical work that supports it.
Enterprise AI journeyGOVERN
Inside Control Frame
Follow a control back to its source.
Give compliance teams, engineers and assessors a shared technical record. Each requirement can be examined alongside the source artifact, collection history, relevant test and review decision that support it.
- Compliance teams
- Control owners
- Auditors and assessors
How the work moves
Define the assessmentAssessment scope
Agree the applicable framework, systems, evidence period and responsible owners. Establish what the review needs before collecting material.
Collect source evidenceTraceable evidence set
Bring policies, system records and collected artifacts into the evidence workspace. Preserve source, version, period and ownership so reviewers can judge relevance.
Preserve the custody recordVerifiable evidence package
Hash the artifacts and assemble a manifest. Package signing and verification make the retained evidence inspectable for changes after collection.
Map requirements and test controlsControl evidence and gaps
Connect evidence to control requirements and proposed cross-framework mappings. Keep live test results and missing evidence beside the requirement being reviewed.
Prepare the assessor's reviewReviewable assessment record
Named reviewers accept evidence and retain the reason for their decision. Assessor workspaces present the technical record with its provenance and outstanding requests.
What the work produces.
Control record
Requirements, proposed mappings, test results and evidence gaps, with a separate review decision for each applicable control.
Assessor review workspace
Evidence, custody details, requests and named decisions organized around the assessment being performed.
Control Frame prepares and preserves the assessment record. Independent assessors retain responsibility for their opinions and certification decisions.
In practice · illustrative scenario
Prepare an access-control review for a defined period.
An assurance team needs to review an access control. The engineer supplies a policy and system records, but the reviewer must establish which versions and dates belong to the assessment.
- 01
Establish relevance
Connect the requirement to its source version and the agreed systems and period before accepting the supplied material.
- 02
Inspect the record
Examine artifact versions, custody history and relevant test evidence. Record a request where the supplied material leaves a question open.
- 03
Prepare the review
Retain the named acceptance decisions and package eligible evidence with its manifest for the assessor's examination.
The useful outcome
The illustrative output is a control record whose evidence, outstanding questions and review decisions can be followed back to their sources.
A closer look
Know what you can do with Control Frame.
How do we establish the right framework scope?
Start with the versioned framework record and its stated product standing, then agree the applicable requirements and assessment period. Coverage is established for that scope rather than inferred from the size of the framework directory.
How does evidence enter the workspace?
Through document intake and the collection paths configured for the project. Connector and private-runner access, accepted sources and review requirements are agreed for the environment so each artifact has a defined route into custody.
What does an assessor receive?
The organized technical record, including applicable requirements, evidence provenance, requests and named review decisions. An eligible portable package adds its manifest and verification material. The assessor forms the independent opinion from that evidence.
