Framework mappings and catalogs

Relate controls to requirements and review catalog updates.

Maintain a control’s mappings

  1. Open Controls & Evidence → Controls and select the control.
  2. Open Frameworks and choose Manage.
  3. Search the available framework items and check their identifiers and versions.
  4. Move the required items into the selected list, or remove associations that no longer apply.
  5. Save, then return to Frameworks and verify the selected items.

A mapping relates an operating control to a reference requirement. Linked evidence and assessments describe how the control operates.

Control Frameworks page showing a linked NIST CSF framework and its related item count.
Use Manage to inspect and update the control’s framework-item associations. Select the image to view it full size.

Consult source catalogs

Open Controls & Evidence → Catalogs to inspect available control sources such as SCF. Reference frameworks remain under the Governance Library. Catalog and framework versions matter when comparing historical work.

Review an SCF update

Use the catalog-update review page when available to compare a control's existing source with the active SCF version. An administrator can relink it to a matching item, apply reviewed catalog content changes, or keep the local control and record that decision for the active version.

Review the actual proposed content rather than assuming that a source-version change should overwrite local implementation. Historical assessments retain the facts recorded at their assessment date. Risks with superseded catalog references use their separate explicit comparison and approval workflow.

Expected outcome

The control’s Frameworks page lists the saved mappings and their reference versions. A mapping records a relationship; evidence and assessments are still needed to explain implementation and effectiveness.

Screenshot

Scroll to inspect the image, or choose Fit image to see the whole screen.