SW
Evidence workspaces

Reusable audit evidence mapping and collection.

ControlFrame separates framework templates from project instances. CMS EDE is the first seeded template; HPS / MarketLink is the first project instance, with empty evidence slots until a ControlFrame collector run writes fresh screenshots, traces, payloads, and source maps.

Seeded templates
1
11 additional frameworks planned
Project instances
1
Reusable model, client-specific scope
Source-native rows
9
Seeded CMS EDE drilldowns
Blocked rows
5
CMS UAT, IDM, Okta, or credentials
Collector design
Browser flow collector

Log in with configured role accounts, follow deterministic route steps, capture full-page screenshots, extract page text, and write sidecar metadata.

API evidence collector

Exercise configured endpoints, capture request/response JSON, redact sensitive fields, hash outputs, and map payloads to source-native IDs.

Document and configuration collector

Index uploaded policies, SSPP/SAR/POA&M packages, configuration exports, and manual auditor artifacts with source-backed mappings.

Evidence rule

Reference projects can guide the evidence format, but ControlFrame evidence must come from ControlFrame collector runs or explicit auditor-safe uploads. Placeholder slots stay visible and honest.

Framework registry

Native requirement identifiers stay first-class

CMS Enhanced Direct Enrollment
CMS EDE
seeded template

First seeded template. HPS / MarketLink is a sample project instance with placeholders until ControlFrame collectors run.

Application UI Toolkit UI Questions Item #6Partner Test Case Suite TC-01MARS-E AC-02
SOC 2 Trust Services Criteria
SOC 2
planned template

Planned reusable template for control narratives, tickets, cloud configuration, access reviews, and auditor packages.

CC6.1CC7.2A1.2
PCI DSS 4.0
PCI
planned template

Planned reusable template for cardholder data environment scoping, access controls, logging, vulnerability evidence, and SAQ/ROC support.

8.4.210.2.112.3.1
HIPAA Security and Privacy Rules
HIPAA
planned template

Planned reusable template for administrative, physical, and technical safeguard evidence with source-backed CFR mapping.

45 CFR 164.312(a)(1)45 CFR 164.308(a)(5)
HITRUST CSF
HITRUST
planned template

High-value healthcare assurance template. Build after HIPAA/SOC 2 primitives so HITRUST can reuse the shared control spine.

09.z01.aCVID 3207.0
NIST Cybersecurity Framework
NIST CSF
planned template

Planned reusable template for risk governance and security operations evidence mapped to native CSF outcomes.

GV.RM-01ID.AM-01PR.AA-01
ISO/IEC 27001
ISO 27001
planned template

Global ISMS template. Strong reuse candidate across SOC 2, HITRUST, NIST, and ISO 42001 governance evidence.

Clause 6.1.2A.5.15A.8.15
ISO/IEC 42001 AI Management System
ISO 42001
planned template

Planned reusable template for AI system inventory, risk treatment, monitoring, and management review evidence.

6.1.28.29.1
FedRAMP
FedRAMP
planned template

Federal cloud-assurance template. Requires strict package fidelity, OSCAL support, and deployment isolation options.

AC-2SC-8SI-2CA-7
Cybersecurity Maturity Model Certification
CMMC
planned template

Defense-industrial-base template. Strong reason for private deployment, appliance collectors, and careful data-residency boundaries.

AC.L2-3.1.1IA.L2-3.5.3SI.L2-3.14.2
General Data Protection Regulation
GDPR
planned template

Privacy-program template that should share inventory, vendor, data-flow, and security evidence with HIPAA, SOC 2, ISO, and NIST.

Article 30Article 32Article 35
NYDFS Cybersecurity Regulation
NYDFS 500
planned template

Financial-services cyber template. Useful for showing ControlFrame can support regulation-specific deadlines, attestations, and notification workflows.

500.2500.7500.12500.17