Compliance
The workspace where an organisation records its own controls, risks, audits and evidence, and what it does not do: it does not assess or certify compliance with any law or standard.
- Version
- 0.2
- Zuletzt aktualisiert
Dokumentation durchsuchen
Auf dieser Seite
Dieses Dokument wird derzeit nur auf Englisch veröffentlicht. Englische Originalfassung lesen
The Compliance workspace is a register. An organisation uses it to record the controls it has in place, the risks it has identified, the audits it has planned or run, and the evidence that supports them, and to see where those records stand.
It does not decide whether an organisation complies with anything. Virtik does not assess an organisation against a law, regulation or standard, does not produce a filing or a certificate of compliance, and does not provide legal advice. The workspace labels each site Compliant, At Risk, Non-Compliant or Not Assessed, computed from the open findings and the evidence that people have recorded. Those labels reflect recorded data only and are not a legal determination, as the Assurance tab itself says.
The six tabs
| Tab | What it holds |
|---|---|
| Overview | Where the organisation's records stand. |
| Controls | A starter library of controls, some of which map to functions of a published framework, with the organisation's own implementation status for each. |
| Risks | Risks the organisation has recorded. A new risk is added by title; its likelihood and impact cannot be set, and show as not assessed. |
| Audits | Audits recorded by title, each with a status. There is no date field. |
| Evidence | Evidence records, each with a source or description and an optional "valid until" date. The tab says that no file is stored: it records evidence metadata only. |
| Assurance | A read-only summary computed from control status, open findings (recorded in Prevention), evidence and audits. |
When a tab has nothing in it, it says so: "No controls in the library yet", "No risks recorded yet", "No audits scheduled yet", "No evidence recorded yet". Assurance shows "Not Assessed" where nothing has been recorded to assess; its audit-readiness line shows "Not Assessed" when no audit is recorded, and also when audits are recorded and no critical or high finding is open (it shows "At Risk" when one is).
What is recorded
The records are saved to the organisation's account. Members can view them and editors can create and change them. The database lets administrators delete them, but the workspace offers no delete control. The controls library is shared reference material: the framework it draws on is a published framework, included as a starting list, and an organisation's own implementation status is recorded against it.