📋 GRC compliance for CMMC 2.0, CPCSC, CPA Canada, IIROC…SaaS discovery for data governanceFree enriched web chat widget🚀 Enriched remote support without your laptop

Compliance Frameworks

Choose which security, privacy and industry frameworks apply to your organization, at what level, and by when you want to be compliant.

Where to find it
Compliance › Frameworks
Who can use it
Anyone whose GRC role includes frameworks can view them; turning frameworks on, choosing levels, setting dates and creating custom frameworks needs edit rights
Plan
Compliance (GRC) platform (or a single-framework compliance add-on)
For
Everyone

What the page is for

This is where you tell Lavawall which frameworks your organization is working towards, such as CIS, NIST or ISO 27001. Enabling a framework brings its controls into your assessments, dashboard and readiness figures. Frameworks are grouped into Security, Privacy, Industry, Regional, Custom and Onboarding, and each card shows its description, version, number of controls and region.

Many frameworks have implementation levels; for those you choose the level you are aiming for, and you can compare all levels side by side. Frameworks with an audit scope, such as SOC 2, let you tick every scope that applies. Once a framework is enabled you can set a target compliance date.

You can also create a custom framework for your own requirements, share it with your child companies, or submit it to the community, and browse frameworks other organizations have shared.

What you see

The Compliance Frameworks page, with the toolbar, category sections, framework cards, options on an enabled card and create custom framework dialog numbered 1 to 5.
The Compliance Frameworks page. Numbers match the list below.
  1. Toolbar: Search frameworks, a region filter, Show community frameworks, Framework Mapping and Create Custom Framework.
  2. Category sections: Security, Privacy, Industry, Regional, Custom and Onboarding Frameworks, each with a short description.
  3. Framework cards: an on/off switch, name, Community or Custom badge, version, description, number of controls with a mapping link, and region.
  4. Options on an enabled card: Target compliance date, Implementation Level (with Compare all levels) or Audit Scope (select all that apply).
  5. Create Custom Framework dialog: Framework Name, Code, Description, Category, Availability, Reference URL, Color and Icon.

How to use Compliance Frameworks

How to enable a framework

  1. Search for the framework or use the region filter.
  2. Turn on the switch on its card.
  3. If the card shows Implementation Level, choose the level you are aiming for. Select Compare all levels to see what each adds.
  4. If it shows Audit Scope, tick every scope that applies.
  5. Optionally set a Target compliance date.

How to filter frameworks to where you operate

  1. Select the region filter (it reads All regions until you choose).
  2. Tick the countries, provinces or states you operate in, or select My regions to use your organization's locations.
  3. Select Show all to clear the filter.

How to create a custom framework

  1. Select Create Custom Framework.
  2. Enter a Framework Name (at least three characters). The Code is generated if you leave it blank.
  3. Add a Description, choose a Category, and choose Availability: This company only, This company + child companies, or Submit to community (requires approval).
  4. Optionally add a Reference URL, and choose a Color and Icon.
  5. Select Create Framework.
  6. On the new card, select Add requirements to map controls to it. Until then it measures nothing.

How to see how a framework maps to controls

  1. Select mapping next to the control count, or Framework Mapping in the toolbar.

Tips

  • Choosing a province or state also includes that country's national frameworks, because both apply to you.
  • Turning a framework off hides its target date and level options; the target date is kept when you change level.
  • A Community badge marks a framework contributed and reviewed by peers; Custom marks one created by your organization.
  • Long descriptions are shortened; select more to read the rest.
  • If you arrive here from Controls with a message saying "Select Frameworks First", enable at least one framework before managing controls.

Troubleshooting

  • "No frameworks match your search.": Try different keywords, clear the search, or select Show all in the region filter.
  • The switches are greyed out.: Your GRC role can view frameworks but not change them.
  • "Your GRC role does not include access to frameworks.": Ask your GRC administrator.
  • "Enable the framework before setting a target date.": Turn the framework on first.
  • "That level does not belong to this framework.": Reload the page and choose the level again.

Task guides that use this page

Still need help?

Search the support centre, or contact our support team and tell us which page you were on.

Names, companies, devices and figures in the pictures are examples. Other product and company names are trademarks of their respective owners.

We use privacy-friendly, cookieless analytics to count visits, and one cookie to run our live chat. Both load only if you accept. We do not use advertising trackers, and we do not profile you across other websites. The essential cookies that keep the site working are always on. See our privacy policy.