Controls library

Your control catalogue — each control maps to regulatory requirements, carries evidence, and mitigates one or more risks.

Controls

in catalogue

Active

operating

Review due

overdue testing

Needs attention

effectiveness gap

6 controls assessed

Design effectiveness

5of 6 effective

5 effective1 ineffective

Operating effectiveness

4of 6 effective

4 effective2 ineffective

Overall effectiveness

4of 6 effective

4 effective2 ineffective

Effective only when design and operating are both effective

Controls6

Control	Category	Owner	Frequency	Frameworks	Effectiveness	Status
Backup restoration testing C-031	Resilience	SLSophie Lindqvist	Semi-annual	DORAISO 27001	Effective	Active
Privileged access review C-001	Access control	JWJames Whitfield	Quarterly	ISO 27001NISTDORA	Effective	Active
ICT incident classification & reporting C-014	Incident management	ITInès Tremblay	Per event	DORAFCA	Effective	Active
Critical third-party register review C-022	Third-party risk	MAMarcus Allen	Annual	DORAPRAFCA	Needs work	Active
Customer due diligence — high risk C-045	Financial crime	TBTom Brennan	Per onboarding	FCA	Effective	Active
Data subject request handling C-067	Data protection	ITInès Tremblay	Per request	GDPR	Not tested	Review due