Controls
The Controls page is your register of security controls: what your organisation does to protect itself, written down, mapped to frameworks, tied to the assets it protects and backed by evidence. This page explains how to find, write, review, approve and publish controls, and how the AI assists help you write them.
Who uses it
| Role | What they do here |
|---|---|
| Admin | Everything on this page, including the AI assists |
| Policy editor | Creates, edits, comments on, publishes, approves and deletes controls. Cannot run the AI assists. |
| Security manager | Runs the AI assists, binds assets and approves controls in review |
| Auditor | Reads controls and their comments, and checks evidence with the AI evidence auditor |
| Incident responder | Reads controls |
Buttons are not hidden by role. When your role does not allow a change, Command shows a message such as Save failed or Update failed.
Before you begin
The Controls page
Click Controls in the top navigation. The page has two parts:
The search box Search controls… at the top finds controls by title.
A control's stage is Published once you publish it. Until then its stage is its status: Draft, In review or Active.
Each row has a menu (⋮, More actions) with Edit, Publish or Unpublish, and Delete.
The control editor
A control with no text yet opens with a template made of the sections Purpose, Scope, Policy statements and Evidence, with example sentences. Replace them with your own text. The template's evidence checklist is only an example: it does not mean any evidence is attached.
Create a control
You can also click New control on the Dashboard, or + Add control in a column of the control board.
Edit a control
There is no Save button. Command saves your changes when you leave edit mode.
If you open a control and click Preview without changing anything, Command saves nothing.
Write the text
In Edit, the text is made of blocks: paragraphs, headings, lists, checklists and callouts.
The command menu also has an AI assist section. See AI assists.
Map the control to frameworks
Under Framework mappings in the side panel:
Only mappings to frameworks you have enrolled are shown.
Tie the control to assets
Under Protected assets, click Bind to an asset and pick an asset. To remove one, click the × on it. Each asset is coloured by its criticality.
The same link shows on the Assets page under Protected by. See Assets.
Choose the departments
Under Departments, click Edit, then + Department to add a department, or the × to remove one, and click Preview to save. The control's departments decide who receives the policies built from it, and who is asked by default when you request evidence for it.
Comment on a control
You can discuss any block of a control's text with your colleagues.
Comments stay with their block after a reload. On a new control that you have not saved yet, Command shows Comment saved locally (save the control to persist); save the control to keep the comment.
Publish, unpublish and delete
Creating, saving, publishing, unpublishing and deleting a control are all recorded in the Audit log.
Review and approve a control
Use a review when a second person should check a control before it is published.
Submit a control for review
Review a control
While a control is in review, a bar at the bottom of the editor says who it is assigned to and how many comments are open. Read the control and its comments, then:
If someone edits an approved control, the approval no longer covers the new text. The implementation score shows this as Approved, then edited — the approval no longer covers the text until the control is approved again.
Version history
Open the ⋮ menu and choose Version history, or click the version (for example v2) in the details row. A panel lists each approved version with its time, a summary and who made it. Click Close history to return.
Share a control
Open the ⋮ menu and choose Share. Command copies a link to the control and shows Sharing link copied to clipboard. The link opens Command on that control. The person you send it to needs access to your workspace.
The implementation score
Implementation shows how far a control is put into practice, from 0 to 100 %. Command calculates it from the control itself; nobody can type it in. Click the score to see what it is made of.
| Part | Up to | How it is earned |
|---|---|---|
| Written | 15 | The length of the text and the number of sections |
| Mapped to a framework | 15 | Full points for two or more confirmed clause mappings |
| Scoped to assets and owners | 10 | At least one protected asset, and at least one department |
| Reviewed and approved | 20 | Full points when approved and unchanged since. Half when approved and then edited, or when in review with a named reviewer. |
| Evidence attached | 15 | One or more evidence files, plus a bonus when Command can read all of them |
| Evidence stands up to audit | 25 | The share of evidence the AI evidence auditor judged Sufficient (full) or Incomplete (partial) |
The score is updated after each save, binding, publication, review decision and evidence check, and once a day. The list may show the previous value until you reload the page.
Evidence on a control
The Evidence section of the side panel lists the evidence files linked to the control, with their status and date. Click a file name to open it.
AI assists
Command can help you write and improve a control. The assists use your control's title, its mapped framework clauses and its scope. When your workspace language is Dutch, they answer in Dutch.
From the command menu
Click Edit, go to an empty line, type /, and choose an item under AI assist:
| Assist | What it does |
|---|---|
| Draft control from prompt | Drafts the text in the sections Purpose, Scope, Policy and Implementation, and inserts it where you typed / |
| Suggest framework mappings | Adds suggested clause mappings to Framework mappings. It does not change the text. |
| Generate evidence checklist | Inserts an Evidence section with a checklist of the proof you need |
| Auto-enrich (risk, assets, mappings) | Sets the risk and pillar, and adds protected assets, departments and framework mappings. It only chooses from your own assets, departments and enrolled frameworks, and removes nothing. |
| Critique my draft | Reviews the wording and adds review comments to the weak lines. See below. |
While an assist works, the line shows AI · followed by the assist's name and working…. The result appears in the editor; nothing is saved until you click Preview, so you can review or remove it first.
From the ⋮ menu
Both switch the editor to Edit. Click Preview to save the result.
Critique comments
A critique adds review comments by AI Reviewer to the lines they concern, each with a severity and a Suggested fix.
Critique comments are suggestions for your current session. Apply the ones you want, then click Preview to save.
AI review notices
After Draft control from prompt, Command may show AI review notice(s), marked advisory, above the text, for example when the draft recommends forced password rotation, when it seems to miss levels or categories the control defines, or when it suggests a framework you have not enrolled. The notices are advice only; they are never saved into the text. Click Resolve / dismiss on a notice, or Dismiss all.
Drafting from a framework gap
On Frameworks › Gap analysis, Draft control writes a new control for a clause no control covers, in the background. When it is ready, the bell shows Draft ready: followed by the title; click it to open the control. See Close a gap.
How Command protects you
Troubleshooting
| What you see | What it means | What to do |
|---|---|---|
| Save failed, Create failed, Delete failed or Update failed | Your role does not allow the change, or the save did not complete | Check your role. A Policy editor or Admin can edit controls. Try again. |
| AI · … is unavailable right now — the assistant could not be reached. Please try again in a moment. | The assist could not run, or your role cannot run assists | Try again in a moment. Ask an Admin or Security manager to run it. |
| No controls match. | No control title matches your search and filter | Clear the search or choose All |
| Request evidence is disabled: Save this control before asking anyone for evidence for it. | The control is new and not saved yet | Click Preview to save the control first |
| Binding failed | Linking the asset was refused | Check your role, and try again |
| Your changes are gone | You opened another control or page while in Edit | Make the changes again and click Preview before you move on |