Frameworks
The Frameworks page is where you choose the standards, laws and guidelines you measure yourself against, and see how well your controls cover them. This page explains how to enrol frameworks, apply template packs, find and close gaps, compare two frameworks, import a framework and build your own.
Who uses it
| Role | What they do here |
|---|---|
| Admin | Enrols and disenrols frameworks, creates custom frameworks, imports frameworks, applies template packs and drafts controls for gaps |
| Policy editor | Applies and composes template packs |
| Security manager | Imports frameworks |
| Auditor and Incident responder | View frameworks, gap analysis and comparisons |
Before you begin
Your workspace comes with the frameworks of the shared compliance library, such as ISO/IEC 27001 and 27002, NIS2, GDPR, DORA, the NIST Cybersecurity Framework, CIS Controls, NEN 7510 and BIO2. Which ones are available depends on the library your workspace uses. In a new workspace, every framework that has controls or obligations to track starts enrolled.
The Frameworks page
Click Frameworks in the top navigation. The page has three tabs: Enrollment, Gap analysis and Compare side-by-side. At the top right are Import framework and Create custom framework.
The Enrollment tab has two views: Template packs, which opens first, and Frameworks.
Kinds of framework
Each framework card carries a kind:
| Kind | What it is | What you track |
|---|---|---|
| Control catalogue | A list of controls, such as ISO/IEC 27002 or CIS Controls | Controls |
| Obligations | A law or regulation, such as GDPR or NIS2 | Obligations |
| Crosswalk | A standard that maps one-to-one onto another, such as ISO/IEC 27001 onto ISO/IEC 27002 | Follows the framework it maps onto |
| Profile | A selection from another framework | Subcategories |
| Reference document | Guidance without a catalogue. Kept for AI chat and mappings. | Nothing; it cannot be enrolled |
Find a framework
Reference documents are hidden unless you switch on the Reference chip.
An enrolled framework's card shows a coverage dial and how many of its clauses are implemented, or how many of its obligations are met. A clause counts as implemented once an Active control is mapped to it. Mapped controls that are still a draft or in review don't count yet, so coverage rises as you approve controls.
Enrol or disenrol a framework
If the change is refused, the switch flips back and Command shows Update failed.
Enrolling decides which frameworks you track: they appear on the Dashboard, in gap analysis and in the control editor's mappings. GDPR, NIS2 and DORA are always shown on the Dashboard and in comparisons.
Apply a template pack
A template pack is a ready-made baseline. Applying one enrols its frameworks, drafts its controls and writes a policy document for each group of controls. Command ships nine packs, including Dutch municipality — BIO2 baseline, SME — ISO 27001 starter, NIS2 essential entity, Healthcare — NEN 7510 baseline, Ransomware resilience and Supply chain & third-party risk.
The new controls start as Draft, so you can review them before they count. Applying a pack again, or another pack with overlapping controls, never duplicates a control. The policy documents are written in the background; you get a notification when they are ready. See Policies.
Compose a custom pack
The pack is saved with a Custom label so you can reuse it. Nothing is applied until you select it and click Apply.
Find your gaps
The Gap analysis tab shows, clause by clause, where your controls cover a framework and where they do not.
Each gap shows No control maps to this clause yet and Unmapped. Each covered clause shows how many mappings it has, and Open mapped control opens the control. Click a clause to read its full text.
Close a gap
Command can draft a control for a gap in the background.
A new draft is a Draft control with text, risk, assets, mappings and an evidence checklist. It is not published until you publish it.
Compare two frameworks
The Compare side-by-side tab shows how two frameworks overlap.
Anyone who can see frameworks can compare them.
Import a framework
You can add a framework that is not in your library, such as a sector standard or an internal baseline.
[{"ref":"CC1.1","name":"Control environment"}].Command also maps your existing controls whose framework reference contains one of the new clause numbers.
Create a custom framework
Build your own framework from controls you already have, for example an internal baseline.
The new framework is enrolled straight away. Your selected controls are grouped under their pillars, People, Organization and Technology.
A custom framework's card has a menu with Edit framework, Duplicate and Delete.
How Command protects you
Troubleshooting
| What you see | What it means | What to do |
|---|---|---|
| Update failed when you switch a framework | Your role cannot change enrolment | Ask an Admin |
| Enroll in a framework first. | No framework is enrolled | Enrol a framework on the Enrollment tab |
| Add a document or controls JSON | You started an import without a document or controls | Choose a document or paste the controls |
| Import failed: followed by a reason | The import could not complete | Check the document and try again |
| Could not compose a pack | Command could not compose a usable pack | Try other answers, or apply a shipped pack |
| Both need an extracted control/obligation catalogue to cross-reference. Import or extract their clauses first. | One of the frameworks has no clause list | Choose another framework, or import its clauses |
| Frameworks could not be loaded. | Command could not load the frameworks | Click Try again |
| Reference frameworks can't be deleted | Only custom frameworks can be deleted | No action needed |
| Draft failed: followed by a title, in the bell | Drafting a control for a gap did not complete | Try Draft control again |