Build Your ProgramControls

Controls

The shared control library at the center of your program, how controls map to requirements, carry evidence, and roll up into framework coverage.

Controls are where compliance stops being abstract. A framework asks for an outcome; a control is the practice you actually run to achieve it, and the thing you attach proof to.

The control library

When your program is materialized, Aegis builds a control library for the frameworks you selected. Each control has:

  • A name and description in plain language, what the practice is.
  • Mapped requirements across one or more frameworks (this is the shared-control model in action).
  • An owner, the person accountable for it.
  • Linked evidence and tasks, the artifacts that prove it operates.
  • A status, in progress until its evidence is complete, then complete.

Mapping to requirements

A control earns its keep by satisfying requirements. One control commonly maps to several, across different frameworks, so implementing it moves multiple frameworks forward at once. Aegis maintains these mappings for you; you see, on any control, exactly which framework clauses it answers.

This is what lets a framework page show a real completion percentage: it is the proportion of the controls mapped to that framework which are complete.

Evidence and status

A control is only as real as the proof behind it. Controls carry:

  • Tasks — the recurring or one-time work that produces evidence (see Evidence & Tasks).
  • Automated evidence — pulled from integrations and cloud tests without anyone taking a screenshot.
  • Policies — the documented commitments that govern the control (see Policies).

A control with no evidence is shown as in progress, never as met. Aegis does not let an empty control quietly count toward a framework, the same honesty principle the rest of the platform holds to: absence of evidence is not evidence of compliance.

Advanced mode

By default Aegis keeps the day-to-day surface focused on the work that moves your program, policies, evidence, risks and vendors, and manages the underlying control library for you. Teams that want to work with controls directly (custom controls, hands-on mapping, granular control operations) can enable advanced mode in settings, which surfaces the full Controls workspace.

This keeps the product approachable for a first-time SOC 2 team while giving a mature GRC function the depth it expects.

Next steps

Frameworks

How controls roll up into framework coverage.

Evidence & Tasks

Produce and automate the proof behind each control.

Policies

The commitments your controls implement.

Risk Management

How risks map to the controls that mitigate them.

Contact us

Was this page helpful?