Custom frameworks · OSCAL ready

Author your own controls. Map them once. Reuse forever.

Build internal policies, sector regulations, customer questionnaires, or hybrid frameworks. Use the same evidence engine, the same workflows, the same auditor exports as our catalog frameworks.

Request a demo Compliance workspace

controls / acme-sec.oscal.json

{
  "id": "ACME-SEC-001",
  "title": "Privileged access",
  "owner": "platform-eng",
  "frequency": "quarterly",
  "maps_to": ["CC6.1", "A.5.15"],
  "evidence": ["okta.access_review"],
  "tests": 4
}

What custom is for

Six categories, one engine

Internal

Group security policy

Enterprise-wide controls codified once, mapped to every framework.

Customer

Strategic security review

Bank- or insurer-grade questionnaires answered from live evidence.

Industry

NIS2 / DORA

Sector regulations not yet in our catalog — author once, reuse.

Regional

PIPL / LGPD / POPIA

Country-specific privacy regimes alongside GDPR / DPDP.

Sectoral

FedRAMP, IRAP, CMMC

Government baselines mapped to your control library.

Prop.

Customer-defined

When a single customer's security review becomes a recurring program.

Import or author

Bring your library — or start fresh

OSCAL-native ingestion, plus structured editors and bulk import for everything else.

OSCAL JSONNative NIST format

XLSX / CSVStandard spreadsheet

Word + ExcelDocument + matrix combos

APIProgrammatic via REST

Many-to-many mapping

Author once, satisfy many frameworks

Custom controls map cleanly to catalog frameworks. Evidence collected once feeds every audit.

ACME-SEC-001Privileged access management

CC6.1 (SOC 2)A.5.15 (ISO)Art 32 (GDPR)

ACME-SEC-014Change management discipline

CC8.1 (SOC 2)A.8.32 (ISO)

ACME-SEC-027Vulnerability management cadence

CC7.1 (SOC 2)A.8.8 (ISO)164.308 (HIPAA)

ACME-SEC-042Vendor security oversight

CC9.2 (SOC 2)A.5.19 (ISO)

Catalog frameworks

Map your custom controls to

SOC 2Trust services criteria controls and evidence ISO 27001ISMS controls and continuous monitoring DPDPIndia Digital Personal Data Protection framework IT Act / CERT-InIndian cyber compliance requirements GDPREU data protection requirements and controls HIPAAHealthcare data security and privacy controls PCI DSSPayment card data security standard controls

Your controls. Our engine.

Bring your control library and let it inherit every workflow, evidence integration, and auditor export the catalog frameworks already use.

Request a demo Compliance workspace