Frameworks & Controls

zGovern ships with 482 pre-built controls across 18 compliance frameworks, organised into five categories. Each control includes plain-English guidance, evidence requirements, and testing frequency — ready to use on day one.

What is a Framework?

A compliance framework is a structured set of controls (requirements) published by a standards body or regulatory authority. Organizations demonstrate compliance by satisfying every applicable control in a framework through documented evidence, policies, and processes.

zGovern lets you activate multiple frameworks simultaneously. A single piece of evidence (e.g., an MFA policy screenshot) can satisfy controls across multiple frameworks at once, eliminating duplicate work.

Supported Frameworks

Frameworks are organised into five categories. You can activate any combination simultaneously — controls and evidence are automatically shared across frameworks via cross-framework mappings.

Security

Privacy

Industry

Business / Operations

AI Governance

Control Anatomy

Each control in zGovern has the following fields:

Example Control

Here is an example of a real control as returned by the API:

{
  "id": "clxr8k2vp0001lg3a4b5c6d7e",
  "code": "CC6.1",
  "title": "Logical and Physical Access Controls",
  "category": "Logical Access",
  "priority": "HIGH",
  "plainEnglish": "Ensure that only authorised individuals can access systems and data. This includes user provisioning, MFA enforcement, and regular access reviews.",
  "evidenceRequirements": "1. MFA policy screenshot\n2. User access list export\n3. Access review sign-off document\n4. Termination checklist for 3 sample leavers",
  "testingFrequency": "QUARTERLY",
  "controlStatus": "IN_REVIEW",
  "dueDate": "2026-06-30T00:00:00.000Z",
  "owner": {
    "id": "clxr8k2vp0002lg3a9b1c2d3e",
    "firstName": "Sarah",
    "lastName": "Chen"
  }
}

Control Statuses

Every control moves through a defined lifecycle:

Control Ownership

Assigning an owner to each control is essential for accountability. Owners receive email notifications when:

• An automated monitoring check linked to their control fails
• Evidence they uploaded is rejected by an auditor
• A control's due date is approaching (7-day and 1-day warnings)
• A control's testing frequency window has elapsed

To assign an owner, open a control in the Audit Workspace and select a user from the Owner dropdown. Any ADMIN or AUDITOR user can be assigned as a control owner.

Evidence Checklist

Each control has an evidence checklist — a structured list of specific artifacts that must be collected and approved. Checklist items are derived from the control's evidenceRequirements field and are created automatically when you activate a framework.

Each checklist item has an approval status:

Evidence files are uploaded via the Audit Workspace. Files linked to integrations are tagged with an [Auto] prefix and highlighted in blue — these do not require manual upload.

How to Complete a Control

1. Open the Audit Workspace

   Navigate to Audit Workspace in the sidebar and select your framework from the dropdown filter.

2. Find the control

   Use the search box or filter by category. Click any control row to expand it.

3. Read the plain-English description

   The Plain English tab explains exactly what this control requires in simple language, without legal jargon.

4. Review the evidence checklist

   Each checklist item specifies a particular artifact. Check items already collected automatically by integrations — these are marked [Auto].

5. Upload evidence files

   For each remaining checklist item, click Upload Evidence and attach the relevant file (PDF, PNG, CSV, etc.). Files are stored securely and linked to this specific control.

6. Update the control status

   Once all evidence is uploaded, change the status to IN_REVIEW. An auditor will then review and approve or reject your evidence.

7. Respond to rejection notes

   If evidence is rejected, you'll receive a notification with a specific note. Address the feedback and re-upload the corrected evidence.