A compliance programme is more than a list of policies. It is a decision about what applies, a set of controls that meet it, proof those controls operate, and a record of the organisation those controls sit in. Governance & Assurance is that programme in ISMSVision.
What applies, and what covers it
Standards are published as statements. You mark which of those statements are in scope and which are not applicable. An implemented control is how your organisation meets a statement: the requirement, how you operate it, who owns it, and how often it is checked.
Coverage is the share of in-scope statements that have at least one implemented control. A statement with several controls counts once. Effectiveness looks at those covered statements: a statement is effective only when every control on it is effective.
How ISMSVision helps with implemented controls describes that record.
Proof and the audit of it
A control is tested on a cadence. Each run records effectiveness and can keep a file, a library item, a document, or a snapshot of a register. The evidence library is the store, with an expiry so old proof is not treated as current.
Evidence and tests are the operating check. Auditing is the separate programme of internal and external audits, with a question bank, a schedule, and findings raised as non-conformities, improvements, or risks.
The registers around the controls
Controls do not explain the organisation by themselves. The registers do.
- Context of the organisation records the internal and external issues that shape the system.
- Interested parties record who has needs, and which controls meet them.
- Legal, regulatory, and contractual requirements record the obligations you must follow.
- Communications plan what is told, to whom, and how.
- Metrics define what you measure. Objectives set the outcomes you are trying to reach.
What you choose to show
The Trust Centre is the published face of the same programme. You choose which documents, files, certificate marks, and articles a visitor can see, and which stay behind an access request.
Open Governance & Assurance from the application. The overview is the way in. Implemented controls, evidence, tests, the registers, auditing, and the Trust Centre are the parts you change.