A catalog statement says what a standard expects. An implemented control is the organisation’s answer: the requirement, how it is operated, who is accountable, and whether the latest tests still show that it works. One control can cover several statements.
Coverage and effectiveness
The register is the view across every control. In-scope statements are the ones not marked out of scope. Out-of-scope statements are the ones marked not applicable. Coverage is the share of in-scope statements that have at least one implemented control. A statement with several controls still counts once.
Effectiveness is read from those covered statements. A statement is effective only when every control on it is effective. A mix is partially effective. That is how the programme shows gaps: a statement with no control, or a control whose tests are not effective and in date.
What a control record is for
- What must be done. The requirement, the intention, and a status from draft through to retired.
- How it operates. The way it is implemented, when it started, and the monitoring cadence.
- Who owns it. Accountable, responsible, consulted, and informed.
- Whether it still works. Tests and evidence. The control is effective only when every test’s latest run is effective and still in date.
- What it covers. The catalog requirements it is linked to, and the risks, non-conformities, and improvements that point at it.
When you need to change it
The register, a new control, and each part of the record are described in the implemented controls register, creating an implemented control, details, implementation and RACI, testing and evidence, and links.