Coverage

Overview

The Coverage view shows every control from all frameworks your organization has enabled in the Frameworks section, together with its coverage status and linked evidence. By default the view is filtered to unmapped controls (status No Coverage or Unknown), so it opens as a work queue of what still needs attention. Clear the coverage filter to see all controls, or narrow the list with the framework, coverage status, and mandatory filters.

Coverage ensures that compliance is measurable and transparent, showing whether framework controls are fully implemented, partially addressed, or missing. This provides a clear picture of your organization’s readiness and highlights areas requiring further action.

Common use cases include monitoring ISO 27001 control coverage, NIST CSF alignment, or assessing internal custom frameworks.

Core Functionality

The Coverage view lists all controls across your enabled frameworks and their associated coverage data. A search box filters by control name or ID, and faceted filters narrow the list by Framework, Coverage Status, and Mandatory. The Mapped and Unmapped figures on the dashboard's Compliance Health card link directly into this view with the matching filter preset.

For each control, you can see:

• Control ID and Control Name
• Coverage Status (implementation state)
• Whether the control is Mandatory
• Linked items such as assets, risks, and policies

Coverage Status

Each control is assigned one of the following statuses:

• Full Coverage — Control requirements are fully addressed and linked to supporting items.
• Partial Coverage — Control is only partially covered by existing items.
• No Coverage — Control has no associated items or implementations.
• Unknown — Coverage could not be determined, often due to incomplete configuration.

Controls that are covered indirectly through a cross-linked control in another framework show a link icon next to their status.

Linked Items

Linked items provide the evidence of coverage. They can include:

• Assets (e.g., systems or applications implementing security measures)
• Risks (showing threats mitigated by the control)
• Policies (documented procedures supporting the control)

By linking items directly, the Coverage view ties framework requirements to real operational data, ensuring traceability and audit readiness.

Coverage Calculation

Coverage is calculated by aggregating all coverage definitions across multiple sources for each control. When a control has coverage defined in multiple places (such as different assets, policies, or risk assessments), the system automatically determines the effective coverage using a "highest wins" principle. This means if one source indicates Full Coverage and another indicates Partial Coverage for the same control, the system will display Full Coverage as the final status.

This hierarchical approach ensures that the most complete implementation is always reflected in your compliance posture. For example, if Asset A provides partial coverage for control A.5.1 and Policy B provides full coverage for the same control, the control will show as fully covered. You can still maintain multiple partial or no coverage definitions across different sources when it makes sense for documentation purposes, but the highest completion state will determine both the displayed status and count toward your overall framework progression percentage.

The overall progression for a framework is calculated based on these winning coverage values across all controls. Each control contributes to the total based on its effective coverage status (the highest among all sources), providing an accurate representation of your organization's compliance readiness without double-counting or underestimating your actual implementation state.

Fields Explained

Best Practices

• Work the unmapped queue: The default view lists everything not yet covered; clear it only when you need the full picture.
• Maintain linked items: Regularly update linked policies, risks, and assets to keep coverage accurate.
• Focus on mandatory controls: Prioritize mandatory controls first to meet baseline compliance requirements.
• Use coverage for audits: Export or present the Coverage view during audits to demonstrate compliance evidence.
• Review unknown statuses: Investigate and resolve any controls marked as Unknown to prevent gaps.

For example, in an ISO 27001 framework, the control A.8.1 – Asset Inventory may be marked as Partial Coverage if it is only linked to IT assets but not to supporting policies. Updating the linked policy ensures Full Coverage, strengthening compliance readiness.

Related Documentation

Coverage integrates closely with:

• Frameworks — to select and manage compliance frameworks
• Controls — for detailed information on individual controls

These sections provide more detail on enabling frameworks and managing control metadata.