Framework Workbench
Visualize controls and capture assessment evidence in one place. Add interview notes and paste tool output directly against each framework control.
Organize interview evidence and scan output by core cybersecurity functions.
Autosaved locally
Govern
gv-1
Risk management strategy
Define how cybersecurity risk is identified, assessed, and managed.
gv-2
Roles and accountability
Establish ownership for cybersecurity decisions and operations.
Protect
pr-1
Identity and access management
Ensure users and systems get least-privilege access to resources.
pr-2
Awareness and training
Train personnel to recognize threats and follow secure practices.
Detect
de-1
Anomaly and event detection
Identify abnormal behavior and potentially malicious activity.
de-2
Continuous monitoring
Monitor systems and networks for security-relevant events.
Respond & Recover
rs-1
Incident response execution
Contain, eradicate, and communicate during active incidents.
rc-1
Recovery planning and lessons learned
Restore services and improve controls after incidents.
Assessment Guidance
Use interview notes to capture policy/process context and tool output for technical evidence. Controls marked as gaps can be prioritized for remediation planning and final reporting.