Skip to content
DeviceQuest DeviceQuest DeviceQuest Docs User Documentation

Documentation

Custom frameworks

Author your own compliance framework, add controls to it, map evidence to each control and delete frameworks or controls.

Overview

The six published frameworks cover the common standards. When your organization has its own baseline, a customer questionnaire or an internal policy to prove, author it as a custom framework. You give it a name and version, add the controls that matter to your tenant, and map evidence to each control. A custom framework sits beside the six published frameworks.

Open the Custom Frameworks tab on the Compliance page, or press g then f.

Screen tour

  1. New Framework: creates a custom framework.
  2. Expand / Collapse: shows or hides the framework’s controls.
  3. Add Control: adds a control to the framework.
  4. Delete: deletes the framework with all its controls and evidence mappings.
  5. Status: the control’s evidence status: Pass, Fail or Pending.
  6. Evidence: maps a piece of evidence to the control.

Each framework card shows the name, the version (for example v1.0), the number of controls and the description. Each control row shows the control ID, title, category, description, status, the number of mapped evidence items (n evidence), and the Evidence and Delete buttons.

Before you create your first framework, the tab shows No custom frameworks yet and a Create your first framework button.

Create a framework

  1. Name: the framework name, for example Internal security baseline. Required.
  2. Description: what the framework covers.
  3. Version: your version label, for example 1.0.
  1. On the Custom Frameworks tab, click New Framework.
  2. Enter the Name, and optionally a Description and Version.
  3. Click Create Framework.

Framework names are unique in your tenant.

Add a control

  1. Control ID: your identifier, for example CC6.1. Required.
  2. Title: a short name for the control. Required.
  3. Description: what the control requires.
  4. Category: a grouping, for example Access Control.
  1. On the framework card, click Add Control.
  2. Enter the Control ID and Title, and optionally a Description and Category.
  3. Click Add Control.

Control IDs are unique within a framework. Click Expand to see the new control.

Map evidence to a control

An evidence mapping tells DeviceQuest which piece of evidence proves a control, for example an asset observation or an uploaded file.

  1. Evidence Type: the kind of evidence, for example asset_observation. Required.
  2. Evidence Reference: the observation key or file ID that identifies the evidence. Required.
  1. Click Expand on the framework card.
  2. On the control row, click Evidence.
  3. Enter the Evidence Type and Evidence Reference.
  4. Click Add Evidence.

The control’s evidence count goes up by one. The new mapping starts as Pending until it is evaluated.

Delete a framework or control

  1. Click Delete on the framework card, or on a control row.
  2. In Confirm Delete, read Are you sure you want to delete this framework? This action cannot be undone. (or …this control?…).
  3. Click Delete, or Cancel to keep it.

Deleting a framework also deletes all its controls and evidence mappings.

Fields

Framework

FieldDescriptionRules
NameThe framework nameRequired; unique in your tenant
DescriptionWhat the framework coversOptional
VersionYour version labelOptional

Control

FieldDescriptionRules
Control IDYour identifier for the controlRequired; unique within the framework
TitleShort nameRequired
DescriptionWhat the control requiresOptional
CategoryGrouping such as Access ControlOptional

Evidence mapping

FieldDescriptionRules
Evidence TypeThe kind of evidence, for example asset_observationRequired
Evidence ReferenceThe observation key or file IDRequired

Statuses

A control’s status comes from its evidence mappings.

StatusMeaningNext possible status
PendingThe control has no evidence mappings, or at least one mapping is still waiting to be evaluatedPass or Fail once its evidence is evaluated
PassEvery mapped piece of evidence passesFail if any evidence starts failing
FailAt least one mapped piece of evidence failsPass when all evidence passes again

Permissions

ActionPermission
View custom frameworks and their controlscompliance:read
Create and delete frameworks and controls, add evidence mappingscompliance:write