A framework is a standard, law or regulation you work towards, such as ISO 27001, NIS2 or GDPR. In Diri, each framework is a set of controls. When you activate a framework, Diri tracks each control's status, owner, maturity, evidence and review, and shows how far you have come.
Open Frameworks in the left-hand menu. The page has two parts:
- Active Frameworks – frameworks you are actively working toward, with their coverage.
- Available Frameworks – frameworks you can add. Many share controls you have already built.
The framework library keeps growing. Which frameworks you see depends on your plan:
- A framework with an Activate button is part of your plan.
- A framework marked Not included or with a Request access button is not in your current plan. Select Request access, add an optional message and select Send request. Our team will follow up.
- Some frameworks need a specific module, for example Privacy. The card then shows Requires and the module name, and the framework cannot be activated until the module is on.
Each card has What is included, which lists the starter content that comes with the framework. If the framework overlaps with frameworks you already have, the card also shows how many controls overlap and how many of them are already satisfied.
- Make sure you are working in the right organisation. A framework is activated for the active organisation.
- Under Available Frameworks, select Activate on the framework.
- In Add starter resources, choose the starter content you want, for example risk assessments, policies, treatments and tasks, and select Import. You own what you import and can edit or remove it at any time. Select Start empty to activate without starter content, or Cancel activation to stop.
- If the framework shares controls with work you already have, Diri offers Reuse existing evidence. Select Apply evidence to … controls to link that evidence, or Skip for now. Linked evidence still needs your confirmation before a control counts as satisfied. See Cross-framework credit.
You can add more starter content later with Add resources on the framework card. Right after an import you can also select Undo import.
If your organisation has sub-organisations or a parent organisation, Diri warns you when the same framework is already active elsewhere in the tree:
- Already active elsewhere: activating here creates a separate set of controls with its own copy of the starter content. Progress in one is not counted in the other. That is the right choice for organisations that answer for their compliance separately. Select Activate anyway to continue.
- Your parent organisation already runs this or Part of this is already done for you: activating starts this organisation's own certification. Controls the parent satisfies centrally arrive as evidence you can confirm. Select Start certification. See Shared controls.
Compliance work in a sub-organisation stays there. It is not shown or counted on the parent organisation's Frameworks page.
Above your frameworks, Diri summarises every tracked control across your active frameworks:
- Control status – Satisfied, In progress, Not started and Not applicable. Controls marked not applicable are excluded from the coverage percentage.
- Review health – whether satisfied controls are still verified: Overdue, Due soon, Current or Never verified. An overdue review does not change coverage, but the confirmation has lapsed.
- Coverage by control class – where the gaps are (Govern, Identify, Protect, Discover, Handle), for frameworks that classify their controls.
- Needs a decision – controls without an owner, framework updates to review and controls with missing evidence.
Use Cross-framework coverage to see where your frameworks overlap. See Cross-framework credit.
Select View on an active framework to open it. The framework page shows:
- Framework Scope – a statement of what the framework covers in your organisation. Select Add a scope statement… or Edit scope. The scope is printed in the Audit Evidence Report.
- Coverage – satisfied controls divided by applicable controls. Excluded controls are left out, and categories (chapters) are not counted as controls.
- Where the work is – Review health, Implementation depth (average maturity of controls that are satisfied or in progress) and Weakest categories (lowest coverage first). Select a row to filter the control list.
- The control list – in the framework's own order. Use Search controls…, the filters All, Open, Partial, Satisfied and Excluded, and Expand all / Collapse all. Select a control to work on it. See Controls and evidence.
- Compliance report – opens the Audit Evidence Report.
Select Activity on the framework card to see the framework's activity log.
When Cyrigo publishes a new version of a framework's content, your organisation receives it without losing your work. Your evidence, owners, maturity and justifications are kept.
The framework page then shows This framework has been updated. Each change is labelled New requirement, Requirement changed, Removed from framework or Reinstated, with a severity: Action required, Review or For information. Changed requirements show what the wording was and what it is now, together with your current status for the control.
- Open the framework and select Show on the update notice to see the changes.
- Go through the changes marked Action required first. These may affect compliance you have already claimed.
- Check No longer part of this framework: controls you have evidence for that were removed. Your evidence is kept, but these controls are excluded from coverage. Decide whether the work belongs to another control.
- Select Mark as reviewed. The date and who reviewed it are shown in the Audit Evidence Report.
A control whose requirement was rewritten after its last review shows the review state Requirement changed until someone reviews it again.
Open More actions on an active framework:
- Deactivate sets the framework aside and keeps everything. Deactivated frameworks are listed under Deactivated, where you can select Reactivate.
- Remove deletes your control tracking for the framework (status, owners, maturity, justifications and evidence links). Policies, tasks, treatments and risk assessments you imported or linked are not deleted. Use Deactivate if you may need the tracking again.
By default, everyone in the organisation can see which frameworks are active, their controls and coverage. Administrators can limit this:
- Go to Settings and find Framework status visibility (also reachable from Who can see status on the Frameworks page).
- Turn off Framework status is visible to everyone in the organisation.
When it is off, only administrators and people you grant framework access can see framework status. To grant it, give a role the See framework status permission in Users & Access (see Role-based access control). Everyone still sees which control requires a policy or task assigned to them, and can open controls they own. If a parent organisation has restricted framework status, a sub-organisation cannot open it up again, only restrict it further.
Whatever the setting, marking a control not applicable, accepting a gap and reassigning control ownership are restricted to administrators.