This guide is for groups where a parent organisation and its subsidiaries (sub-organisations in Diri) work towards the same framework.
Much of the work is often done once, centrally: one information security policy, one risk process, one set of procedures. Without shared controls, each subsidiary would file its own copy of work it did not do, and an auditor would see several versions of the same document. With shared controls, the parent decides for each control who answers for it. Where the parent answers, the subsidiaries receive the evidence as well as the assurance, so they can show it to their own auditor.
Each organisation still activates the framework itself and answers for its own certification. See Frameworks.
Afterwards, Diri shows What this changed for the organisations below: how many documents became readable, and which items could not be shared (for example a document that no longer exists, or a link, which they can follow themselves).
Nothing is copied. Each sub-organisation reads the decision from the nearest organisation above it, so a sub-organisation created or activated later is covered by a decision you make today. The Shared controls view shows how many sub-organisations have the framework active; the rest pick up the decision when they activate it.
Shared evidence is read-only for the sub-organisations: they can open and present it, never change it. Some kinds of records cannot cross an organisation boundary, and the screen says so. If you have shared controls but some linked items are not visible to the sub-organisations, Diri lists them under Sub-organisations cannot open … linked item(s) and lets you select Share with sub-organisations.
In both cases, evidence that was readable only because of these controls stops being readable. A document that another shared control still relies on stays available, and a document someone shared by hand is not affected.
If an organisation above you has already decided for a control, you can only ask more of your own sub-organisations, never less. Choosing a setting that asks for more local work than the group requires asks you Why are you departing from the group?, so the group can see where its coverage was not enough. Changes that would ask less are refused and listed.
Select the Status by organisation view to see each sub-organisation that runs the framework, with its own coverage, how many controls it has confirmed as covered centrally, and where it has chosen to go further than asked (select Show why … departed from the group). This view is read-only.
Controls an organisation above you satisfies are marked Centrally in the control list, and listed in the Satisfied centrally view of the framework.
A confirmed control can still show as Partial. That is not a fault: it means the organisation answering for the control has not finished it yet. Your control stays partial until they do, however much you add locally, or until you satisfy it yourselves. If the control is set to Downwards, with local evidence, you must also add your own evidence.
If central work is not arriving, or you need to go further than the group, you are never stuck:
You can hand the control back at any time with Go back to …'s coverage.