Compliance

Controls

Write the controls your organization operates, split them into subcontrols when ownership or verification differs, and map each one to every framework it satisfies, including any standard you define yourself.

NIST 800-53AC-2

SOC 2CC6.1

ISO 27001A.5.16

HIPAA§164.308(a)(4)

Organization ControlSEC-12

AC-2Access Control

Account Management

Accounts are approved, reviewed, and revoked on a defined cadence.

AC-2.1Provisioning approvalsDana R.Automated

AC-2.2Quarterly access reviewMiguel S.Manual

AC-2.3Deprovisioning within 24hPriya N.Automated

Control Management

One control, every framework it satisfies

A control is the requirement your team operates. Its implementation records how; its evidence proves it kept working. Openlane keeps all three on one record, mapped to every standard the control satisfies.

Controls that match your business

Write controls in the language your business runs on, not a generic checklist. When one control spans different owners or verification methods, split it into subcontrols so each piece is implemented, tested, and verified on its own.

Split one control into subcontrols by owner, implementation type, or verification method
Policies stay separate from the controls that put them into practice

Map once, satisfy many

Map one control to every framework it satisfies, so adding a standard expands your program instead of restarting it. A single control can answer multiple frameworks together, including any standard you define yourself.

Add a new standard with no added charge per framework
Bulk import framework controls, custom controls, or mappings via CSV

Ownership that matches who does the work

Give each control to the person who runs the process, and its status reflects the work rather than the plan. You see what is done and what is still open, per control and per owner.

Every control carries a written implementation alongside its status
Owners keep their own controls current, so the compliance lead stops chasing status

Native Integrations

Connect the tools
your team already uses

Connect the cloud and identity platforms you run so findings and directory data land next to the controls they support, with evidence tied to each control and its renewal date.