Openlane
Custom frameworks icon

Custom frameworks

Define the controls your business follows, import a standard we do not list, and map either one to the frameworks you already run at no added charge per standard.

No credit card. 30-day free trial.

Frameworks built from the controls you already run

A customer's control set, a regulator's rulebook, or your own policy becomes a framework with the same owners, evidence, and mappings as a built-in standard.

Framework import

Bring in any framework as a CSV of controls. Define the control families, identifiers, and descriptions, and each row becomes a control with an owner and an evidence link.

  • Bulk control import via CSV
  • Controls created by hand in the console

Internal policy management

Treat your own security policies and governance standards as a framework. Each internal control gets the same owner, evidence, and review cadence as a published standard.

  • Internal controls beside industry standards
  • Same evidence record for both

Cross-framework mapping

Map custom controls to SOC 2, ISO 27001, NIST, or any other framework you run. One implementation satisfies every mapped control, and a gap shows up as a control without evidence.

  • One control, many frameworks
  • Evidence reused across mappings

Evidence on your terms

Define what evidence each control needs and how often it renews. Attach any document type, and stale artifacts surface before a reviewer finds them.

  • Any file type as evidence
  • Renewal dates per artifact

Standards we do not list

Need a framework we do not list? Import StateRAMP, TISAX, a regional regulation, or a customer's own questionnaire and map it to the controls you already run.

  • Regional and industry frameworks
  • Customer-required control sets

Control history

Every change to a control is kept with who made it and when, so you can update a framework and still show what a control said when its evidence was collected.

  • Change history on every control
  • Review and rollback through the API
Part of Compliance

Bring the framework nobody else lists

Import your controls via CSV and map them to the standards you already run.

Request a Framework

No credit card. 30-day free trial.

Frequently asked questions

Custom framework basics

What is a custom framework in Openlane?

A custom framework is any set of controls you bring into Openlane that we do not list as a built-in standard: internal security policies, an industry standard we do not yet ship, a customer's security requirements, or a regional regulation. You decide how the controls are defined, organized, and assessed.

Why would I need a custom framework?

To run internal security policies with the same rigor as an external standard, to meet an industry framework Openlane does not yet ship (such as TISAX or StateRAMP), to answer a customer's specific control set, or to manage a regional regulation. Custom frameworks keep all of it in one program.

Can I use custom frameworks alongside built-in frameworks?

Custom and built-in frameworks share the same control model. Map controls between them, reuse evidence across all of them, and manage everything in one place, so overlapping controls are implemented once.

What formats can I use to import a custom framework?

Import controls in bulk via CSV, or create them by hand in the console. Each control carries an identifier, a family or domain, a description, and the evidence it needs, and you can map it to other frameworks in the same import.

Implementation and management

How do I structure a custom framework?

Group controls into families or domains, give each control a unique identifier and a description, and record the evidence it needs, how often it is assessed, and who owns it. Split a control into subcontrols when ownership or verification differs. The CSV import follows the same structure.

Can I map custom controls to other frameworks?

Map a custom control to its equivalent in SOC 2, ISO 27001, NIST, or any other framework you run. Where controls overlap, you implement once and the evidence satisfies every mapped framework, which is what keeps a multi-framework program from multiplying the work.

How do I update or modify a custom framework?

Edit controls in the console or re-import an updated CSV. Every change is kept with who made it and when, so you can see what a control said when its evidence was collected. Evidence attached to controls you did not change stays where it is.

Can I share custom frameworks across my organization?

A custom framework belongs to your organization, so multiple teams can work from it, assign controls to different owners, and collaborate on evidence. Access is layered by organization, group, program, and object, so you decide who can view, edit, or delete it.

Common use cases

How do I use custom frameworks for internal policies?

Import your security policies, acceptable use policy, data classification rules, or other internal standards as a framework. Assign an owner to each control, attach evidence of implementation, schedule reviews, and report status to leadership from the same record as your external frameworks.

Can I import frameworks requested by customers?

Import a customer's security requirements as a custom framework, map them to the controls you already operate, and the unmapped rows show you the gaps. Track remediation against each gap and share status during the customer's vendor assessment.

What if I need a framework that Openlane does not list?

Import it as a custom framework and map it to the controls you already run; StateRAMP, TISAX, and regional regulations are common examples. If you would rather see it shipped as a built-in standard, use Request a Framework and we will tell you where it stands.

© Copyright theopenlane, Inc. All Rights Reserved.

Openlane on Product Hunt
California Consumer Privacy Act (CCPA) Opt-Out IconYour Privacy ChoicesNotice at Collection