Using Keen

Frameworks, scope and shared evidence

Chapter 2 of 17

Frameworks, controls and scope

This chapter explains what a framework is in Keen, how controls and clauses are organised, how to decide what is in scope, and how one piece of evidence can count for more than one framework. Editing frameworks is an administrator's task; reading and scoping them is everyone's.

Framework

A catalogue you assess against, such as KEEN-AF or ISO/IEC 27001:2022. Keen ships 94 of them.

Control

A practice you can show evidence for, such as “backups are tested”.

Clause

A management-system requirement. Clauses can form a hierarchy and link to the controls that satisfy them.

Scope

Your decision about which controls and clauses apply to your organisation, and why.

Manage frameworks in the application

Administrators maintain frameworks in Admin → Frameworks. Everyday work there is small: pick a framework, adjust a node, save.

1. Choose Select framework to edit an existing framework, or New framework to create one. Enter a slug, name, version, description and optional upstream URL, then Save framework.
2. Choose New node to add a Clause, Control or Custom node. Give it a reference and title, then a description, an optional parent of the same category, an upstream URL, a sort order and its In scope setting. A control can also link to related clauses. Choose Save node.
3. To edit a node, select it in the searchable tree. The node you are editing is marked in the tree and stays marked after you save.

Controls, clauses and applicability

Open a control to see its description and details above a row of tabs. Requirements opens first and brings together its policies and processes, evidence and effectiveness measures, as described in Read a control's requirements. Evidence lists the events mapped to the control, including evidence it inherits from related controls. Related controls lists the controls in other frameworks that share evidence with it, Justification holds its Statement of Applicability justification for administrators, and further tabs hold its clauses, risks, interested parties, ISMS records and changes. Evidence links open the events themselves, so you can check the dates, sources and relevance behind the totals.

A clause can link to controls and supporting evidence, PESTLE(E) items, interested parties and ISMS records. When you review a clause, read its direct evidence and the context its linked controls bring.

The Statement of Applicability brings your scope decisions together for the selected framework. Record why each requirement applies and why any exclusion is justified, and revisit those notes when the business, its risks or its framework changes.

Read a control's requirements

Requirements shows what a control expects and what it has. Three tiles at the top summarise the parts below: a tick marks a part that is in place, and an exclamation mark one that needs attention. Select a tile to move to its part.

• Policies and processes lists the documents from ISMS, Policies and processes, linked to the control, with their type, how each is kept, its version and its last update. Link a document to a control from the document's own page.
• Evidence counts the events mapped to the control by source, with the latest from each; the Diary is one of the sources. Select a count to open the evidence list filtered to that source. Administrators can add Diary evidence from here: the Diary form opens with this control already chosen.
• Measures and tests lists the effectiveness measures linked to the control, with the latest result, the target and whether the result meets it. People who manage ISMS records can record a result from here; automated tests and metrics can submit results through the measurement webhook.

Design a framework and make scope decisions

Building your own framework follows the same editor. The order below keeps relationships valid as you go.

1. In Admin → Frameworks, choose an existing framework or New framework. Save the framework's metadata first.
2. Add nodes with New node: Clause, Control or Custom, with reference, title, description, sort order and upstream link. Choose a parent of the same category when you build a hierarchy.
3. For controls, select related clauses, so a clause review can draw on its controls. Evidence mappings connect events to controls separately.
4. Set In scope deliberately, then open the result to check its reference, title and relationships.
5. Review the Statement of Applicability. Record why requirements apply and why exclusions are justified. Revisit scope after a material change to services, suppliers, assets or obligations.

Use the supplied KEEN-AF controls as editable working material, and follow upstream links to authorised source material for other standards. When you assess a control's effectiveness, look at the time period, the event outcomes, the assessment rationale and whether the evidence addresses the requirement.

Reuse evidence across frameworks

The same event can support requirements in several catalogues. Two mechanisms make that happen:

• A mapping rule can target controls or clauses in more than one framework.
• An administrator can approve a directed cross-framework control relationship and record why two requirements overlap. The receiving control then shows evidence from the linked source control.

When you assess a receiving requirement, read both the relationship's rationale and the underlying evidence.

Browse related controls by framework

On a control page, Related controls has a framework selector. Choose a catalogue to see that framework's related controls, with pagination for longer lists. Expand a relationship to read its rationale, coverage and gaps.