Regulatory Framework Mapping (Pro)

This feature requires the Dantian Policy Management Pro add-on.

The Regulatory Frameworks feature lets you map your documents to specific controls in compliance standards. This provides structured evidence that your policies and procedures cover each required control — the kind of evidence a certification body, regulator, or external auditor expects to see.

The Free plugin includes the Regulatory Framework taxonomy itself: you can build a framework hierarchy, tag documents with controls in the editor, and import or export frameworks and document assignments by CSV. The Pro add-on adds the curated Framework Library, the Coverage & Gaps readiness matrix and survey export, a Framework Editor for custom frameworks, and optional AI tools (control briefs and a per-document Compliance Audit). Pro features need an active Pro licence.

Supported frameworks

The Pro add-on ships with a curated Framework Library that includes:

Australian Privacy Principles (APP)
CCPA / CPRA (California)
FERPA (US)
GDPR (EU)
HIPAA Privacy Rule and HIPAA Security Rule (US)
ISO 9001:2015 (Quality Management)
ISO 14001:2015 (Environmental Management)
ISO/IEC 27001:2022 (Information Security Management)
NDIS Practice Standards (Australia)
NHS Data Security and Protection Toolkit (DSPT) (UK)
NIST Cybersecurity Framework 2.0
PCI DSS v4.0
RTO Standards 2025 (Australia)
SOC 2 — Trust Services Criteria
UK GDPR + Data Protection Act 2018

Library definitions contain control codes and structural information only — no copyrighted standard text is bundled. Refer to the issuing body for the current full text of any standard.

You can also create custom frameworks for internal standards, industry codes, or any other compliance requirement specific to your organisation.

How framework mapping works

Each framework is made up of controls — specific requirements the standard demands. For example, ISO/IEC 27001:2022 control A.5.1 is “Policies for information security”.

When you map a document to a control, you are asserting that this document provides evidence of how your organisation meets that control. A document can be mapped to multiple controls across multiple frameworks.

Setting up framework mapping

Step 1: Enable the feature

Go to Policy Management → Settings → Features and tick Enable Regulatory Frameworks. It is off by default.

With Pro, the Frameworks and Coverage & Gaps menu items are visible even while the feature is off. Opening either one (or a bookmarked Framework Editor link) shows Regulatory Frameworks are turned off with an Enable Regulatory Frameworks button, so you can switch it on from there.

Once enabled, a Regulatory Frameworks panel appears on every document edit screen.

Step 2: Install a framework from the catalogue

Go to Policy Management → Frameworks (the Regulatory Framework Library page). You need the Manage settings capability.
Search by name, or filter by Region, Industry or Category / Family.
Click Preview to see a framework’s details and controls, if you like.
Click Install next to the framework you need. Its controls are added under the Regulatory Framework taxonomy and become available for mapping.

Installed frameworks show Installed and offer Manage (open the Framework Editor) and Uninstall. Uninstalling removes the framework’s controls; documents mapped to them lose those mappings.

Step 3: Map documents to controls

Open any document in the editor.
In the sidebar, find the Regulatory Frameworks panel.
Tick the controls that this document provides evidence for.
Save the document.

Repeat for all relevant documents. A single document can satisfy multiple controls across multiple frameworks. You can also map documents from the Coverage & Gaps page (below), or in bulk by CSV.

The framework compliance view

Once your documents are mapped, go to Policy Management → Coverage & Gaps to see how well each framework is covered. Choose a Regulatory Framework and click View coverage.

The page opens with a readiness scorecard — the percentage of controls covered and how many controls are:

Ready (green) — at least one in-force document is mapped, and every mapped document is fully acknowledged, within its review date and (if owner attestation is on) signed off by its owner
Attention (amber) — mapped, but a document has incomplete acknowledgements, an overdue review, or a pending owner sign-off
Gap (red) — no document is mapped to the control

Below the scorecard, the matrix lists every control with its Status, Control, Mapped Documents, Ack Rate, Owner Attested, Review Due and Waivers. You can filter by status, sort the columns, and switch between an Overview (coverage by theme) and All controls.

The matrix is cached for 5 minutes; click Refresh to recompute it immediately. Recording an acknowledgement or saving a document also refreshes it.

This view tells you not just whether you have a policy covering each control, but whether staff have actually read and acknowledged the relevant document — which is what a well-run compliance programme requires.

The Document Compliance dashboard also shows a Frameworks column and a framework filter while this feature is enabled.

Who can do what on this page: anyone with permission to view acknowledgements (Administrators and Policy Auditors by default) can see the scorecard and matrix. Closing gaps, opening a control’s coverage detail and exporting the survey packet need permission to manage acknowledgements (Administrators by default), so a Policy Auditor sees a read-only matrix.

Closing gaps from the matrix

Each Gap row offers two actions:

Map policy — opens a searchable list of published documents that aren’t already mapped to this control. Click Map next to the right one. The control’s status is recalculated straight away and the totals update. You can only map documents you are allowed to edit.
+ Create — creates a new draft document titled “Document for” followed by the control’s name, already mapped to the control, and opens it in the editor. Write and publish it as normal. You need permission to create documents.

Coverage detail for a control

Click a control to open Coverage detail for it. For each mapped policy you see whether it is in force, whether it requires acknowledgement, and any issue holding it back from Ready (for example incomplete acknowledgements, an overdue review or a pending owner sign-off), with an Ack report link to its acknowledgement report. If nothing is mapped yet, you can Map a policy to this control from the same panel.

The Framework Editor

The Framework Editor is where you look after a single framework. Open it by clicking Manage next to an installed framework, or next to one of Your custom frameworks, on the Policy Management → Frameworks page. You need the Manage settings permission (Administrators by default). There is no separate menu item for it, and Back to Framework Library returns you to the list.

What you can change depends on the kind of framework:

Section	Curated (library) framework	Custom framework
Definition — name, description	Read-only	Editable
Controls — add, nest, remove, bulk import	Read-only	Editable
Advanced source settings	Not shown (the publisher link is shown read-only)	Editable
Corpus — reference material for the AI	Yours to manage	Yours to manage
Briefs — AI summaries per control	Yours to manage	Yours to manage

To uninstall a curated framework, use Uninstall on the Framework Library page, not the editor.

Advanced source settings (custom frameworks, optional — open the Advanced source settings panel):

Setting	What it does	Default	Allowed values
Publisher URL	A help link shown with the framework. For a paid standard, link to the publisher’s purchase page.	Empty	A web address
Source host allowlist	The only websites the auto-fetch tool may download the primary standard from	Empty	One host per line, for example `nist.gov`
Auto-fetch	Lets the AI suggest a primary-standard address within the allowlist	Off	On or off. When you switch it on for a custom framework, you are vouching that the hosts you list are proper sources of the standard.
Brief token target	Length of each control brief for this framework	0 (use the site-wide default)	0–2,000 tokens, in steps of 50; 200–800 is the suggested range
Primary-section cap (chars)	How much primary-standard text is sent with each control during a Compliance Audit	0 (use the default of 6,000 characters)	0–20,000 characters. Raise it for long-winded standards; lower it to keep audits cheaper.

AI control briefs (optional)

With AI features enabled, the Pro add-on can generate a brief for each control — an AI summary of what the control requires, based on the control text and any reference material you upload. Briefs help you interpret a control and are used as context by the Compliance Audit. See AI-Assisted Workflows for how to switch AI on and add your provider key.

All the tools in this section live in the Framework Editor and need the Manage settings permission. Each one sends text to your AI provider and is charged to your own account.

Framework AI settings and cost guards

Go to Settings → AI & Automation and open Framework AI — Models & Cost Guards. This panel only appears while Regulatory Frameworks is switched on.

Setting	What it does	Default
Reference doc classification model	Model used by Suggest with AI and by the auto-fetch tool	Claude Haiku 4.5
Brief generation model	Model used to write control briefs	Claude Sonnet 4.6
Compliance audit model	Model used by the Compliance Audit	Claude Opus 4.7
Brief target length (tokens)	Default brief length (each framework can override it)	400 (allowed 100–2,000)
Cost guard — classification (cents)	Ask for confirmation before a classification estimated to cost more than this	5¢
Cost guard — brief generation (cents)	Ask for confirmation before a brief rebuild (single or bulk) estimated to cost more than this	50¢
Cost guard — compliance audit (cents)	Ask for confirmation before an audit estimated to cost more than this	200¢

Each model list shows Anthropic Claude and OpenAI GPT models with their price per million tokens. Cost guards accept 0–10,000 cents. They are warnings, not spending caps — you can still choose Proceed.

Allow AI audit on restricted documents (off by default) sits in the AI Content Privacy section of the same tab. See Running a Compliance Audit below.

Uploading reference material (the corpus)

The Corpus section holds two kinds of source material:

Primary standards — the publisher’s own text of the standard.
Organisation reference documents — your interpretation guides, advisory notes, prior audit reports and the like.

To add a file:

In Add a corpus document, choose the File (PDF, DOCX, TXT or MD, up to 25 MB).
Enter a Title.
Choose the Kind — primary standard or organisation reference.
Under Applies to, choose Applies broadly to all controls or Select specific controls below, then pick the controls (hold Cmd/Ctrl to select several). Picking specific controls is recommended for reference documents — it produces better-targeted briefs.
Click Upload Document.

Text is extracted as soon as you upload. DOCX, TXT and MD extract most reliably. Scanned, image-only PDFs can’t be read unless your server has OCR software installed, so prefer DOCX or text files where you can. Corpus files are stored privately — they never appear in the Media Library or on your site.

Reviewing extracted text: click Review text next to a file to check what was extracted, and correct layout problems such as two columns run together. Click Save changes; future briefs and audits use your corrected text. Click Remove to delete a file.

Suggesting controls with AI

When you upload a reference document, Suggest with AI can propose which controls it applies to, so you don’t have to work through a long control list by hand.

Choose the file in Add a corpus document.
Click Suggest with AI. If the estimated cost is above your classification cost guard, confirm first.
The AI suggestions are grouped as Strong, Possible and Tentative. Strong and possible matches are pre-selected in the control list; click a tentative match to add it.
Review the selection, then click Upload Document.

The file isn’t stored during the suggestion step — only when you upload it. Treat the suggestions as a starting point; your own reading usually gives better-targeted results.

Auto-fetching a primary standard

For frameworks that allow it, the plugin can find and download the publisher’s primary standard for you instead of you uploading it. The Auto-fetch primary standard from publisher button appears in the Corpus section only when the framework has Auto-fetch switched on and at least one allowed host. Among the library frameworks, NIST Cybersecurity Framework 2.0 ships with auto-fetch set up; for a custom framework, set it in Advanced source settings. The allowed hosts are listed next to the button.

Click Auto-fetch primary standard from publisher.
Click Suggest URL. The AI proposes a download address on one of the allowed hosts.
Check the Suggested URL and click Fetch + verify (or Back to ask again).
The plugin downloads the file and asks the AI whether it really is this framework. You see the AI verification result — Match, No match or Uncertain, with a short reason — and the first 800 characters of the content.
Optionally enter a Title (it defaults to the file name), then click Confirm — save as primary standard. Or click Cancel to discard the download.

The result is stored exactly like a primary standard you uploaded yourself.

Limits and safeguards:

The plugin only downloads from the allowed hosts, even if the AI suggests something else, and refuses any redirect that leads off the list (up to 5 redirects are followed).
The file must be PDF, DOCX, TXT or MD, no larger than 25 MB, and its type must match its extension.
A downloaded file waits for your confirmation for 1 hour. After that it’s discarded, and you’ll need to fetch it again.

Generating and rebuilding control briefs

The Briefs section lists every control with its Status, when it was Last generated, and the Model used. It also shows when briefs were last run and the total AI cost spent on this framework so far.

Fresh — the brief matches the current source material.
Stale — reference material or control assignments have changed since the brief was written.
Not generated — no brief yet.

To build briefs:

Click Rebuild on one control, or Rebuild stale briefs / Rebuild all briefs (each shows how many controls it covers).
The plugin estimates the cost first. If it’s above your brief cost guard, a Confirm AI cost dialog asks you to Proceed or Cancel.
During a bulk rebuild, click Stop to finish the current control and stop there.
Click View brief to read a brief, with the model and date it was generated.

Briefs are generated on demand and stored — they are not regenerated on every page load or on a schedule. Without organisation reference material, briefs are short one-sentence baselines; the section tells you when that’s the case. Briefs can’t be generated until the framework has controls.

Running a Compliance Audit

The Compliance Audit checks a document’s wording against each control it is mapped to. Anyone who can edit the document can run it.

Open a document mapped to at least one control. The Compliance Audit box shows how many controls are mapped, how many of their briefs are fresh, stale or missing, the estimated cost and the model.
Click Run Compliance Audit. If the cost is above your audit cost guard, confirm first. Controls are audited one at a time and progress is shown as it goes.
Each control is rated Adequate, Needs expansion or Missing coverage, with the section concerned, the reason, and proposed text where something is missing.
For each finding choose Accept, Edit (then Save edit + Accept), Reject or Snooze.
Click Apply (the button shows how many accepted edits there are) and confirm that you want to submit them for approval.

What happens to accepted findings: they go to the moderation queue — the Edit Suggestions screen — marked Source: AI Compliance Audit, with the control codes involved. The document isn’t changed until a user with permission to approve edits (by default, Administrators and Editors) approves them. On approval, each proposed passage is inserted after the paragraph the AI quoted, or, if that paragraph can’t be found, added at the end of the document under a Compliance audit updates heading, and a new version entry is created. Rejecting discards the change. The Edit Suggestions menu item only appears while Edit Suggestions is switched on under Settings → Features, so switch it on if your approvers need to find the queue.

Finding labels you’ll see: Pending review, Accepted — queued, Staged — awaiting approval, Applied to document, Rejected and Snoozed.

Previous findings are kept with the document. If its content has changed since the last audit, the box warns that the findings may be stale — run the audit again to refresh them, or use Dismiss prior findings to clear them.

Limits: up to 20,000 characters of the document, plus the control’s brief and up to 6,000 characters of the primary standard (or the framework’s Primary-section cap), are sent for each control. For a very long document, only the first 20,000 characters are checked.

Confidential documents can never be audited. Restricted documents are blocked by default along with other AI features; if your AI privacy settings allow Restricted documents, you’ll be asked to confirm before each audit unless Allow AI audit on restricted documents is switched on. See AI-Assisted Workflows for the full privacy rules.

Custom frameworks

If you need to track compliance against a framework not in the catalogue, or an internal standard:

Go to Policy Management → Frameworks and click Create Custom Framework.
Enter the Framework name and an optional Description.
Optionally paste Initial controls, one per line, as CODE,Title or CODE,Title,parent_code to nest a control under another.
Click Create Framework.

After creating it, you can add more controls with Add a single control (choose where to nest it with Nest under) or Bulk import controls (paste CSV), and remove controls you no longer need. Your custom frameworks are listed under Your custom frameworks on the Framework Library page, and are available in the document editor for mapping, exactly like the built-in frameworks.

Curated frameworks can also be opened in the Framework Editor, but their name and controls are read-only; only the Corpus and Briefs sections are yours to edit.

You can also import a framework structure from a CSV file: go to Policy Management → Tools → Framework CSV Import, click Download Template (columns level_1 to level_5), fill in your hierarchy, and click Import Frameworks. Existing terms are reused and missing ones are created. (This tool is part of the Free plugin.)

Framework CSV export

Export your framework mapping — every document and the framework controls it is mapped to — as a CSV for audit submissions, spreadsheet reports, or external audit tools. This is part of the Free plugin.

Go to Policy Management → Tools → Framework CSV Import, and in Document Framework Assignments click Export Assignments CSV. From the same section you can also:

Export Framework Paths CSV — every framework path on your site, for reuse in an assignment file
Download Assignment Template — a blank template
Import Assignments — upload an updated file (columns post_id and framework_paths; use ” > ” between hierarchy levels and ” | ” between multiple frameworks). Only the framework assignments of the listed documents are changed.

The Accreditation Survey

The Pro add-on’s Coverage & Gaps page (above) doubles as a pre-audit self-assessment tool, giving you a clause-by-clause readiness matrix for each framework. There is no separate questionnaire to fill in — status is calculated automatically from your mappings, acknowledgements, review dates, owner sign-offs and waivers.

When you’re ready to hand evidence to an auditor, click Export Survey Packet (ZIP). The packet contains the readiness matrix as a CSV plus a manifest with a SHA-256 integrity signature.

Running the survey:

Go to Policy Management → Coverage & Gaps. You need permission to view acknowledgements to see the matrix, and permission to manage acknowledgements to close gaps and export.
Select the framework you are preparing for and click View coverage.
Work through the Gap and Attention controls — map or create policies, chase acknowledgements, and complete overdue reviews and owner sign-offs.
Click Export Survey Packet (ZIP) to download the evidence packet. While gaps remain, the page nudges you to view the gaps first, but you can export at any time.

For a full acknowledgement evidence bundle (attestation PDF, version PDFs, exception lists), use the Evidence Pack described in Per-Document Compliance Dashboard.

Troubleshooting frameworks

Frameworks or Coverage & Gaps says “Regulatory Frameworks are turned off”. Click Enable Regulatory Frameworks on that page, or switch it on under Settings → Features.

A control stays Attention although the policy is mapped. Open the control’s coverage detail. The usual causes are acknowledgements still outstanding (the control needs every mapped document fully acknowledged), a review date in the past, or an owner sign-off still pending. Click Refresh if you’ve just fixed something and the matrix was cached.

Map policy says there are no other published policies to map. Only published documents not already mapped to the control are listed. Publish the draft first, or use + Create.

A Policy Auditor can’t see Map policy, + Create or the export button. That’s expected — those actions need permission to manage acknowledgements.

The auto-fetch button doesn’t appear. The framework must have Auto-fetch switched on and at least one host in its Source host allowlist.

Auto-fetch refuses the download. Check the error: the address may be on a host that isn’t allowed, redirect off the allowed list, be larger than 25 MB, or be a different file type from its extension. If the verification says No match, cancel and upload the standard yourself.

“Staged download has expired”. Downloads wait 1 hour for your confirmation. Fetch it again.

A reference PDF extracts as gibberish or nothing. It is probably a scanned image or a two-column layout. Use Review text to fix it, or upload a DOCX or text version instead.

Briefs show as Stale after I uploaded a file. That’s expected — changing the corpus or which controls a file applies to marks the affected briefs stale. Click Rebuild stale briefs.

The Compliance Audit box says the document has no controls mapped. Tick at least one control in the document’s Regulatory Frameworks panel and save.

My accepted audit findings didn’t change the document. They are waiting for approval on the Edit Suggestions screen. If you can’t see that menu item, switch on Edit Suggestions under Settings → Features.

Worked example: getting ready for an ISO/IEC 27001 surveillance audit

Sam is the information security officer at a software company with a certification audit in six weeks.

Sam switches on Enable Regulatory Frameworks, opens Policy Management → Frameworks, filters by Category / Family, and clicks Install on ISO/IEC 27001:2022.
Sam opens Coverage & Gaps, chooses ISO/IEC 27001:2022 and clicks View coverage. The scorecard shows 31% covered, with many controls in red.
For control A.5.1 “Policies for information security”, Sam clicks Map policy, searches “security”, and clicks Map next to the existing Information Security Policy. The row turns amber because only 80% of staff have acknowledged it.
For a gap with no policy at all, Sam clicks + Create. A draft called “Document for …” opens in the editor, already mapped to the control, ready to write.
Sam clicks Manage on the framework, uploads last year’s audit report to the Corpus as an organisation reference document, uses Suggest with AI to pick the controls it covers, then clicks Rebuild stale briefs and confirms the estimated cost.
On the Information Security Policy, Sam runs a Compliance Audit. Two controls come back as Needs expansion. Sam edits one proposed paragraph, accepts both, and clicks Apply. The Head of Engineering approves them on the Edit Suggestions screen, and a new version is created.
Over the following weeks, Sam chases acknowledgements and signs off overdue reviews until most controls are Ready. The week before the audit, Sam clicks Export Survey Packet (ZIP) and generates an Evidence Pack for the auditor.

Was this helpful?