Framework assessments

Supported frameworks

Radius360 ships with the following frameworks pre-loaded. Each one includes its full control library, descriptions, and cross-framework mappings.

• SOC 2 Type II (Trust Services Criteria)
• ISO 27001:2022 and ISO 27002
• NIST CSF v2.0 and NIST 800-53
• HIPAA Security and Privacy Rules
• PCI DSS v4.0
• CMMC Level 1 and Level 2
• GDPR
• NIS2
• FDA 21 CFR Part 11 and GxP
• CIS Controls v8
• ISO 42001 (AI management systems)
• EU AI Act risk tiers
• NIST AI RMF
• Plus industry-specific frameworks: HITRUST, StateRAMP, FedRAMP Low, and others

Activating a framework

Frameworks can be activated during client onboarding (the wizard asks which frameworks apply) or added later from Frameworks, Activate Framework.

1. 1
   Pick the framework from the catalog.
2. 2
   Optionally pick a scope (full framework, or a specific scope like "SOC 2 Security Trust Service only").
3. 3
   Click Activate. The framework appears in the tenant's Frameworks list with all its controls set to Not Started.

The assessment view

Open any active framework. The assessment view shows:

• A completion percentage at the top (percent of controls with sufficient evidence)
• The full control tree grouped by section (for SOC 2: CC1 through CC9; for NIST CSF: Govern, Identify, Protect, Detect, Respond, Recover)
• Per-control status badges (Not Started, In Progress, Satisfied, Needs Review)
• A filter bar to isolate controls by status, priority, or missing evidence type

Click any control to open its detail panel: description, evidence requirements, attached evidence, linked policies, linked risks, and a notes field for the operator.

Attaching evidence to controls

Three ways to satisfy a control:

1. 1
   Automatic from integrations. When a deep integration collects evidence that matches a control (e.g., Okta confirming MFA is enforced), Radius360 attaches it automatically. You just review.
2. 2
   Map a policy. In the control detail panel, link to a policy from the library. If the policy covers the control, the control is marked In Progress until operational evidence also lands.
3. 3
   Manual upload. Attach a PDF, screenshot, log excerpt, or written attestation. Radius360 stores it in the Evidence Vault with the control link.

Cross-framework mapping

Every control has mappings to equivalent controls in other frameworks. When you attach evidence to SOC 2 CC6.1 (Logical Access), Radius360 automatically credits ISO 27001:2022 A.5.16 and NIST CSF 2.0 PR.AA-01 if those frameworks are also activated.

This means that for a client running SOC 2 and ISO 27001 side by side, roughly 60 percent of the work is done once. You see shared evidence counted in both frameworks in real time.

Running a gap assessment

A gap assessment is the view of what is missing, in priority order. Open a framework, click Gap Assessment. Radius360 lists every unsatisfied control with:

• What evidence is missing (specifically)
• Which integration or manual action could satisfy it
• Priority (based on control criticality and audit-period age)
• Estimated effort (light, moderate, heavy)

Work the list top to bottom. Each resolved gap flips the control to Satisfied and updates the completion percentage.

Audit export

Open the framework, click Export. You get a single PDF or zip archive containing:

• Executive summary (completion %, date, tenant, framework version)
• Control-by-control status with evidence references
• Evidence index (every attached artifact with hashes for integrity)
• Policy index (every linked policy with version stamps)
• Gap list for anything not yet satisfied

This is the package an auditor asks for. The board report is different: it is for executives, not auditors. The audit export is the ground-truth artifact.