A control catalog, connected to real evidence.
A control catalog you can buy off the shelf is a list of things to think about. The TruSecure control library is different in one structural way: every control is connected to the evidence sources that prove it, so the catalog reads your operational reality instead of sitting beside it.
Each control is authored once — an operational definition, not annex language — tagged with citations to every framework it satisfies, connected to the connectors that produce its evidence, and version-tracked as either the control or the frameworks referencing it change.
How it works
- Author once
A control is written as an operational definition: what must be true in a running system, and what "good" looks like when someone checks.
- Tag the citations
The control is linked to every framework clause it satisfies — NIS2, DORA, ISO 27001, NIST, SOC 2, CIS and beyond — through the crosswalk.
- Connect the evidence
Each control names the systems that can prove it. Connect those systems and the control starts producing evidence; leave them disconnected and the gap is visible, not hidden.
- Track the versions
When a framework revises or a control tightens, the change is versioned and lands as a reviewable proposal — with a diff, not a surprise.
What a control record looks like
Definition, citations, evidence sources, ownership and review state in one record:
- Definition
- Access is provisioned, reviewed and revoked on record
- Citations
- NIS2 21(2)(i) · ISO A.5.18 · DORA Art. 9
- Evidence sources
- identity connector · ITSM change tickets
- Owner
- named control owner
- Version
- 3.2 · review 2026-11
Why one library matters
Because every framework cites the same control, a gap shows up once — as one remediation item, not six findings in six programmes. And because the library is shared, the board report, the auditor's evidence request and the engineer's ticket queue are all looking at the same record of what is true.
TruSecure helps operationalize requirements and prepare evidence. Legal interpretation should be validated by qualified counsel.