Control Domains & Artifact Types

Control domains are the categories of security requirements that VISO TRUST assesses vendors against. Artifact types are the documents and evidence that validate whether those requirements are met. Together, they form the evidence-to-controls mapping that drives every risk score.

Control domains

A control domain is a grouping of related security controls (for example, Access Control, Incident Response, Data Protection, or Vendor Management). The business cases selected for a relationship determine which domains are in scope for its assessment. VISO TRUST’s default framework covers these dimensions:

Dimension	What it covers
Security	Core information security controls — access management, encryption, vulnerability management, incident response, etc.
Privacy	Data handling, consent, sub-processor management, and compliance with privacy regulations (GDPR, CCPA, HIPAA)
Artificial intelligence	Risk controls specific to vendors that develop or deploy AI — model governance, bias, transparency, and AI-specific security practices
Resilience	Business continuity, disaster recovery, and operational stability
Product security	Secure software development, dependency management, and vulnerability disclosure programs
Corporate governance & ethics	The vendor’s governance programme, compliance and audit obligations, enterprise risk management, business ethics and anti-corruption, and speak-up and grievance channels
Fourth-party & suppliers	Due diligence and contracting over the vendor’s own subcontractors, and its inventory and ongoing monitoring of those providers
Sustainability & human rights	Sustainability governance, climate and GHG disclosure, environmental management, labour and working conditions, human rights and modern slavery, and responsible recruitment
Sanctions & trade	Sanctions screening, export and trade controls, ownership and foreign influence, prohibited technology and country of origin, country and jurisdiction risk, financial-crime screening (AML/CTF), and host-government access and digital sovereignty
Financial viability	Audited financial statements and going-concern review, and ongoing monitoring of financial standing via credit ratings and financial-health indicators
Cyber insurance	Coverage and limits of the vendor’s cyber insurance policy
Service locations	Where the vendor stores data and operates, for data residency and geopolitical exposure
Subservicers	The vendor’s own downstream providers, for nth-party visibility

Every dimension that has controls in scope gets its own section in the relationship’s risk analysis, where you can see those controls and the evidence behind them. Only the Security dimension produces the inherent and residual risk scores used across the platform. Controls introduced by your organization’s own supplemental questionnaires are tracked separately. They appear under Questionnaires in the risk analysis rather than as a risk dimension. You can further tailor the controls in scope through Custom Frameworks.

Browse the control framework

The full framework is listed in-platform under Glossary → Control Framework. Use this page to look up a control, see its weight, or check which business cases bring it into scope.

Filter by dimension: Select All controls or a single risk dimension in the side navigation. Each entry shows its control count.
Search: Type in Search controls to narrow the list to matching controls.
Switch layouts: Use the list view to see controls grouped under their domain. Use the table view to sort controls by name, weight, dimension, domain, or domain weight.
Download: Click the download icon to export the controls you’re viewing as a CSV file. The export respects the selected dimension and your search.

The CSV contains one row per control, with these columns: risk dimension, domain, domain description, domain question, domain weight, control, control description, control weight, and business cases.

How controls come in scope

The business cases you select during relationship context configuration bring controls into scope. Each business case maps to a set of control domains. The combination of selected business cases determines the full set of controls that must be assessed. Example: A vendor with the business cases “Stores customer data” and “Has privileged system access” has a broader set of controls in scope. A vendor with only “Provides software as a service” has a narrower set. Changing a relationship’s business cases immediately updates which controls are in scope. Control domains that fall out of scope are marked Out of scope. New in-scope controls show No Information until evidence is collected. The intake questionnaire also carries dedicated questions that bring the non-security dimensions into scope. Answering yes to any of these adds the mapped control domains to the relationship:

Intake question	Dimensions it brings into scope
Material or Critical Relationship — would a failure or serious control deficiency at the vendor materially disrupt your operations, obligations or customers?	Corporate governance & ethics
Financial Exposure — do you carry material financial exposure to the vendor through committed or prepaid spend, or slow-to-replace services?	Financial viability
Subcontracted Delivery — does the vendor use subcontractors, sub-processors or other third parties to deliver any part of the service?	Fourth-party & suppliers
Physical Goods, Labour & Outsourced Operations — does the vendor supply physical goods, workers, staffing, contingent labour or outsourced business operations?	Sustainability & human rights (labour, human rights, environmental, speak-up & grievance)
Sustainability Reporting Scale — is the vendor large enough to fall within mandatory sustainability, climate or modern-slavery reporting regimes?	Sustainability & human rights (sustainability governance, climate & GHG, human rights)
Foreign Ownership or Offshore Delivery — is the vendor foreign-owned, headquartered outside your home jurisdiction, or delivering, hosting or supporting the service from overseas?	Sanctions & trade (sanctions screening, ownership disclosure, country risk, host-government access)
Controlled Goods, Technology & Restricted Origin — do the goods, software or technology the vendor provides fall under export or dual-use controls, or come from a restricted vendor or country?	Sanctions & trade (export controls, prohibited technology)
Financial & Payment Services — does the vendor handle funds, process payments or payroll, or provide other regulated financial services?	Sanctions & trade (AML/CTF screening)

These questions appear alongside the business case selections in the intake questionnaire. Predict context answers them automatically from the vendor’s profile and the business purpose you entered, and you can adjust the answers before saving.

Control status

Each in-scope control has a status that reflects the current state of evidence:

Status	Meaning
Present	The control is described as implemented — evidence confirms it’s in place
Description Only	Evidence describes the control but doesn’t test it, so it counts as present at reduced assurance
Not Present	The control is described as not implemented, or the audit includes a qualified opinion or exception against it
No Information	No evidence addresses this control yet
Not Applicable	Confirmed by the vendor (or your team) that this control doesn’t apply to their environment

Out of scope applies at the control domain level: the domain is enabled in your organization, but doesn’t apply to this relationship based on its business context. In the risk analysis view, these statuses are grouped into three indicators: Present (green), Not present (red), and Not applicable (grey). A ring shows how much of the control’s weight the evidence actually mitigated. Controls with no supporting evidence represent gaps. They keep the residual risk score high and are the primary targets for remediation requests and follow-up questionnaires. Controls marked Not applicable are handled differently: their weight is removed from likelihood rather than counted as mitigation, so they neither raise nor lower the score.

Artifact types and control mapping

Every artifact type recognized by VISO TRUST maps to a defined set of controls it can validate. When you upload an artifact, Artifact Intelligence analyzes it, extracts evidence from the document and credits the controls it satisfies. Each type covers a characteristic set of domains:

Artifact Type	Controls typically validated
SOC 2 Type II	Security, availability, confidentiality, processing integrity
ISO 27001	Information security management across all domains
HITRUST CSF	Security, privacy, compliance (especially healthcare)
PCI DSS ROC/AOC	Payment card data security controls
Penetration Test	Vulnerability management, application security
Data Processing Agreement	Privacy, sub-processor management, data handling
Cyber Insurance Policy	Cyber insurance coverage and limits
Security Policy	Policy-level coverage across security domains
SOC 2 Type I	Design of controls (no operating effectiveness testing)
Vendor Questionnaire	Self-attested coverage across any domain
Audited Financial Statements	Financial viability, going-concern opinion
Credit Rating / Financial Health Report	Ongoing financial viability monitoring
Modern Slavery / Transparency Statement	Human rights, modern slavery due diligence
Sustainability / ESG Report	Sustainability governance, climate & GHG disclosure
ISO 14001 Certificate	Environmental management
ISO 45001 Certificate	Occupational health and safety
ISO 37001 Certificate	Anti-bribery management
Human Rights & Labour Standards Policy	Labour and human rights commitments
Code of Conduct / Anti-Bribery Policy	Business ethics, anti-corruption
Whistleblower / Speak-Up Policy	Speak-up and grievance channels
Supplier Code of Conduct	Fourth-party requirements, supply-chain ethics
Beneficial Ownership Disclosure	Ownership, control and foreign influence
Sanctions, AML/CTF & Financial Crime Program	Sanctions screening, AML/CTF
Export Control Classification & Licences	Export and trade controls

Assurance levels

Every artifact type carries a numeric assurance value, displayed as one of three levels on a three-dot meter:

Level	Meter	Assurance value	Example artifact types
Strong	Three green dots	0.92 and above	ISO 27001, PCI DSS AOC/ROC, HITRUST r2, penetration test
Moderate	Two blue dots	0.80 – 0.91	SOC 2 Type II, HITRUST i1, SOC 1 Type II, HITRUST e1
Weak	One amber dot	Below 0.80	SOC 2 Type I, SOC 1 Type I, vendor questionnaires, privacy policies

Treat the examples as illustrative. Glossary → Artifact Types in the platform is the authoritative list. It shows each type’s current level, and you can filter the list by assurance level. The same meter appears everywhere VISO TRUST shows assurance, including the artifact list, risk analysis detections, the artifact viewer, monitoring, and report exports. Hover over the meter to see a tooltip with the level. Assurance is what scales control credit. A present control backed by a Strong artifact mitigates nearly all of its weight, while the same control backed by a questionnaire mitigates well under it. Every artifact type’s own level is listed in-platform under Glossary → Artifact Types. Assurance can also be reduced below an artifact type’s normal level. Expired artifacts show the meter in red with the label Expired artifact. Artifacts with assurance reduced for another reason show a red Reduced label. Hover over a red meter to see the reason, the original assurance level, and the adjusted level. When the meter summarizes several control assessments and at least one was reduced, the tooltip reads Combined assurance reduced and shows the highest reason. The risk analysis view labels the reason:

Reason	What happened
Artifact expired	The artifact is past its validity period
Description only	The evidence describes the control without testing it
Reduced assurance	A VISO TRUST auditor manually lowered the assurance
Presumed certification	The artifact is a presumed placeholder for a claimed certification, so its assurance is discounted until the real document arrives
Audit ignored	The artifact doesn’t count toward the risk model at all

When more than one reason applies, the risk analysis view shows the stronger reason. An expired presumed artifact is labeled Artifact expired, not Presumed certification.

The assurance hierarchy

When multiple artifacts of different assurance levels address the same control, VISO TRUST uses the highest-assurance artifact to determine the control’s status. A validated SOC 2 report supersedes a self-attested security policy for the same control. When a high-assurance artifact is available, it also supersedes expired lower-assurance artifacts of the same type, and older versions of the same artifact type.

Compliance certifications vs. validated artifacts

When VISO TRUST detects a publicly claimed certification (a SOC 2 badge on a vendor’s website) but doesn’t have the actual report, it grants partial credit. This is a lower-confidence signal that the vendor likely meets those controls. To upgrade from partial to full credit, request the actual certification document through a collection request. Submitting and analyzing the full report replaces the partial credit with validated evidence.

Getting Started

Third Parties

Risk & Monitoring

Trust & Questionnaires

VISO Chat Agent

Integrations

Organization Settings

Control Domains & Artifact Types

Control domains

Browse the control framework

How controls come in scope

Control status

Artifact types and control mapping

Assurance levels

The assurance hierarchy

Compliance certifications vs. validated artifacts

​Control domains

​Browse the control framework

​How controls come in scope

​Control status

​Artifact types and control mapping

​Assurance levels

​The assurance hierarchy

​Compliance certifications vs. validated artifacts

Control domains

Browse the control framework

How controls come in scope

Control status

Artifact types and control mapping

Assurance levels

The assurance hierarchy

Compliance certifications vs. validated artifacts