Control Domains & Artifact Types

Control domains are the categories of security requirements that VISO TRUST assesses vendors against. Artifact types are the documents and evidence that validate whether those requirements are met. Together, they form the evidence-to-controls mapping that drives every risk score.

Control Domains

A control domain is a grouping of related security controls — for example, Access Control, Incident Response, Data Protection, or Vendor Management. The domains in scope for a given assessment are determined by the business cases selected for that relationship. VISO TRUST’s default framework covers seven primary dimensions:

Dimension	What it covers
Security	Core information security controls — access management, encryption, vulnerability management, incident response, etc.
Privacy	Data handling, consent, sub-processor management, and compliance with privacy regulations (GDPR, CCPA, HIPAA)
Artificial Intelligence	Risk controls specific to vendors that develop or deploy AI — model governance, bias, transparency, and AI-specific security practices
Resilience	Business continuity, disaster recovery, and operational stability
Product Security	Secure software development, dependency management, and vulnerability disclosure programs
Cyber Insurance	Coverage and limits of the vendor’s cyber insurance policy
Service Locations	Where the vendor stores data and operates, for data residency and geopolitical exposure

You can further tailor the controls in scope through Custom Frameworks.

How Controls Come In Scope

Controls are brought into scope by the business cases selected during relationship context configuration. Each business case maps to a set of control domains — the combination of selected business cases determines the full set of controls that must be assessed. Example: A vendor selected with the business cases “Stores customer data” and “Has privileged system access” will have a broader set of controls in scope than a vendor selected only as a “Provides software as a service.” Changing a relationship’s business cases immediately updates which controls are in scope. Controls that fall out of scope are marked as Out of Scope. New in-scope controls begin as Unvalidated until evidence is collected.

Control Status

Each in-scope control has a status that reflects the current state of evidence:

Status	Meaning
Present	The control is described as implemented — evidence confirms it’s in place
Not Present	The control is described as not implemented, or the audit includes a qualified opinion or exception against it
Unvalidated	No evidence yet, and an assessment is in progress
No Info	No evidence available and no active assessment — control could not be verified
Out of Scope	The control domain is enabled in your org, but this control doesn’t apply to this specific relationship based on its business context
Not Applicable	Confirmed by the vendor (or your team) that this control doesn’t apply to their environment

Controls marked Not Present or No Info represent gaps — these drive the residual risk score upward and are the primary targets for remediation requests and follow-up questionnaires.

Artifact Types and Control Mapping

Every artifact type recognized by VISO TRUST maps to a defined set of controls it can validate. When an artifact is uploaded and analyzed, Artifact Intelligence extracts evidence from the document and credits the controls it satisfies. Higher-assurance artifact types validate controls with greater confidence:

Artifact Type	Assurance	Controls typically validated
SOC 2 Type II	High	Security, availability, confidentiality, processing integrity
ISO 27001	High	Information security management across all domains
HITRUST CSF	High	Security, privacy, compliance (especially healthcare)
PCI DSS ROC/AOC	High	Payment card data security controls
Penetration Test	High	Vulnerability management, application security
Data Processing Agreement	Moderate	Privacy, sub-processor management, data handling
Cyber Insurance Policy	Moderate	Cyber insurance coverage and limits
Security Policy	Moderate	Policy-level coverage across security domains
SOC 2 Type I	Moderate	Design of controls (no operating effectiveness testing)
Vendor Questionnaire	Moderate	Self-attested coverage across any domain

The Assurance Hierarchy

When multiple artifacts of different assurance levels address the same control, VISO TRUST uses the highest-assurance artifact to determine the control’s status. A validated SOC 2 report supersedes a self-attested security policy for the same control. When a high-assurance artifact is available, it also supersedes expired lower-assurance artifacts of the same type, and older versions of the same artifact type.

Compliance Certifications vs. Validated Artifacts

When VISO TRUST detects a publicly claimed certification (a SOC 2 badge on a vendor’s website) but doesn’t have the actual report, it grants partial credit — a lower-confidence signal that the vendor likely meets those controls. To upgrade from partial to full credit, request the actual certification document through a collection request. Submitting and analyzing the full report replaces the partial credit with validated evidence.

Getting Started

Third Parties

Risk & Monitoring

Trust & Questionnaires

VISO Chat Agent

Integrations

Organization Settings

Control Domains & Artifact Types

Control Domains

How Controls Come In Scope

Control Status

Artifact Types and Control Mapping

The Assurance Hierarchy

Compliance Certifications vs. Validated Artifacts

​Control Domains

​How Controls Come In Scope

​Control Status

​Artifact Types and Control Mapping

​The Assurance Hierarchy

​Compliance Certifications vs. Validated Artifacts

Control Domains

How Controls Come In Scope

Control Status

Artifact Types and Control Mapping

The Assurance Hierarchy

Compliance Certifications vs. Validated Artifacts