Core workflows

Framework assessments

Run a SOC 2, ISO 27001, NIST CSF, HIPAA, or any of 30 framework assessments. Evidence attached once counts toward every framework that shares the same underlying control.

Supported frameworks

Radius360 ships with the following frameworks pre-loaded. Each one includes its full control library, descriptions, and cross-framework mappings.

SOC 2 Type II (Trust Services Criteria)
ISO 27001:2022 and ISO 27002
NIST CSF v2.0 and NIST 800-53
HIPAA Security and Privacy Rules
PCI DSS v4.0
CMMC Level 1 and Level 2
GDPR
NIS2
CIS Controls v8
ISO 42001 (AI management systems)
EU AI Act risk tiers
NIST AI RMF
Plus HITRUST CSF, FedRAMP Moderate, NIST 800-171, DORA, NYDFS Part 500, CCPA/CPRA, TISAX, SWIFT CSCF, and others, for 30 in total

Activating a framework

Frameworks can be activated during client onboarding (the wizard asks which frameworks apply) or added later from Compliance (the Controls tab), where the rest of the catalog is listed under Available to add.

1
Pick the framework from the catalog.
2
Optionally pick a scope (full framework, or a specific scope like "SOC 2 Security Trust Service only").
3
Click Activate. The framework appears in the tenant's Frameworks list with all its controls set to Not Started.

Activating a framework does not affect existing data. Controls are empty until you attach evidence or map existing policies to them.

The assessment view

Open any active framework. The assessment view shows:

A completion percentage at the top (percent of controls with sufficient evidence)
The full control tree grouped by section (for SOC 2: CC1 through CC9; for NIST CSF: Govern, Identify, Protect, Detect, Respond, Recover)
Per-control status badges (Not Started, In Progress, Satisfied, Needs Review)
A filter bar to isolate controls by status, priority, or missing evidence type

Click any control to open its detail panel: description, evidence requirements, attached evidence, linked policies, linked risks, and a notes field for the operator.

Attaching evidence to controls

Three ways to satisfy a control:

1
Automatic from integrations. When a deep integration collects evidence that matches a control (e.g., Okta confirming MFA is enforced), Radius360 attaches it automatically. You just review.
2
Map a policy. In the control detail panel, link to a policy from the library. If the policy covers the control, the control is marked In Progress until operational evidence also lands.
3
Manual upload. Attach a PDF, screenshot, log excerpt, or written attestation. Radius360 stores it in the Evidence Vault with the control link.

Cross-framework mapping

Every control has mappings to equivalent controls in other frameworks. When you attach evidence to SOC 2 CC6.1 (Logical Access), Radius360 automatically credits ISO 27001:2022 A.5.16 and NIST CSF 2.0 PR.AA-01 if those frameworks are also activated.

This means that for a client running SOC 2 and ISO 27001 side by side, roughly 60 percent of the work is done once. You see shared evidence counted in both frameworks in real time.

This is the biggest quiet efficiency in Radius360

The tools that do not cross-map make you redo the same evidence work once per framework. Radius360 does not. Verify this by activating a second framework partway through an assessment and watching controls flip to In Progress on their own.

Running a gap assessment

A gap assessment is the view of what is missing, in priority order. Open a framework, click Gap Report. Radius360 lists every unsatisfied control with:

What evidence is missing (specifically)
Which integration or manual action could satisfy it
Priority (based on control criticality and audit-period age)
Estimated effort (light, moderate, heavy)

Work the list top to bottom. Each resolved gap flips the control to Satisfied and updates the completion percentage.

Audit export

Open the framework, click Export Audit Packet, and pick the audit period (last 90 days, last 6 months, last 12 months, year to date, or custom dates). You get a self-contained HTML file you can open in a browser or print to PDF. It contains:

A summary: controls in scope, controls evidenced, controls that failed a check in the period, and controls inherited from vendors
Control-by-control evidence for the period
A machine-readable manifest of everything in the packet

By default the packet includes passing evidence that has not been rejected. For an internal working copy, you can also include pending-review and non-passing rows.

This is the package an auditor asks for. The board report is different: it is for executives, not auditors. The audit export is the ground-truth artifact.

PreviousPolicy management Next Board reports