Pick one control from a framework you are audited against and ask the vendor to show the path from the requirement, to the setting or data in the product, to the evidence an auditor would accept. Note what the product produces on its own and what you must add. Repeat for two more controls.
What "maps to a framework" usually means
When a vendor says the product "maps to" a framework, it can mean several different things:
- A label linking a feature to a control name.
- A report template organized by the framework's structure.
- Automated evidence collection for specific controls.
- Guidance only, with the work left to you.
These differ a great deal in effort saved. The RFP should force the vendor to say which one it is. A mapping does not make you compliant. It helps you gather evidence for work you still have to do.
The four step test
- Choose a control. Pick one you have been asked about in a real audit or questionnaire, for example access review, change management or vulnerability remediation timelines.
- Ask for the trace. The vendor shows the requirement text, the product capability, the data it records, and the exported evidence.
- Mark each link as automatic, partly manual or manual. Include who does the manual part.
- Check the evidence with your auditor or assessor. Ask whether the artifact would be acceptable as presented. This is the step that matters most, and only they can answer it.
A scoring grid
| Link | Automatic | Partly manual | Manual |
|---|---|---|---|
| Data collected for the control | |||
| Evidence produced and time stamped | |||
| Review or approval step recorded | |||
| Export in an auditor-friendly form |
Fill it in during the demo. Vendors who prepare will fill it in with you.
RFP questions to add
- For each framework you claim support for, which controls have automated evidence, and which are guidance only?
- Which version of the framework does the mapping reflect, and when was it last updated?
- How are changes to the framework handled, and who reviews them?
- Can we edit the mapping to reflect our own control wording?
- Can the vendor share a sample evidence package with sensitive data removed?
- Does the vendor claim any attestation or certification of its own? If so, ask for the document, its scope, its period, and the name of the issuing party. Do not accept a logo as evidence.
Be careful with the word "compliant"
Pay attention to who is claiming what. Standards like SOC 2 are attestations issued by independent auditors, not certifications you buy. A vendor can say its product helps you gather evidence. It cannot say that using it makes you compliant.
A worked example: tracing one control
Take a common requirement: "Vulnerabilities are identified and remediated within a defined timeframe." A buyer asks the vendor to trace it. A good session looks like this.
| Link | Vendor shows | Automatic or manual | Evidence artifact |
|---|---|---|---|
| Requirement text | The control wording from the framework version in use | Automatic mapping, reviewed by you | Control page |
| Policy | Your remediation timeline, stored as a policy in the product | Manual, you write the policy | Policy document with version and approver |
| Detection data | Findings with discovery dates | Automatic | Exported findings list |
| Remediation record | Status changes and dates for each finding | Automatic if the workflow is used, partly manual otherwise | Time stamped history |
| Exceptions | Accepted risks with reasons and expiry | Manual entry, automatic reminders | Exception log |
| Review | Periodic summary of overdue items | Automatic report, manual sign-off | Signed review record |
The honest answer often includes manual steps. That is not a weakness. A vendor that shows precisely where you must act is more useful than one that claims everything is automatic.
Questions for your auditor
Before the demo, ask your auditor or assessor:
- Which forms of evidence do you accept for this control?
- Do you need screenshots, exports, or system generated reports?
- How do you want time stamps and approver names shown?
- How much historical evidence do you expect for the period under review?
Bring those answers to the demo and check each against what the vendor shows.
Watch for scope creep in "supports"
| Claim | Questions to ask |
|---|---|
| Supports the framework | Which controls, and at what level of automation? |
| Aligned with the framework | Who assessed the alignment? |
| Evidence ready | Has an assessor accepted it? Ask for a reference who can say so |
| Always up to date | How are framework changes tracked and reviewed? |
If a claim cannot be turned into a testable question, treat it as marketing.
Be careful with attestations
A vendor may say it holds an attestation or report of its own. Ask for the document, the scope, the period and the issuing firm, and read the scope. Do not accept a badge. Also remember that a vendor's own report says nothing about whether your use of its product satisfies your controls.
Build your own crosswalk
After the demo, keep a one page table of your three controls, the product's evidence for each and the manual steps. It becomes the seed for your audit preparation, and it lets you compare vendors on the same axes.
Try it yourself
Click through it at your own pace, or open it full screen. Follow one control from requirement to evidence and mark each link as automatic or manual.
Quick check
Does a framework mapping make us compliant?
No. It organizes evidence for work you still do. Compliance is judged by your assessor.
Who decides whether the evidence is acceptable?
Your auditor or assessor. Ask them early.
Can a mapping tool replace an auditor's judgment?
No. It organizes evidence and reduces collection effort. Whether the evidence satisfies a control is decided by your assessor.
Safeguard's GA capabilities include compliance and evidence automation. Ask it the same trace questions, and check them against your own framework with your auditor's input.
Last reviewed: 19 October 2026.
