Working with Controls

Controls are the building blocks of your compliance program. Each control represents a specific security or operational requirement that your organization must implement to satisfy one or more framework requirements.

​

What Controls Are

A control in Regentra is an organizational requirement that maps to specific clauses, sections, or criteria within compliance frameworks. For example:

• “Enforce Multi-Factor Authentication” might map to HIPAA § 164.312(d), SOC 2 CC6.1, and NIST CSF PR.AC-7
• “Maintain an Incident Response Plan” might map to HIPAA § 164.308(a)(6), SOC 2 CC7.3, and ISO 27001 A.16.1.1

Controls are seeded when you adopt a framework and are linked across frameworks through the Common Control Framework (CCF).

​

Control Statuses

Every control has a status that reflects its current implementation state: The HHS SRA Tool’s “Flag for later” semantic is exposed separately on the assessment workflow (see Risk Assessment → Control assessments) — assessment statuses include FLAGGED_FOR_REVIEW, distinct from the implementation status on the control itself.

​

Automatic status changes

A control’s status can also change on its own, driven by its monitoring signals (see Evidence Collection):

• Auto-demote — if an Implemented control’s latest monitoring evidence turns up a fresh failure, Regentra automatically moves it to Needs Review and remembers the prior status so it can find its way back.
• Auto-restore — once that control’s monitoring evidence returns to a full, fresh pass (no stale or failing signals), it is automatically restored to the status it was demoted from, and the memory is cleared.

Only the aggregated, worst-of-all-signals check triggers a demotion or restore — a single flaky or stale signal never does. Any manual status change you make clears the demotion memory, so automation never overrides a human decision once you’ve made one.

​

The Control Detail Page

Click on any control to open its detail page. This is where you do the actual implementation work.

​

How to Satisfy

Each control includes a How to Satisfy This Control section with the full, untruncated guidance on what is required — Regentra’s single source of truth for implementation guidance on the control detail page. This section explains:

• What the framework requirement actually asks for
• Common implementation approaches
• What evidence auditors expect to see

​

Policy Documentation

Link relevant policies to the control. If you have a “Password Management Policy” that supports an access control requirement, attach it here so auditors can trace the connection.

​

Implementation Notes

Free-form text field where you document how your organization specifically implements this control. Be detailed — this is what you will reference during audits.

​

Evidence

Attach evidence that proves the control is implemented. Evidence can be:

• Files — screenshots, configuration exports, signed documents
• Links — URLs to dashboards, monitoring tools, or external systems
• Automated signals — evidence pulled automatically from connected integrations

​

Assignment

Assign the control to a specific team member who is responsible for implementation and ongoing maintenance.

​

Framework Mappings

When you have a framework selected, the control detail page leads with a ” Requirements Satisfied” card at the top of the page — the official requirement text and reference numbers from that specific framework, each marked Full or Partial depending on how completely this control covers it. This is the language a framework expert is looking for, shown first. The right sidebar’s All Framework Mappings card lists every framework requirement this control satisfies across your full set of adopted frameworks, with the currently active framework’s group pinned first. If a control maps to three different frameworks, you will see all three listed with their specific clause or section references — useful for understanding how a single implementation effort contributes to multiple compliance programs at once. Throughout the controls list and dashboard, the domain grouping Regentra uses (e.g. “Access Control,” “Incident Response”) is labeled Regentra domain — an explanatory banner appears when a framework filter is active, making clear this is Regentra’s own organizing layer and not part of the selected framework’s own structure.

​

Cross-framework citations (NIST CSF, HPH CPG, HICP)

These citations aren’t on the standalone control detail page above — they show up on the Controls (SRA) tab of an individual Risk Assessment, where each control card shows an Also referenced as panel sourced from the HHS/ONC SRA Tool v3.6.1. For every HIPAA §ref the control covers, the panel lists:

• NIST CSF 2.0 subcategory IDs (e.g., ID.RA, PR.AC-7, DE.CM-7)
• HPH CPG numeric references (Health and Public Health Critical Performance Goals)
• HICP Technical Volume references (Health Industry Cybersecurity Practices)

These cross-references mean a customer reviewing a control sees every external framework that probes the same HIPAA §ref in one place. Useful when preparing for cross-framework audits or when an auditor asks “show me the NIST CSF equivalent.”

​

SRA Tool question reference

Also on that same Controls (SRA) tab: for each control whose hipaaRef matches a question in the HHS/ONC SRA Tool v3.6.1 workbook, the control card shows a collapsible HHS SRA Tool questions for §164.xxx panel listing every SRA question that probes that §ref. Each question renders:

• The question text and its SRA-S{section}-Q{n} code
• HHS’s Required flag (when present)
• The full multi-choice answer set with HHS’s per-answer markers (✓ compliant per HHS, ! risk indicated, · skip)

This is a read-only reference — Regentra does not currently track which answers operators select. Operators running the SRA Tool workbook in parallel use this panel to see “for this control, here are the HHS questions to answer” alongside Regentra’s control checklist + evidence. See Risk Assessment for the broader picture.

​

Gap Analysis

The gap analysis view shows you where your compliance program stands and where the gaps are.