Framework Scope Lock (Onboarding)
A checklist with 7 steps: Inventory every certification the client has promised to a buyer before any platform is configured.
By InnovaAI ResearchPublished
What are the steps?
Framework Scope Lock (Onboarding)
- 01
Inventory every certification the client has promised to a buyer before any platform is configured
List the frameworks named in live RFPs, security questionnaires, and signed MSAs. A SOC 2 Type II commitment and an ISO 27001 commitment require different control sets and different audit windows.
- 02
Map each promised framework to the controls it actually shares with the others
Most of the overlap sits in access review, change management, and vendor risk. Document the shared control spine once so evidence is collected a single time and reused across frameworks.
- 03
Assign a named control owner inside the agency for each control family
Access provisioning, incident response, backup verification, and vendor review each need one accountable person. Unowned controls are the ones that fail at audit.
- 04
Connect the source systems that generate evidence, not the ones that are easiest to connect
Cloud consoles, identity providers, ticketing, and code repositories produce the raw logs auditors test. Pulling from a chat tool because the integration is quick leaves the real control unmonitored.
- 05
Export the control-to-framework mapping into a portable spreadsheet before the first scan runs
Keep a vendor-neutral copy of the mapping and the evidence sources. This file is the exit plan if the platform's framework interpretation diverges from the auditor's.
- 06
Confirm the auditor accepts the platform's evidence format in writing
Send the proposed evidence set to the audit firm and get written confirmation before the observation window opens. Discovering a format mismatch mid-window restarts the clock.
- 07
Set the observation window start date against the client's contract deadline, working backwards
A SOC 2 Type II needs a monitoring period before the report exists. If the client signs in March and expects a report in April, the scope conversation has to happen now, not at delivery.