On this page0
Guide
Get started with the Compliance Hub
Pick your framework, gather evidence, give every control an owner, have it reviewed, and export a package for your auditor.
Before you start
- A role that can manage compliance. In the built-in set, administrators have that permission. The “security_analyst” role has it too; no group carries it, so an administrator gives it to a person by hand, as Roles, groups and permissions shows.
- At least two people for reviews: the person who submits a control cannot approve it.
- Your systems connected where possible (for example your identity provider and enrolled devices). Connected systems supply evidence on their own.
Choose what you are working toward
Step 1: Open the hub and pick a framework
Go to Security & ComplianceCompliance Hub. The hub covers 8 frameworks: SOC 2, ISO 27001, HITRUST, HIPAA, PCI DSS, GDPR, CCPA and NIST CSF. The switcher under the page title shows the ones you are pursuing; click “Add framework” to choose more, then click the one you want to work on. It sets the framework for every tab.
The catalog has 146 controls, and many count toward more than one framework. The tabs are “Overview”, “Owners”, “Evidence & integrations”, “Program”, “Auditor room” and “History”.
Step 2: Declare your environment and scope
On a new hub, “Overview” shows a three-step setup strip: “Declare your environment”, “Collect evidence” and “Assign owners”. Click “Set up” on the first. It opens the “Program” tab at “Scope — your environment”.
Under “Scope your controls”, answer the questions about your business and click “Apply scope”. Controls that don’t apply are marked N/A with the reason, and stop counting against you.
Then, under “Your environment”, list the systems you use and click “Save”. Each control then shows where its evidence comes from in your systems.
Gather evidence
Step 3: Let Zonitix collect what it can
Back on “Overview”, click “Collect now” in the setup strip (the button at the top of the page reads “Collect evidence” until the first collection has run). Zonitix checks its own data and your connected systems, and then keeps checking every 30 minutes. If a passing control starts failing, the people who manage compliance are alerted.
To see where the evidence is coming from, open the “Evidence & integrations” tab. The cards at the top show how many sources are “Connected & healthy” and how many controls are “Controls auto-covered” for your framework. “Needs attention now” lists the controls that are failing or unverified, with a “Track fix →” button to record who is fixing each one and by when. The list at the bottom holds the evidence attached so far. A source that could not be read never counts as a pass; its controls show as needing attention until it works again.
Step 4: Give each remaining control an owner
Click “Assign” in the setup strip, or open the “Owners” tab. Tick the controls, click “Assign”, choose the “Employee” and a “Due date”, and confirm. “Split evenly” shares a selection across several people.
Step 5: Owners upload their evidence
Each owner opens My WorkMy Compliance Tasks. Every control says what evidence is needed and how to collect it. They click “Attach evidence” or drag a file onto it, then click “Submit for review”.
Review and check your score
Step 6: A second person reviews each submission
On “Overview”, “Next actions” lists the submissions waiting for review. A reviewer opens a control from the table and clicks “Approve”, or “Send back with a note…” to return it with what’s missing. The owner is told either way.
By default the submitter cannot review their own control. This is the “Require a separate reviewer” setting under the settings icon, “Compliance settings”. Administrators are exempt.
The same dialog has “Manual attestation”, which decides whether one person may mark a control as passing without a review: “Allow”, “Note required” (the default) or “Review only”. Changing either setting needs the Manage security permission, so the people doing the reviews cannot relax their own rules.
Step 7: Read your readiness score
The ring on “Overview” shows verified readiness for the framework: controls that pass on collected evidence or on a review by someone other than the submitter, divided by the controls in scope. N/A controls are left out.
A pass that one person attested, or that the submitter approved themselves, is not counted in the ring. Those show beside it as “self-attested”, with the percentage you would have if they were included. A control waiting for review, or one whose evidence has gone out of date, does not count as passing. Collected evidence goes out of date after 30 days if it is not seen again; a reviewed or attested pass after a year.
Hand it to your auditor
Step 8: Start the audit run
Click “Prepare for audit” at the top of the hub. Under “What is this for?” choose an internal readiness check, a point-in-time audit (SOC 2 Type I) or a period audit (SOC 2 Type II), and give the dates it asks for. Set an “Evidence target date” and click “Start run”. Sections you assign default to that date, and owners are reminded as it gets closer.
Zonitix opens the run page. While the run is open it stays in the menu under “Security & Compliance”, and “Resume … run” at the top of the hub takes you back to it. Only people who manage compliance can open the run page.
If verified readiness is under 80%, the dialog warns you that most auditors expect more before fieldwork. You can still start.
Step 9: Export the evidence package
Open the “Auditor room” tab. On “Evidence package”, click “Open binder”, then “Download all (.zip)”. The file has one folder per control, an index your auditor can read, and the attached files. Past runs stay under “History”, where “View binder” reopens them.
Step 10: Or give your auditor a read-only link
Still in “Auditor room”, on “Auditor links” click “Manage links”. Add a label if you like, choose when it “Expires”, and click “Create link”. Copy the link straight away. It is shown only once.
The link opens a read-only view of this framework’s controls, their status and whether evidence is attached. Your auditor needs no account. It does not show internal notes, personal data or the evidence files themselves, and you can revoke it at any time. If the auditor asks for more evidence on a control, the request appears under “Evidence requests”.
Step 11: Finalize the run when the audit is over
Open the run page and click “Finalize audit”. A window titled “Finalize this audit?” shows what will be recorded: the readiness percentage, and how many controls are passing, are findings, are N/A or are still pending. A control with no verdict yet is recorded as not passing, so settle those first if you can.
If people were assigned work, you can tick the box to remove their access; it is removed only for people who own no work in another open audit. Then click “Finalize & archive”.
Finalizing cannot be undone. It works out the final score, moves the evidence to “History” and closes the run. To change anything afterwards you start a new run.
What you should see
The setup strip disappears once all three steps are done. After that, “Next actions” on “Overview” shows what still needs work.
Each passing control shows how it passed: “Collected” automatically, “Reviewed” by a second person, “Self-approved” when the submitter approved it themselves, or “Attested” by one person only. Auditors trust these differently, which is why only the first two count toward verified readiness.
The “Program” tab also keeps your policies, risks, vendors and Statement of Applicability. The steps are in Keep your risk register and vendor register and Keep policies up to date and download the Statement of Applicability (SoA). The “Trust Center” card on the “Auditor room” tab is in Publish your Trust Center page.
If something goes wrong
- "Separation of duties: you submitted this control, so someone else must review it."
- Ask another person who manages compliance to approve it.
- "This control has not been submitted for review"
- Only submitted controls can be approved. Have the owner click Submit for review in My Compliance Tasks first, or attest it yourself if your Manual attestation setting allows it.
- "A note is required when reopening a control."
- Write what the owner needs to fix, then send it back.
- "Manual attestation is disabled — this control must go through the submit → review loop."
- Manual attestation is set to Review only. Have the owner submit the control and a second person approve it.
- Evidence & integrations lists a control under "Needs attention now"
- The evidence for that control reports a failure, or could not be collected. If it comes from a connected system, re-check that connection under Identity Hooks, fix the cause, then click Collect now on Overview. To record who is fixing it and by when, click Track fix on that row; the row then shows Fix tracked.
- Readiness went down with no changes
- Some evidence is now out of date, or a connected system reports a failure. Open the Overview to see which controls changed.
Still stuck? See When something goes wrong, or Contact Zonitix support.