Evidence-First Assurance Model
Universal controls, evidence mapped to many frameworks, and why missing evidence is not failure.
- At least one framework enabled for the customer
- Familiarity with the customer's asset inventory
Overview
AssurIQ does not maintain a separate checklist per regulation or standard. Instead, it maintains a single set of universal controls — the actual security practices that matter, such as MFA enforcement, patch cadence, endpoint protection and access review — and maps each one to the specific language of every framework you need to report against.
This means one piece of evidence, collected once, can simultaneously satisfy a requirement in FTC Safeguards, HIPAA Security, NIST CSF 2.0 and a cyber insurance questionnaire, without collecting it four separate times.
Universal controls
Each universal control describes a practice, not a regulation: for example, AIQ-ID-004 covers privileged account MFA enforcement. Frameworks then reference that same control wherever their own language requires equivalent protection.
- One control, many framework citations — write once, prove everywhere.
- Controls are versioned; framework packs can be upgraded independently of control history.
- Every control has an owner, a cadence, and an evidence trail.
Mapping strengths
Not every framework requirement maps to a universal control the same way. AssurIQ records the strength of each mapping so coverage percentages remain honest.
| Mapping strength | Meaning |
|---|---|
| Full | The universal control fully satisfies the framework requirement as written |
| Partial | The control addresses part of the requirement; additional evidence or process is still needed |
| Supporting | The control provides useful context or defense-in-depth but does not directly satisfy the requirement |
The six control states
| State | Meaning |
|---|---|
| PASS | Current evidence confirms the control is operating as required |
| PARTIAL | Evidence shows the control is in place but with gaps, exceptions, or incomplete coverage |
| FAIL | Evidence confirms the control is not operating as required |
| EVIDENCE GAP | No sufficient evidence exists yet to evaluate the control either way |
| NOT APPLICABLE | The control does not apply to this scope, asset class, or environment |
| EXCEPTION | A documented, owned, time-bound risk acceptance overrides the raw evaluation |
Why EVIDENCE GAP is not FAIL
A newly onboarded customer will show many controls in EVIDENCE GAP in week one. That is expected and correct. As collectors, connectors and manual evidence uploads complete their first cycles, gaps resolve into PASS, PARTIAL or FAIL based on what the evidence actually shows.
Assurance confidence
Assurance Confidence is a separate score from the framework percentage. It reflects how fresh, complete and well-sourced the evidence behind that percentage is. A framework can show 90% PASS built on stale, manually-entered evidence with low confidence, or the same 90% built on fresh, automatically-collected evidence with high confidence. Both numbers are shown so nobody mistakes coverage for certainty.
Append-only history
Every control observation is recorded, never overwritten. The full history — including every PASS, PARTIAL, FAIL, GAP and EXCEPTION a control has ever held — remains visible in the evidence timeline. This is what makes the platform usable in an audit: nobody can retroactively edit history to make a point-in-time report look better than it was.
Example: control AIQ-ID-004 (privileged account MFA) can move from PARTIAL, when only some administrators had MFA enforced, to PASS once the remaining accounts are enrolled and a fresh evidence cycle confirms it. Both states remain in the timeline permanently.