← All documentation

Cross-Framework Coverage

Reports surface framework coverage two ways: a deterministic Framework coverage readout (no AI) and an AI-assisted Cross-framework coverage rollup. They answer different questions.

Framework coverage (how far your answers reach)

The Framework coverage panel on Reports shows, for each built-in framework pack, how many of its controls your answered questions already touch — "answered N / M controls (X%)" with a progress bar. A lighter track behind the bar shows what the question bank can assess for that framework, so you can tell "we haven't done it yet" from "the bank doesn't cover it." This is computed directly from your yes/partial answers and the question→control mappings — no AI, no approval step. Org admins get a View link to each framework's controls.

Cross-framework coverage (one answer, mapped everywhere)

Once you've answered a question yes or partial and attached evidence, Watney can suggest which controls in other frameworks (another built-in pack, or a custom framework of your own) that same evidence also satisfies. One answer becomes coverage across every framework you use.

How it works

  1. On the assessment page, open a question you've answered with evidence and click Map to other frameworks.
  2. Watney compares the question's framework text against the control catalog and proposes matches, each with a confidence score and a one-line rationale.
  3. An org admin reviews the proposals and approves the ones that genuinely apply. Approved mappings are recorded against your organization.
  4. The Cross-framework coverage panel on Reports rolls up, per framework, how many controls your answered questions now cover, and lists the source question codes so each mapping's provenance is visible.

Grounding & safety

  • What is sent is the question text, its framework text, and the control catalog — never your evidence file contents. If your organization has authored a custom framework, the control titles and references you typed are part of that catalog and are sent with it; those are free text, so they may contain personal or confidential information. Watney's system card names the model provider and how it handles what is sent.
  • Watney only proposes mappings above a confidence threshold, and an empty result is normal — a wrong mapping is worse than none.
  • Nothing is recorded until an admin approves it. Approvals are org-scoped: they never alter the shared question bank.