← All documentation

Frameworks

Frameworks are the control libraries your assessments map onto. Backsplice ships built-in framework packs, and you can add your own custom frameworks.

The built-in packs today include NIST AI RMF 1.0, NIST AI 600-1 (Generative AI Profile), NIST Cyber AI Profile (IR 8596 initial preliminary draft), NIST COSAiS Predictive AI (built from NIST's January 2026 outline), ISO/IEC 42001:2023, ISO/IEC 42005:2025, ISO/IEC 23894:2023, EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744), EU AI Act GPAI model obligations (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744), NYC Local Law 144 of 2021 (AEDT), Colorado ADMT Act (C.R.S. 6-1-1701 to 6-1-1709, SB 26-189), California CCPA Regulations on ADMT and Risk Assessments (2025), California Civil Rights Council Regulations on Automated-Decision Systems (2025), Illinois Human Rights Act (775 ILCS 5), as amended by P.A. 103-0804 (HB 3773), Texas Responsible Artificial Intelligence Governance Act (H.B. 149, 2025), Utah AI Laws (Utah Code 13-72, 13-72a, 13-77 and 58-60-118, as amended through 2026), UK AI Cyber Security Code of Practice (2025), Singapore Model AI Governance Framework (2nd ed., 2020), Singapore Model AI Governance Framework for Generative AI (2024), Singapore Model AI Governance Framework for Agentic AI (v1.5, 2026), OWASP Top 10 for LLM Applications 2026, MITRE ATLAS 2026.09, HIPAA Security and Breach Notification Rules (45 CFR 164 Subparts C–D, eCFR 2026-10-06), HIPAA Privacy Rule (45 CFR 164 Subpart E, eCFR 2026-10-06), 42 CFR Part 2 (Substance Use Disorder Patient Records, eCFR 2026-10-05), HHS 405(d) HICP (2023 Edition), NIST SP 800-66 Rev. 2 (February 2024) and ONC Information Blocking (45 CFR 171, eCFR 2026-10-06). 13 packs are drawn from law (statutes and regulations); the others are voluntary guidance or standards. They are not legal advice: whether and from when a law applies to your organization is for it to settle, with counsel where needed. Every question in the question bank belongs to a pack and maps to that pack's controls. Each assessment is of one kind, and asks its kind's core packs whatever is selected: Every AI governance assessment asks the NIST AI RMF 1.0 and NIST AI 600-1 (Generative AI Profile) questions (the generative AI ones only where generative AI is in use). Every HIPAA assessment asks the HIPAA Security and Breach Notification Rules (45 CFR 164 Subparts C–D, eCFR 2026-10-06) and HIPAA Privacy Rule (45 CFR 164 Subpart E, eCFR 2026-10-06) questions on Premium and Enterprise; on the Free plan it asks the HIPAA Security and Breach Notification Rules (45 CFR 164 Subparts C–D, eCFR 2026-10-06) questions only. It also asks the questions of each pack selected for it, and no others. The system questions of NIST AI 600-1 (Generative AI Profile), Singapore Model AI Governance Framework for Generative AI (2024), Singapore Model AI Governance Framework for Agentic AI (v1.5, 2026) and OWASP Top 10 for LLM Applications 2026 are asked only of AI systems marked as using generative AI, and their program questions only while a live system (one not retired or rejected) is so marked.

A pack marked Full assessment has a question for every control, so its coverage is a real score. A pack marked Crosswalk view maps answers onto only the controls its questions cover. A crosswalk with no questions of its own (NIST SP 800-66 Rev. 2 (February 2024)) shows its controls as "mapped from other packs", on the register and on its own page: they are credited by other packs' questions, and selecting it adds no question. The NIST Cyber AI Profile is built from NIST's initial preliminary draft (IR 8596), which NIST may change before it is final.

Some packs reproduce openly licensed text (the OWASP entry names under CC BY-SA 4.0, the MITRE ATLAS mitigation names under the Apache License 2.0, and the UK Code's provisions under the Open Government Licence v3.0). Each such pack's source and license notice is shown on its framework page, on the assessments that ask its questions, and in each of its questions' guidance.

Every pack is included in Premium and Enterprise. The Free plan includes them too, except the HIPAA Privacy Rule and the optional HIPAA packs: a HIPAA assessment on it asks the HIPAA Security and Breach Notification Rules questions only. There is no limit on how many packs an assessment can cover. Custom
frameworks are included on every plan, the Free plan included.

Built-in vs. custom

Built-in frameworks come pre-populated with their controls and are read-only: you can scope them into an assessment but not edit them. Custom frameworks are yours to build: create one with a name, description, source, and version, then add controls to it (each has a reference like AC-1, a title, an optional category, and a required flag). Mark a framework active to make it available for scoping; deactivate one you're not using.

How frameworks are used

Frameworks don't do anything on their own. You put them to work by scoping them into an assessment: pick the frameworks the assessment reports against when you create it. The assessment asks its kind's core packs (above) whatever you pick, plus every pack you select; a pack you leave out is not asked. You can add or remove packs later with Manage beside the assessment's frameworks while the assessment is open: removing one hides its questions (any answers are kept, and come back if you add the pack again), and if any of them is answered you are told how many before anything is saved. A completed assessment's question set is fixed: a pack can be added there for the coverage views, not removed. Within the selection, a question that cites only frameworks you do not report against can be marked N/A with a recorded justification once you confirm the scope. On a Statement of Applicability, a control is assessed only by its own pack's questions: a question of another pack that cites it is a cross-reference, not an assessment of it. On your own framework, every question you mapped to a control assesses it. (See Assessments for scoping, and Cross-Framework Coverage for the AI that suggests where one answer satisfies controls in other frameworks.)

Statement of Applicability

On any framework's page, Issue a statement now builds a Statement of Applicability: for every control of the framework, whether it applies, the justification for including it, the justification for an exclusion (with who recorded it and when), its implementation status and the policies and evidence behind it. Each issued statement is kept exactly as issued, with a SHA-256 of its content and an integrity stamp, and can be downloaded as CSV or PDF at any time. Downloads come with a paid plan; they are not on the Free plan.

How it is derived:

  • Basis. Your most recently completed program assessment. Its answers, including the Not applicable answers that scope a framework out, were fixed when it was completed. With none completed, every control is listed as applicable and none is reported as implemented or excluded: a control an active policy cites reads Documented in policy, not assessed, one that only AI system assessments answer reads Assessed per AI system, not at program level, and every other control reads Not assessed.
  • Not applicable only when every question that assesses the control was answered N/A in that assessment. The answers' notes are the justification; a framework-scoping N/A already names who scoped it and when. An N/A with no note is shown as "No justification recorded".
  • Implemented when every answered question is Yes, none is unanswered and no finding on its questions is open. Not implemented when no answer is Yes or Partial. Anything else is Partially implemented.
  • Assessed per AI system, not at program level when no question the program assessment asks assesses the control, but completed AI system assessments answered a question that does. The statement gives how many; their answers are not combined into a program-level status.
  • Documented in policy, not assessed when nothing is answered at program level yet but a statement of an active policy cites the control; otherwise Not assessed. A statement of a draft or under-review policy is listed beside the control as cited by that policy, and is not credited. Policy templates you have not adopted are never counted.
  • Justification for inclusion for an applicable control: the risks in your Risk Register recorded as treated by the control, each with its treatment and status. A control no risk names reads "No justification recorded". Name the controls that treat a risk on the risk's page.

Management system standards. For a standard whose controls are its Annex A controls beside its management system clauses (ISO/IEC 42001), the statement has two tables. The Statement of Applicability table lists the Annex A controls, with the columns above. Management system requirements (always apply) lists clauses 4 to 10 with the same status column: the standard requires every one of them, so none is excluded and none has a justification column. A requirement whose questions were all answered N/A reads Needs evidence (answered Not applicable), with those answers beside it. An Annex A control that every assessing question answered Not applicable but that an open risk in the risk register is recorded as treated by is included, not excluded: it reads Needs evidence (answered Not applicable), with those answers and the risks listed beside it. Every other framework's statement is one table.

The statement prints these rules in its own header, says no percentage, and is not a certification or legal advice. For a licensed standard whose control titles cannot be reproduced, the title column names the first question that assesses each control ("Assessed by: …"), and the header says so: read each identifier against your licensed copy of the standard.

When a newer program assessment is completed, or the Not applicable answers of the one a statement was built on change, the compliance calendar shows a Statement of Applicability refresh, due 30 days later, until a new statement is issued.

Issued statements

Issued statements (on the Frameworks page, or Statements of Applicability in an auditor's menu) lists every statement issued for any framework, newest first: the framework, its issue number for that framework, when and by whom it was issued, its basis, its number of controls (and, for a management system standard, of requirements) and its SHA-256.

  • Org admins download any of them as CSV or PDF from there.
  • Auditors whose engagement includes assessments see the list but cannot download a statement: the organization hands the file over, and the auditor compares its SHA-256 with the one listed. An engagement limited to particular assessments lists only the statements built on one of them.
  • Deleting a custom framework deletes its controls, but not the statements already issued for it: they stay listed, under the name the framework had, marked Framework since deleted, and can still be downloaded.

Who can do what

The Frameworks page (browsing the built-in libraries and managing your own: create, edit, add/remove controls, activate) is for org admins. Every member still sees the frameworks an assessment is scoped to, inside that assessment. A custom framework belongs to your organization and can be deleted by an admin.