> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zespan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Frameworks and controls

> The SOC 2 control mapping evidence packs draw on today — CC6.1, CC7.2, CC8.1 — what each control's evidence comes from, and what's not yet available.

A "SOC 2 control evidence" pack organizes Zespan's recorded facts under a framework's named controls, instead of under the agent-centric sections a Compliance Card uses. One framework is registered today.

## SOC 2

Selecting **SOC 2 control evidence** as your document type maps evidence to three Trust Services Criteria controls:

| Control   | Title                                                 | Evidence sources                                                                                                                                                                |
| --------- | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **CC6.1** | Logical access controls                               | Standing organization role assignments, plus every recorded membership or role change during the period                                                                         |
| **CC7.2** | Monitoring of system components and anomaly detection | Configured alert rules and incidents detected during the period, with time-to-resolve where a resolution was recorded                                                           |
| **CC8.1** | Change management                                     | Recorded changes to prompts, guardrail policies, and agent lifecycle state, plus externally-reported pipeline deploys and human approval requests raised for privileged actions |

Each control's narrative is explicit about scope. CC6.1, for example, states plainly that the section "reports what Zespan recorded; it does not assess whether those assignments were appropriate." A control document reports observed facts — never a judgment about whether those facts satisfy the control.

## Coverage

Before you generate, the Compliance page's **Coverage for this period** panel runs the same evidence queries each control would use and shows, per control, whether at least one of its sections produced records for the period you've chosen — without rendering or storing a document. A control with zero records across every one of its sections shows as uncovered, along with which sections came back empty, so a gap in the underlying data is visible before you generate — and possibly hand to an auditor — the document itself.

This mirrors what the generated document itself does at render time: a section with no records for the period prints the literal text "No evidence available for this period." rather than being silently omitted.

## `reviewedOn` / `reviewedBy`

Every SOC 2 control evidence document — in every format — carries a review-attribution line:

> Reviewed: 2026-08-08 by Zespan engineering — not reviewed by a licensed auditor

This is deliberately printed on the document itself rather than buried in a settings page. The SOC 2 mapping shipped in this release was authored and reviewed internally, by Zespan engineering — it has **not** been reviewed by a licensed external auditor. Treat a generated control-evidence document as a well-structured starting point for your own SOC 2 evidence collection, not as a substitute for your auditor's own judgment about what satisfies your specific control environment.

## Not yet available

<Note>
  **EU AI Act** and **ISO/IEC 42001** framework mappings are not available yet. Building either responsibly means qualified review before it ships — the same bar the SOC 2 mapping was held to — so this release ships one well-grounded mapping rather than several rushed ones. Adding a framework is additive to the current design (one new mapping file plus one registry entry), so it won't require a redesign when it happens.
</Note>

## Next steps

* [Evidence packs](/compliance/evidence-packs) — the two document kinds and how to generate one
* [Verification](/compliance/verification) — re-checking a generated document's citations
* [Compliance evidence limitations](/reference/compliance-limitations) — permanent data gaps stated in the documents themselves