Compliance Frameworks

Frameworks are how Muin organizes compliance work. A framework is a named collection of controls (e.g. SOC 2 CC6.1 — “Logical Access Controls”). Each control has a status, priority, assigned owner, test history, and linked evidence. Controls from different frameworks can be mapped to each other so proving one control’s evidence satisfies multiple frameworks at once.

The shape of a compliance program in Muin is: activate a framework → work the controls → map them across frameworks → attach evidence → track readiness on the Dashboard.

Framework List (/compliance/frameworks)

The list page shows every framework you’ve activated in this tenant. Each card shows:

Field	What it shows
Name	e.g. “SOC 2 Type II”
Type	soc2, gdpr, hipaa, pci_dss, iso27001, nist_csf, ccpa, custom
Status	not_started, in_progress, ready_for_audit, certified
Completion	Progress bar showing implemented_controls / total_controls
Certification expiry	Date the current certificate lapses (if certified)
Owner	Framework owner (a User)

Click a card to open the framework detail page (IS1).

Importing SOC 2 from Template

The fastest way to activate SOC 2 is the template import:

1. On the Frameworks page, click Import Template
2. Select SOC 2 Type II
3. Optionally limit to a subset of Trust Services Criteria — by default, all five categories are imported
4. Click Import

Trust Services Category	Required?	Purpose
Security (CC)	Always included	Common Criteria — access, change, operations
Availability	Optional	System availability commitments
Confidentiality	Optional	Confidentiality commitments
Processing Integrity	Optional	Accuracy and completeness
Privacy	Optional	Privacy commitments

The import is atomic — it uses a database SAVEPOINT that wraps the framework row and every control row as a single unit. If anything fails mid-flight (network blip, constraint violation, tenant quota exceeded) the whole thing rolls back. You never end up with a half-imported framework that has a name but no controls. See FrameworkService.import_from_template for the implementation.

If a SOC 2 framework already exists in this tenant, the import returns a 409 Already Exists error instead of silently duplicating. To re-import with different categories, archive the existing framework first.

The default SOC 2 Type II template has 51 controls across the five trust service categories, based on the AICPA Trust Services Criteria 2017 revision. Template definition: muin.core/src/muin_core/seeds/compliance/soc2_framework_template.py.

Currently soc2 is the only template with a built-in importer. GDPR, HIPAA, ISO 27001, and other types are supported as frameworks — but they’re activated by creating the framework manually and adding controls. Template importers for those are tracked post-beta.

Creating a Custom Framework Manually

For frameworks without a built-in template:

1. Click New Framework
2. Fill in name, type (pick the closest type or custom), version, description, certification target date
3. Click Create
4. On the detail page, click Add Control to populate controls one at a time

Custom frameworks don’t get the SAVEPOINT atomic import benefit — each control is added independently, so a failure partway through leaves the framework with however many controls succeeded.

---

Framework Detail (/compliance/frameworks/:id — IS1)

The framework detail page is the working surface for a framework:

Section	What it shows
Header	Framework name, type, status, completion %, readiness threshold
Controls tab	Every control with its status, category, priority, owner
Mappings tab	Cross-framework mappings involving this framework’s controls
Test history	Control tests across the framework, most recent first
Evidence	Documents attached across all controls in this framework

The header shows a readiness threshold (default 80). The overall compliance score is compared against this threshold to render the “Audit-ready” badge on the Dashboard. Change it per framework — SOC 2 Type II audits often aim higher than 80; internal-only custom frameworks can sit lower.

Filtering the Control List

The controls tab supports search and filters:

• Search — by control ID (CC6.1), name, or keyword in the description
• Status — not_started, in_progress, implemented, tested, certified, not_applicable
• Priority — 1 (highest) through 5 (lowest)
• Category — the sub-category within the framework (e.g. “governance”, “logical_access”)
• Owner — controls assigned to a specific user

The list is paginated — expect ~50 controls for SOC 2 Type II (more if you imported all 5 categories, fewer if you filtered).

---

Control Detail (/compliance/controls/:id — IS2)

Click any control to open its detail page. Sections:

Section	What it shows
Overview	Control ID, name, description, category, priority, status, owner
Evidence	Attached documents with their filename, type, upload date, click-through to the document
Test history	Dates the control was tested, tester, outcome, linked test-plan document
Related risks	Risks in the Risk Register that reference this control
Related incidents	Incidents whose root cause or corrective action references this control
Cross-framework mappings	Other frameworks’ controls mapped to this one

Attaching Evidence

Click Attach Evidence on the Evidence section. Muin opens the Documents module with the correct context pre-set:

• document_type=compliance_evidence — so the new document is tagged as evidence up front
• linked_control_id={this control's ID} — so after upload the document is automatically linked back

Upload the file in the Documents module and return. The Evidence section now shows the new document, with the filename clickable to navigate into document detail.

This design keeps evidence uploads going through one code path (the Documents module) — so virus scanning, version control, and storage lifecycle are handled in one place, not reimplemented per module.

Suggest Evidence (AI)

On control detail, the Suggest evidence button asks Bedrock Claude to propose evidence document types based on the control description and the tenant’s existing linked evidence. The suggestion is a list of evidence types — it doesn’t auto-create documents. You review, pick what fits, and upload the real files through the normal Documents flow. Hallucinated document names get fenced — suggestions must reference generic evidence categories, not specific documents Muin hasn’t seen.

Updating Status

The status dropdown moves a control through its lifecycle: not_started → in_progress → implemented → tested → certified. not_applicable is an alternate terminal state for controls that don’t apply to this tenant (e.g. a payment-processing control at a non-payments tenant).

Status transitions are recorded in an audit log with the user, timestamp, and optional comment. Backward transitions are allowed (e.g. a failing test drops a control from certified back to in_progress) but they log a warning for the compliance owner to review.

---

Cross-Framework Control Mapping

If your SOC 2 CC6.1 (Logical Access) is fulfilled by the same evidence as your ISO 27001 A.9.1.1 (Access Control Policy), map them. A mapping means: when you upload evidence or mark one control as tested, Muin knows the other control should be looked at too.

Creating a Mapping

On a control’s detail page, click Add Mapping. The form asks for:

Field	What it means
Target control	The control in the other framework this one fulfills
Mapping type	equivalent, fulfills, related — informational metadata, doesn’t change automatic logic
Confidence	0.0-1.0 — how strong the mapping is
Notes	Free text for the auditor

Mapping Guards (enforced at the service layer)

Guard	What it enforces	Error
No self-mapping	source_control_id != target_control_id	422 Cannot map a control to itself
Tenant isolation	Both source and target must exist in your tenant	404 Not Found (no information leaks about other tenants’ controls)
Uniqueness	The combination (tenant, source, target) must be unique	409 Already Exists

These guards are implemented in FrameworkService.create_control_mapping (see Plan 272h-2 R2-MAPPING-HARDEN).

AI-Suggested Mappings (post-beta)

AI-assisted mapping between frameworks is planned post-beta. The FrameworkMapper agent scaffolding exists in the codebase, but the LLM wiring is not shipped in beta — the mapping creation UI today supports manual pairing only, with the service-layer guards above preventing duplicates and cross-tenant leakage. LLM-backed suggestions will be tracked in a follow-up plan.

---

FAQs

How do I import SOC 2?

On the Frameworks page, click Import Template, select SOC 2 Type II, leave all five trust service categories selected (or narrow to just Security), and click Import. All 51 controls land in one atomic operation — either the whole framework appears or nothing does. If Muin shows “409 Already Exists” you already have a SOC 2 framework; archive it first if you want to re-import.

What counts as evidence?

Any document in the Documents module with document_type=compliance_evidence linked to a control. The click-through from the control’s Evidence section opens the document in its native Documents module view — so you get versioning, virus scanning, and retention lifecycle automatically. Common evidence types: policy PDFs, screenshots of configurations, exported audit logs, signed memos, training completion certificates.

How do I map a control to another framework?

Open the source control’s detail page, click Add Mapping, pick the target control from your other framework, set the mapping type (equivalent / fulfills / related), optionally add a confidence score and notes, and save. Muin will reject the mapping if you picked the same control as both source and target (self-mapping is not allowed), if the target belongs to another tenant (tenant isolation), or if the same source→target mapping already exists (uniqueness).

Can I import GDPR or ISO 27001 from a template?

Not at beta — soc2 is the only template with a built-in importer. For GDPR, HIPAA, and other frameworks, create the framework manually using New Framework and add controls one at a time. Additional built-in templates are tracked post-beta.

What happens when a control’s status drops back to “in progress”?

The status change is recorded in the audit log with the user, the previous status, the new status, and an optional comment. Downgrades don’t delete the control’s test history or evidence — they just indicate that something changed and the control needs re-testing. The compliance score reflects the new status immediately after cache expiry (5 minutes).

---

Related

• Compliance Health — how framework completion feeds the overall score (25% weight)
• Risk register — link controls to risks they mitigate
• SOC 2 audit — the auditor portal and evidence-sampling flow
• Policy hub — attach policy documents as control evidence