SECCONTROL: Security Control
The SECCONTROL entity: An ISO 27001 Annex A security control record for the Statement of Applicability, tracking implementation status, evidence, and justification.
SECCONTROL definition shipped with DemandFlow. Administrators can add, remove, rename, or re-type fields, change which ones are required, and alter the layout from the Definitions screen in Settings. Your tenant's current schema may differ from what is shown here. To read the current definition at any time, GET the DEFINITION object whose id matches SECCONTROL.Entity properties
| Property | Value |
|---|---|
| Entity code | SECCONTROL |
| Display name | Security Control |
| Plural | Security Controls |
| Level | 90050 |
Use cases
SECCONTROL implements the Statement of Applicability (SoA) required by ISO 27001 clause 6.1.3(d). Each record represents one Annex A control from ISO 27001:2022. The controlCategory field maps to the four themes in Annex A (Organisational, People, Physical, Technological).
The applicable checkbox and justification field handle control exclusions (auditors require documented justification for excluded controls). Implementation status tracks progress from Not Started through to Certified. The evidence fields document what proof exists that the control is operating effectively.
Fields
Control Details
| Field | Type | Required | Notes |
|---|---|---|---|
controlRef | text | Yes | Control Reference |
name | text | Yes | Control Name |
controlCategory | enum | Yes | Category (Annex A Theme) Valid ids: organisational (A.5 Organisational Controls), people (A.6 People Controls), physical (A.7 Physical Controls), technological (A.8 Technological Controls). |
description | text (multi-line) | Control Description |
Applicability
| Field | Type | Required | Notes |
|---|---|---|---|
applicable | boolean | Is this control applicable to your organisation? | |
justification | text (multi-line) | Yes | Required by ISO 27001 6.1.3(d) - explain why this control is or is not applicable |
implementationStatus | enum | Yes | Implementation Status Valid ids: notStarted (Not Started), planned (Planned), partial (Partially Implemented), implemented (Fully Implemented), notApplicable (Not Applicable). |
maturityLevel | enum | Maturity Level Valid ids: 1 (1 - Initial / Ad-hoc), 2 (2 - Managed), 3 (3 - Defined), 4 (4 - Quantitatively Managed), 5 (5 - Optimising). |
Ownership
| Field | Type | Required | Notes |
|---|---|---|---|
owner | reference → user | Yes | Control Owner |
implementer | reference → user | Implemented By | |
lastAssessedDate | date | Last Assessed Date | |
nextAssessmentDate | date | Next Assessment Date |
Related Risk
| Field | Type | Required | Notes |
|---|---|---|---|
riskTreatment | enum | Risk Treatment Valid ids: mitigate (Mitigate / Reduce), accept (Accept), transfer (Transfer), avoid (Avoid). | |
residualRiskLevel | enum | Residual Risk Level Valid ids: low (Low), medium (Medium), high (High). |
Implementation Details
| Field | Type | Required | Notes |
|---|---|---|---|
implementationDetails | text (multi-line) | Describe the specific measures, tools, and processes used | |
relatedPolicies | text (multi-line) | List policy references that support this control |
Evidence
| Field | Type | Required | Notes |
|---|---|---|---|
evidenceDescription | text (multi-line) | What evidence exists to demonstrate this control is operating effectively? | |
gaps | text (multi-line) | Any gaps or weaknesses in the current implementation | |
improvementPlan | text (multi-line) | Planned improvements to address gaps |
Attachments
(file): file attachment field.
Additional panels
- Activity timeline panel attached.
Relationships
- Lookups:
ownerpoints at a user;implementerpoints at a user.
Creating a Security Control via the API
POST /v1/objects
Authorization: Bearer <your-pat>
Content-Type: application/json
{
"entity": "SECCONTROL",
"level": 90050,
"comboKey": "SUB:|ENT:",
"controlRef": "Example value",
"name": "Example name",
"controlCategory": "organisational",
"justification": "Example Justification for Inclusion/Exclusion"
} Listing Security Controls records
GET /v1/entities/SECCONTROL/SUB