# Control Catalogue

The Control Catalogue is part of the Standing Data for the Controls module. Its purpose is to give organisations a reusable library of standardised control definitions that can be applied to new controls, so that control creation is faster, more consistent, and easier to govern over time.

### Purpose

A Control Catalogue entry is a template for a control. When a user creates a new control and selects a Control Catalogue entry, a number of key fields on the control are pre-filled based on the catalogue entry.

The Control Catalogue exists to:

* Standardise how controls are described across the organisation.
* Reduce effort when creating new controls, especially for recurring control types (e.g. segregation of duties, four-eyes approval, access reviews).
* Support consistent reporting, because controls that originate from the same catalogue entry are inherently comparable.
* Make it easier for second-line and audit functions to recognise the control type at a glance.

Think of it as a catalogue of "off-the-shelf" control definitions that first-line users can pick from when documenting a new control, rather than starting from a blank form every time.

### Where to find the Control Catalogue

The Control Catalogue is part of the Controls standing data.

1. From the main dashboard, open **Standing Data**.
2. Expand the **Controls** menu item.
3. Select **Control Catalogue**.

You will see the list of all Control Catalogue entries configured for your environment.

<figure><img src="https://3191097248-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEeL4xdXxYZ2fsPsMzsYF%2Fuploads%2FvprHYCDVwOnkZpi1JTBT%2Fimage.png?alt=media&#x26;token=69e6cd97-f81a-4487-a80d-874395f23c00" alt=""><figcaption></figcaption></figure>

***

### Fields on a Control Catalogue entry

When you open or create a Control Catalogue entry, you can configure the following fields. Each of these fields will be copied onto a new control that references this catalogue entry.

#### Catalogue item name

The name of the Control Catalogue entry. This is the label users will see when they pick a catalogue entry on the "Create New Control" form. Use short, recognisable names (e.g. *Four-eyes approval*, *Quarterly user access review*).

#### Description

The default control description that will be applied when this catalogue entry is used on a new control. We recommend writing the description using the **5W 1H** structure (Who, What, Where, With what, When, What if), so that every control created from this catalogue entry starts from a complete, testable description.

#### Control properties

The control classification defaults, including:

* **Type** (Preventive, Detective, Repressive)
  * For this property, you can also decide whether the user creating the control is allowed to override the default or not. This lets you enforce consistency on properties that should not vary (e.g. a "four-eyes approval" template should always be preventive), while still allowing flexibility on properties that may vary per instance.
* **Source of the control**

#### Structure (Framework dimension)

You can pre-define a **Framework dimension** for the catalogue entry. When a control is created from this catalogue entry, the Framework dimension field on the control is pre-filled with this value.

This is particularly useful when a catalogue entry maps one-to-one to a specific framework requirement (for example, an ISO 27001 control objective or a DORA requirement).

<figure><img src="https://3191097248-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEeL4xdXxYZ2fsPsMzsYF%2Fuploads%2FZsXD0c62U7zSqRvZ102K%2Fimage.png?alt=media&#x26;token=82c2b356-4805-440f-868d-39ed1d43dc31" alt=""><figcaption></figcaption></figure>

### Using a Control Catalogue entry on a new control

Once a Control Catalogue entry is saved, it becomes available in the Control Catalogue dropdown on the "Create New Control" form.

1. Go to the **Controls Workspace**.
2. Click **Add new control**.
3. In the **Control catalogue** field, select the relevant catalogue entry.
4. The description, control properties, and the Framework dimension are pre-filled if configured.
5. Adjust any fields that should differ for this specific control instance, then continue with Organisation, Business dimensions, and the remaining control fields.

<figure><img src="https://3191097248-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEeL4xdXxYZ2fsPsMzsYF%2Fuploads%2FimwvBQAd83JikBmKhnnw%2Fimage.png?alt=media&#x26;token=db408c1e-84af-468f-a60e-f38f1ecafc51" alt=""><figcaption></figcaption></figure>

### Exporting the Control Catalogue

You can export a Control Catalogue entry to Excel. The export contains all of the relevant information configured on the catalogue entry and is useful for review, documentation, or bulk maintenance discussions with stakeholders.