Related: Shared Policies
Overview
Shared Controls is an optional feature that allows multi-workspace organizations to share controls across two or more of their workspaces. A Shared Control has the same owner, action items and their assignees, and other metadata in all of the workspaces it's shared across, reducing confusion and duplicated work between teams.
For example, if an employee in Workspace A and an employee in Workspace B are looking at the same Shared Control, the information they see will be the same, and any changes made in one workspace will be reflected in the other.
💡Thoropass uses a standardized list of controls, known as Unified Controls, for all customers. All Thoropass controls have a standardized name, and this name is the same from workspace to workspace even if the control is not shared. Changes to a control will only be reflected across more than one workspace if the control is shared.
To learn more about Unified Controls, see Understanding Unified Controls.
How Do I Know if a Control Is Shared?
All Shared Controls are chosen by you, the customer, and we'll never share a control unless you choose to.
Shared Controls will always be marked by an overlapping diamond icon, like this:
or
If a control or other object isn't marked by this icon, it is not shared.
How Do Shared Controls Work with Unified Controls?
For your convenience, Thoropass already features Unified Controls, a mapping of our most popular frameworks, such as SOC 2, ISO 27001, or HIPAA, to a single, core control list. This means that all Thoropass controls have a standardized name regardless of which frameworks you have unlocked.
Unified Controls are implemented for all customers whether or not they are a multi-workspace customer. Unified Controls and Shared Controls work hand-in-hand ensure your team does only the required work and nothing more.
Which Controls Should Be Shared?
Depending on the structure of your team or product, you may want some controls to be shared and others to remain independent.
For example, you may choose to share a control across some workspaces but not all, as with an infrastructure control that affects only some of your products, or you may choose to share a control across all your workspaces, as with a control related to employee background checks.
The structure of your teams, and therefore the structure of your Thoropass Workspaces, is unique to your organization. Deciding which controls should be shared is entirely up to you.
What about Monitors?
Because the integration configurations may vary per workspace, monitors are not shared. This means that if you log into Workspace A and view Control-123, the health may be in "Needs Attention" because of an unhealthy monitor, while that same Control-123, while logged into Workspace B is "Healthy" because all its associated monitors are functioning properly.
Note
Creating a Shared Control must be done by a CSM. If you'd like start sharing controls, contact your CSM.