Implementing and testing controls

A control proves itself through the work attached to it: manual tasks that people complete and document, automated tests that check a system, and assessments that record a verdict on whether the control is effective. This article covers all three.

Understanding Tasks vs Tests

Tidal distinguishes two fundamental ways to validate controls:

Manual Tasks

• Manual activities performed by people
• Require human assessment and evidence
• For example: creating network diagrams, verifying that incidents are resolved
• Status: Open → Closed

Automated Tests

• Monitoring progress in Tidal
• For example: Periodic policy reviews, completeness of risk information
• Monitoring external systems
• For example: Azure security settings, firewall rules, encryption status
• Status: Not executed → Pass/Fail

Working on manual tasks

Manual tasks open in a sidepanel on the control. You do the work there: discuss it in the Conversation tab, attach your evidence to a comment, then close the task.

Viewing manual tasks

1. Go to the control with pending tasks
2. Click on the control name to see the tasks and tests for this control
3. Click on a manual task in the expanded list
4. The task sidepanel opens with all necessary information
5. The Details tab contains additional information about the task
6. The Linked tasks tab contains an overview of linked tasks
7. The Feed tab contains a complete audit trail of this task

Collaborating via conversations

Comments and @mentions are how progress gets documented and the right people get pulled in.

Conversation tab functionality:

• Add comments - Document progress and ask questions
• Use @mentions - Notify specific people (e.g. @john)
• Real-time notifications - Stakeholders receive immediate messages

Example of an @mention:

@jane Can you review the network diagram I uploaded? 

Uploading evidence

Evidence is attached through a comment, so every file arrives with the context of why it was added.

File upload:

You can upload documents directly in the Conversation tab:

1. Scroll to the "Add your comment" section in the task interface
2. Click "Drop, or click to add files" or drag files directly to the comment field
3. A new comment automatically appears containing a link to the just uploaded file

Evidence best practices:

• Screenshots with timestamps for configuration evidence
• Signed documents for policy approvals and training records
• Log files for incident response and monitoring activities
• Reports for security scans and audit results

Completing / closing tasks

• Select 'Close task' at the top of the screen, or
• Write a comment and select 'Submit and Close' to close the task with a final comment.

Working on tests

You do not complete a test yourself; you refresh it and read the result. Any result other than Passed marks the control red.

Viewing tests

1. Go to the control with linked tests
2. Click on the control name to see the tasks and tests for this control
3. Click on a test in the expanded list
4. The test sidepanel opens with all necessary information

Refreshing test results

1. Click "Refresh" top right in the overview
2. The test now starts running and will add a new result

Interpreting test results

Not executed (Gray)

• The test has never been executed
• Refresh the test to get a result
• Control is automatically marked red

Pass (Green)

• Test executed successfully
• Configuration meets required security standards
• Contributes to green control compliance status

Fail (Red)

• Test detects non-compliance or security issue
• Requires immediate attention and remediation
• Control is automatically marked red

Error (Orange)

• Technical error in test execution
• Test must be executed again
• Control is automatically marked red

Azure Cloud tests example

Azure integration tests check:

• Data encryption at rest - Verification that Azure Data Disks are encrypted
• Network security groups - Firewall rules and access controls
• Identity management - Multi-factor authentication configurations
• Resource compliance - Tagging and naming conventions
• Backup configurations - Automated backup schedules and retention

Completing assessments

An assessment is a manual task with one extra obligation: you have to conclude whether the control is Effective or Ineffective, and that verdict feeds the control's status.

Assessments vs regular tasks

Assessments are specialized manual tasks with additional functionality:

• Assessors - Automatically assigned to control assessors (not owners)
• Linked tasks tab - Overview of all related tasks
• Effectiveness conclusion - Mandatory choice: Effective vs Ineffective
• Periodic assessment per control - assessments typically occur periodically, with one assessment covering the entire control
• One assessment for multiple controls - it's quite normal to assess multiple controls in one assessment. The Assessment task is then visible under each linked control in the overview

Executing assessments

Assessments are otherwise executed in the same way as regular manual tasks.

Drawing a conclusion

There is no unambiguous instruction to determine whether a control is Effective or Ineffective, or these instructions are organisation-specific.

But in general terms, we recommend the following strategy:

A control is effective when:

• All linked tasks have been successfully completed (closed)
• The associated evidence demonstrates adequate implementation of the relevant control
• All automated tests have been successfully completed (passed)
• No tasks, tests or other requirements are missing
• Any Issues linked to the control have been handled timely and adequately

A control is ineffective when:

• Tasks have not been executed according to deadline
• The associated evidence is insufficient
• Automated tests show security issues
• Tasks or tests needed for the control are missing
• Any Issues linked to the control have not been handled timely or adequately