What is Compliance4DevOps?

Compliance4DevOps is an Azure DevOps extension for running compliance audits where your engineering work already happens. It connects the standards you must meet to the controls you run, the evidence your teams produce and the audits you carry out. At the end of an audit, it produces a finished audit package your auditors can review.

You don't need a separate tool, a second login or a set of spreadsheets. Compliance4DevOps uses your Azure DevOps sign-in and works alongside your projects.

What you can do with it

Keep your standards in one place. Add ready-made standards to your Standard Library, import your own from a PDF, or write a private standard. Choose how each standard's clauses are scored, from Pass or Fail to maturity levels.

Define controls once and use them across standards. Map each control to every clause it covers, even across several standards. You can also see which clauses still have no control.

Link evidence from where the work is done. Link evidence from:

• Azure DevOps work items, pull requests, pipeline runs, repository files, wiki pages and test plans.
• Modern Requirements artifacts: Smart Docs, Version Packages, Baselines, Reviews, Traceability and Diagrams.
• Files in your Documents library, web links and notes.

Azure DevOps evidence is saved at the version you relied on, such as a work item's revision or a file's commit, so later changes don't alter what you cited.

Run audits the same way every time. Create a compliance event for an internal audit, external audit, gap assessment or self-assessment. Decide which clauses apply, record a verdict for each one, and add an optional review step. When the audit is complete, finalize the event to lock its results.

Track issues to closure. Raise findings with a severity, an owner and a due date, and track corrective actions until they're done.

See where you stand. Dashboards show progress, verdicts, open findings and overdue items for each audit and across the project.

Produce audit packages in minutes. Generate a PDF package from a template, with your branding, a document number and a version. A package never changes once it's generated. Regenerating creates a new version.

Keep a full record. The History tabs record who changed what and when.

Who it's for

• Compliance and risk teams set up standards, run audits and produce audit packages from one place.
• Engineering teams and leaders show compliance using the work they already do in Azure DevOps, without extra paperwork.
• Auditors get read-only access to the evidence, verdicts and findings behind each audit, and can download its packages.

Roles control what each person can see and change. For example, an Assessor records verdicts, a Reviewer reviews them and an Auditor reads everything without changing anything.

What you need

• An Azure DevOps organization.
• An organization administrator to install the extension from the Visual Studio Marketplace.
• A license, or a free trial to get started.

Next steps

Install Compliance4DevOps in your Azure DevOps organization

Add the extension to your organization and open it for the first time.

Before you start

You need to be a Project Collection Administrator in your Azure DevOps organization to install the extension. Other users can request it, and an administrator approves the request.

Compliance4DevOps only reads from Azure DevOps. It never changes your work items, code, pipelines, wikis, test plans, projects or identities.

Install the extension

For now, submit a trial request on the Compliance4DevOps website. We'll send you the installation instructions.

Open it for the first time

1. In Azure DevOps, go to Organization settings and select Compliance4DevOps in the left menu.
2. Select Start free trial. No credit card is needed.

You're given a license straight away, and the app opens.

As a Project Collection Administrator, you have full access to every setting.

Where to find it

Compliance4DevOps has two places in Azure DevOps:

Give your team access

Each person needs a license and a role:

• License: Someone who opens the app without a license sees “You don't have a Compliance4DevOps license”. An administrator assigns licenses from the members list in Organization settings.
• Role: Roles decide what each person can see and change. For example, Assessor, Reviewer and Auditor.

Next steps

Key concepts: standards, controls, evidence and events

Everything in Compliance4DevOps is built on four ideas. Once you know how they fit together, every screen makes sense.

Standards: what you must meet

A standard is a framework your organization has to comply with, such as ISO/IEC 27001 or SOC 2. It's broken into clauses, the individual requirements you're assessed against.

• Standards live in your organization's Standard Library. You can add a ready-made standard, import one from a PDF, or write your own.
• Clauses are arranged in sections. Some clauses are only headings. The clauses that state requirements are the ones you assess.
• Each standard has a verdict scale that sets how its clauses are scored, for example Pass, Partial and Fail, or maturity levels 1 to 5.
• A standard must be Published before it can be used in an audit.

Controls: what you do to meet them

A control is something your organization does to meet a requirement, for example “Enforce MFA for all admin accounts” or “Review access every quarter”.

• Controls belong to a project and are numbered, such as CTRL-6.
• Each control has a type, such as Preventive or Detective, an owner, and a status of Draft, Active or Retired.
• You map a control to every clause it covers, even across several standards. One control can satisfy many clauses, so you do the work once.

Evidence: proof that you do it

Evidence shows that a control is in place and working. You add evidence to a control, and through that control it supports every clause the control is mapped to.

• You can link Azure DevOps work items, pull requests, pipeline runs, repository files, wiki pages, test plans and test runs.
• You can also use files from your Documents library, web links and notes.
• If your organization uses Modern Requirements4DevOps, you can link its items too, such as Smart Docs, Baselines, Reviews and Diagrams.
• Azure DevOps evidence is saved at the version you relied on, such as a work item's revision, a pull request's update or a file's commit. A test run has no versions, because a finished run doesn't change.

Events: when you check it

A compliance event is one audit or assessment, such as an internal audit, an external audit, a gap assessment or a self-assessment. It covers one or more standards, has an owner, and runs over an audit period.

In an event, you:

1. Decide which clauses apply. A clause marked not applicable needs a reason.
2. Record a verdict for each applicable clause, based on its controls and evidence. An optional review step can check each verdict.
3. Raise findings for problems, and track corrective actions until they're done.
4. Generate an audit package, a PDF of the results for your auditors.
5. Finalize the event when the audit is complete. This locks its results.

How they fit together

Where to find each one

Next steps

Add a standard to your Standard Library

Load a standard once, and every project in your organization can use it in its audits.

Before you start

• You need permission to manage the Standard Library. The Org Administrator and Compliance Program Manager roles include it.
• Go to the library: Organization settings > Compliance4DevOps > Standard Library.

Choose how to add it

Add a public standard

1. In Standard Library, select Add Standard.
2. Choose Public Standard.
3. Search or filter by industry, then select the standard.
4. Select Import Standard, then Confirm adoption.

The standard is added with the status In Review. Review it, then publish it. A standard marked Already adopted is already in your library.

Create a private standard

1. In Standard Library, select Add Standard.
2. Choose Private Standard.
3. Enter the Name, Abbreviation, Version and Issuing body, for example “Medical device software life cycle”, “IEC”, “62304” and “IEC”. You can add a description.
4. Select Create standard.

The standard is added with the status Draft, ready for you to add clauses.

Import clauses from a PDF

You can import clauses into a private standard while it's still in Draft.

1. Open the standard, then select Standard settings and choose Import clauses.
2. Upload a PDF or a JSON file. The clauses are extracted for you.
3. Check the extracted clauses. Each one shows how confident the extraction was, so you know which to look at closely.
4. Save the clauses to the standard.

Review the extracted clauses

The review list shows each clause's ID, title, type and a confidence score.

What the confidence score means: It's a number from 0 to 100 that shows how sure the import is that it read a clause correctly. It's based on three checks: the clause number, the clause type, and where the clause sits in the hierarchy. The weakest of the three mostly sets the score. It doesn't check the clause text, so read the wording yourself. A clause imported without a score shows none. For example, a JSON file may not include scores.

Each clause gets one of four types. You can change any clause's type after import.

Publish the standard

A standard can be used in a compliance event only once it's Published. Use the standard's Status menu to move it along:

Next steps

Choose how clauses are scored with verdict scales

A verdict scale is the list of outcomes an assessor can record against a clause, such as Pass, Partial or Fail. Each standard uses one scale.

Before you start

• You need permission to customize the library to create or change scales. Anyone with access can view them.
• Scales live in your organization's library: Organization settings > Compliance4DevOps > Verdict Scales. One scale can be used by many standards.

Built-in scales

Every organization starts with three scales:

Built-in scales can't be edited. To change one, duplicate it and edit the copy.

Public standards may come with their own scale, marked MR-published. Those are read-only too, so duplicate one to make an editable copy.

How outcomes work

Each value on a scale belongs to one of three outcomes: Pass, Partial or Fail. You can name values however you like, but the outcome decides how a verdict counts. It drives dashboards, failing-clause counts, roll-ups to parent clauses, and audit package results.

Create a scale

1. In Verdict Scales, select Create scale.
2. Enter a Scale name and, optionally, a Description of when to use it.
3. Add at least two values. For each value, enter a Value label and choose its Outcome. Labels must be unique within a scale.
4. Optionally, turn on Graded / scored scale and give each value a number. This lets results be averaged or scored, for example Pass = 1, Partial = 0.5, Fail = 0.
5. Select Create scale.

You can also choose a color for each value. A value without one uses its outcome's default color.

Assign a scale to a standard

1. Go to Standard Library and open the standard.
2. Select Standard settings > Edit verdict scale.
3. Choose a scale from the library, or create one from there.

When a scale can't be changed

A scale locks once a standard or a compliance event uses it, so recorded verdicts keep their meaning. To change a locked scale, duplicate it, edit the copy, and assign the copy where you need it. If a standard is locked, its verdict scale is read-only too.

Next steps

Customize control and event fields

Add the fields your team needs to track, such as an implementation type on controls or a sampling method on assessments.

Before you start

• You need permission to manage control and event settings. The Org Administrator role includes it. Other roles can view the settings but not change them.
• Find the settings in Organization settings > Compliance4DevOps:
  • Controls: fields on every control.
  • Events: fields on compliance events, clause decisions, assessments and findings.

Each settings page lists two kinds of fields:

Add a field to controls

1. Go to Controls and select Add attribute.
2. Enter an Attribute name, for example “Implementation type”.
3. Choose a Data type. For a select type, add its Options.
4. Choose which control types it's used in: all types, or only some, such as Preventive or Detective.
5. Turn on Required if it must be filled on every control it applies to.
6. Select Add attribute.

Add a field to events

Event fields are grouped by where they're filled in:

1. Go to Events and choose a section.
2. Select Add attribute.
3. Enter an Attribute name, for example “Sampling method”.
4. Choose a Data type. For a select type, add its Options.
5. Turn on Required if the field must be filled before the event can be finalized.
6. Select Add attribute.

Data types

Things to know

• A field's data type can't be changed after you create it. To change it, add a new field.
• Options can be added or removed, but not renamed. A removed option still shows on records that already hold it, marked as removed.
• Removing a field deletes the values recorded in it. The confirmation tells you how many records hold a value.
• Drag fields to reorder them. The order you set is the order users see.
• Custom fields don't print in audit packages yet.

Next steps

Give people access with roles

Roles decide what each person can see and change. Organization roles cover the settings everyone shares. Project roles cover the audit work in each project.

Before you start

• Each person needs a license as well as a role. See Start a free trial and assign licenses.
• Project Collection Administrators already have full access. It's granted through Azure DevOps, so you can't change it here. To change it, remove them from Project Collection Administrators in Azure DevOps.

Organization roles

Organization roles control the settings in Organization settings > Compliance4DevOps.

Project roles

Project roles control the work inside each project. A person can hold more than one, for example Assessor and Reviewer.

Give someone an organization role

1. Go to Organization settings > Compliance4DevOps > Access Permissions.
2. On the Members tab, select Add member.
3. Pick the Azure DevOps user and their Organization role.

Adding a member uses one of your license seats.

Give someone a project role

1. In your project, open Compliance4DevOps and go to the Members tab.
2. Select Add member and find the person. You can search the whole organization.
3. Choose their Project role.

To change a role later, open the member's menu and select Change project role.

Create a custom role

The six project roles and three organization roles are system roles, and their permissions can't be edited. To make a role with different permissions:

1. Go to Access Permissions > Roles.
2. Open a system role and duplicate it, or select Create custom role.
3. Name the role, and turn permissions on or off.

You can't grant a permission you don't hold yourself. Some permissions, such as managing roles, can only be granted by an Org Administrator.

Next steps

Create a control and map it to clauses

Write a control once, and map it to every clause it covers across your standards.

What a control is

A control is something your organization does to meet a requirement, for example “Multi-factor authentication” or “Quarterly access review”. You map it to the clauses it covers and add evidence that it works. Every clause it's mapped to then shares that evidence.

Create a control

1. In your project, open Compliance4DevOps and go to the Controls tab.
2. Select + New Control.
3. Fill in the control:
   • Control Name: It must be unique in the project, for example “Multi-factor Authentication”.
   • Control Type: Preventive, Detective, Corrective, Compensating, Directive, Deterrent or Recovery.
   • Description: What the control does and how.
   • Any other fields your organization has added.
4. Select Create control.

The control gets a number automatically, such as CTRL-6. New controls start in Draft.

Map it to clauses

1. Open the control and go to its Clauses tab.
2. Select Map clause.
3. Choose a Standard, or keep All standards to search across all of them.
4. Search for the clauses this control covers, and select them.
5. Select Done.

You can map one control to clauses in several standards. For example, one MFA control can cover clauses in both ISO/IEC 27001 and SOC 2.

To remove a mapping, select Unmap clause next to it.

Add controls while assessing

You can also add controls from inside a compliance event. When you're working on a clause, add a control to it. Choose Find existing to map a control you already have, or Create new to write one there and then.

Control statuses

Things to know

• Duplicate a control to start a similar one quickly.
• A control can't be deleted once it's mapped to clauses or used in an event. Unmap it and remove it from those events first, or set its status to Retired instead.
• Deleting a control also removes its evidence links. This can't be undone.
• Each control has its own History tab, which records what changed and who changed it.

Next steps

Link Azure DevOps artifacts as evidence

Use the work items, pull requests, pipeline runs and test runs your team already has as evidence for a control.

What you can link

Link an artifact

1. Open the control and go to its Evidence tab.
2. Select Link existing, then choose the Azure DevOps tab.
3. Choose a type, such as Work items.
4. Search by name or ID, and select the artifacts you want. Anything already linked to this control is marked Already linked to this control.
5. Choose a version for each one. See below.
6. Select Add evidence.

Versions: what each type saves

Evidence should show an artifact as it was when you relied on it, not as it is later. So the app saves a specific version of every artifact type except test runs.

For each artifact you pick:

• Leave it on Current version to cite the version that exists now. Later changes don't alter what you cited.
• Or select Choose version, pick an earlier one from the list, then select Pin version. For a pipeline run, you also choose which attempt you cite.

What can't be linked yet

Some artifacts can only be cited once they're finished:

If you pick a pipeline that has never completed a run, the app tells you it has no completed runs to cite yet.

Finding older pull requests and runs

To keep searches fast:

• Pull requests: The search starts with the 100 most recently completed ones.
• Pipeline runs: The search starts with runs from the last 4 weeks.

Select Search the last 3 months or Search the last year to look further back. To find something older, search for its number or ID.

Opening linked evidence

On the Evidence tab, opening an Azure DevOps artifact shows the version you cited:

• Work items and test plans: Azure DevOps has no page for an old revision, so the app shows the saved revision itself.
• Pull requests, pipeline runs, repo files and wiki pages: These open in Azure DevOps at the cited update, run or commit.
• Test runs: These open the run in Azure DevOps.

If an artifact has since been deleted from Azure DevOps, the app tells you it's no longer available.

Next steps

Link Modern Requirements artifacts as evidence

If your organization uses Modern Requirements4DevOps, you can use its Smart Docs, Baselines, Reviews and Diagrams as evidence.

Before you start

An administrator must set up the Modern Requirements integration. Until then, the tab says “The Modern Requirements integration isn't configured yet.”

What you can link

Link an artifact

1. Open the control and go to its Evidence tab.
2. Select Link existing, then choose the MR artifacts tab.
3. Choose the Artifact Type, such as Smart Docs.
4. Search Modern Requirements, and select the artifacts you want.
5. For a Smart Doc or Version Package, choose a version. See below.
6. Select Add evidence.

Choose a version

• Latest links the artifact as it is now, and it opens the live artifact. If the artifact changes later, the evidence shows the change.
• A specific version keeps the evidence fixed. Choose one with Choose version, then select Pin version.

Opening linked evidence

On the Evidence tab, select Open in Modern Requirements to view the artifact. If it has since been removed, the app tells you it's no longer available.

In audit packages

Modern Requirements artifacts are listed by name in the package's Evidence index.

Next steps

Upload files and add links as evidence

Attach evidence that lives outside Azure DevOps, such as a signed policy, a report or a page on another website.

Upload a file

1. Open the control and go to its Evidence tab.
2. Select Upload, then choose Upload file.
3. Drop a file in the box, or choose one.
4. Check the Evidence name. It defaults to the file name. Optionally, add a Description.
5. Select Upload document.

Accepted files: PDF, Word, Excel and CSV, PowerPoint, images, text and log files, email (.msg and .eml) and .zip files, up to 50 MB.

Not accepted: Files that can run code in a browser, such as web pages (.html), SVG images and scripts. XML files and saved web pages (.mht) are accepted, but they always download rather than open.

Add a link

1. On the control's Evidence tab, select Upload, then choose Link.
2. Enter the Link URL, for example “https://status.example.com/incidents/204”.
3. Enter an Evidence name, and optionally a Description.
4. Select Add link.

A link opens in a new tab. In an audit package, it prints with its address.

Reuse a document from the library

If the file is already in the Documents library:

1. On the control's Evidence tab, select Link existing.
2. Choose the Document library tab.
3. Search for the document, or filter by folder, then select Add evidence.

One document can be evidence for many controls.

Edit or remove evidence

Open the evidence row's menu:

• Edit changes its name or description.
• Unlink from control removes it from this control. An uploaded file stays in the Documents library.

Next steps

Organize files in the Documents library

Keep your project's policies, procedures and reports in folders, ready to use as evidence.

Open the library

In your project, open Compliance4DevOps and go to the Documents tab.

Add a document

1. Select Add document.
2. Choose the Document source:
   • Upload file: Choose a file.
   • Link: Enter the Link / reference URL.
3. Check the Name. For a file, it defaults to the file name.
4. Choose a Category: Policy, Procedure, Standard, Report, Evidence or Other.
5. Choose a Folder, and optionally add a Description.
6. Select Upload document.

Files can be up to 50 MB. The accepted types are the same as for evidence uploads.

Organize with folders

• Create a folder: Select New folder and enter a Folder name, for example “Policies”. You can nest folders up to 10 levels deep.
• Rename or delete a folder: Use its Folder actions menu.
  • Deleting a folder never deletes documents. Its documents and sub-folders move up into the folder above it.
• Move a document: Edit the document and choose a different folder.

The Control Evidence folder

Every file uploaded as evidence from a control is added to the Control Evidence folder automatically. You can move those files into other folders. You can't upload into the Control Evidence folder directly. Upload from a control instead.

Use a document as evidence

Documents in the library can be linked to any control. On the control's Evidence tab, select Link existing and choose the Document library tab. A document can support many controls at once.

Delete a document

Open the document's menu and select Delete. This can't be undone.

Next steps

Create a compliance event

A compliance event is one audit or assessment of one or more standards. Create one for each internal audit, external audit, gap assessment or self-assessment.

Before you start

• The standards you assess must be Published in your organization's Standard Library.
• You need permission to manage events. The Project Compliance Manager role includes it.

Create the event

1. In your project, open Compliance4DevOps and go to the Compliance Events tab.
2. Select + New Event.
3. Fill in the event:
   • Event Name: It must be unique in the project, for example “ISO 27001 Surveillance Audit”.
   • Standards: Choose one or more published standards to assess.
   • Start Date and End Date: The audit period. The end date can't be earlier than the start date.
   • Owner: The person accountable for the event.
   • Event Type: Internal audit, External audit, Gap assessment or Self-assessment, if your organization uses it.
   • Any other fields your organization has added.
4. Select Create event.

The event opens with the status Planning.

Inside an event

Event statuses

Change the status on the Details tab.

Change the standards later

To add or remove a standard, open the event and use Manage standards.

Next steps

Decide which clauses apply

Before you assess, decide which clauses apply to this event. A clause that doesn't apply is excluded from assessment, and it needs a reason.

How applicability works

• Every clause starts as applicable. A clause with no decision yet is treated as applicable, and it will need a verdict before the event can be finalized.
• A not-applicable clause is excluded. It needs no verdict, isn't counted in results, and appears with its reason in audit packages.

Mark a clause applicable or not

1. Open the event and go to the Clauses tab.
2. Select a clause, then open its Applicability tab.
3. Select Edit applicability.
4. Choose the Applicability Status: Applicable or Not Applicable.
5. For Not Applicable, choose a Not-applicable Reason:
   • Out of scope
   • Not relevant to context
   • Satisfied by inheritance
   • Other
6. Add a Justification explaining the decision. Your organization may require it.
7. Save.

The app records who made the decision and when.

Apply the decision to sub-clauses

When a clause has sub-clauses, you can apply the same decision to them with Cascade to sub-clauses:

• Overwrite all sub-clauses replaces decisions someone has already recorded.
• Fill only undecided sub-clauses leaves existing decisions untouched.

Marking an assessed clause not applicable

Find clauses quickly

On the Clauses tab, filter the list by applicability to see which clauses are applicable and which aren't.

Next steps

Record and review verdicts

Record a verdict for each applicable clause, based on its controls and evidence. Then a reviewer checks it, if your organization requires review.

Who does what

Record a verdict

1. Open the event and go to the Clauses tab.
2. Select a clause. Check its Controls & Evidence tab to see what supports it.
3. Open the Assessment tab and select Edit assessment.
4. Choose a Verdict. The choices come from the standard's verdict scale, for example Pass, Partial or Fail.
5. Add an Assessment Note explaining your verdict, and fill in any other fields your organization requires.
6. Save.

The app records who assessed the clause and when.

Clauses that roll up

• A Container has no verdict of its own. Its result rolls up from the clauses under it.
• An Assessable Container is assessed itself, and also rolls up.

To change a rolled-up result, select Override verdict, choose the verdict and give a reason. Remove verdict override goes back to the rolled-up result.

Review a verdict

1. Select a clause that has a verdict, and open its Assessment tab.
2. Read the verdict, the note and the evidence.
3. Set the Review Status:
   • Reviewed: The verdict is accepted.
   • Needs rework: The assessor should look again.
   • Not reviewed: Not checked yet.
4. Save.

The app records who reviewed the clause and when.

When review is required

If your organization turned on Require review before finalizing, every clause with a verdict must be marked Reviewed before the event can be finalized.

Track progress

The event's Dashboard shows how many clauses are assessed and reviewed, and how the verdicts break down.

Next steps

Raise findings and track corrective actions

When an assessment uncovers a problem, raise a finding. Then add corrective actions and follow them until the problem is fixed.

Raise a finding

1. Open the event and go to the Clauses tab.
2. Select the clause where you found the problem, and open its Findings tab.
3. Select Raise finding.
4. Fill in the finding:
   • Title: A short summary of the problem.
   • Description: What you found.
   • Severity: Major, Minor or Observation.
   • Owner: Who's responsible for fixing it.
   • Due date: When it should be fixed.
   • Recommendation: What should be done.
5. Save.

The finding gets a number, such as F-001, and starts with the status Open.

Link a finding to more clauses

A finding often affects more than one clause. Select Manage affected clauses to add others. The app suggests clauses that share a control with this one. You can also search all clauses in the event.

Add corrective actions

1. On the finding, select Add action.
2. Fill in the action:
   • Action: What will be done.
   • Description: More detail.
   • Owner and Due date.
   • Status: Not started, In progress or Complete.
3. Save.

Each action gets a number, such as ACT-001. When you mark an action Complete, record who completed it and when.

Close a finding

When the problem is fixed, change the finding's Status to Closed. The app records who closed it and when. Finding statuses are Open, In Progress and Closed.

Overdue items

A finding or action is overdue when its due date has passed and it isn't closed or complete. Overdue items show on the event's Dashboard and on the project Overview.

After the event is finalized

• You can still close findings, so remediation can continue.
• Everything else is locked: a finding's other fields, its affected clauses and its corrective actions can't be changed.

Next steps

Finalize an event

When the audit is complete, finalize the event to lock its results. A finalized event is the permanent record of the audit.

Before you start

• You need permission to finalize. The Project Compliance Manager role includes it.
• The event's status must be Completed.

Finalize the event

1. Open the event and go to the Details tab.
2. Change the Status to Finalized, then save.
3. The app checks whether the event is ready. Review what it lists, then select Finalize event.

What must be done first

These stop the event from being finalized:

Warnings to check

These don't stop you, but they're worth a look before you lock the results:

• Evidence that has changed or been deleted since it was cited.
• Applicable clauses with no evidence.
• Major findings with no corrective action.
• Findings that are still open.
• Findings not linked to any clause.
• Required fields left blank.

Each warning links to the records it's about. If nothing is outstanding, the app says Nothing outstanding.

What finalizing does

• The event becomes read-only. Applicability, verdicts, reviews and corrective actions can't change.
• Findings can still be closed, so remediation can be recorded.
• It can't be reopened. To correct a finalized audit, create a new event.
• New audit packages are no longer marked DRAFT in the package list. Packages generated before finalizing keep their DRAFT mark, so regenerate them for a final version.

Cancel instead

Next steps

What is an audit package?

An audit package is a PDF document generated from a compliance event's data, ready to hand to an auditor. It records the standard you assessed, which clauses apply, the verdicts, the controls and evidence behind them, and the findings raised.

What a package contains

The sections come from a template your organization sets up. A package can include:

How auditors read it

• Every item has a number, and the same number is used throughout. Controls are CTRL-6, evidence is E-07 and findings are F-001. An auditor reading the Clause table can look up E-07 in the Evidence index, and CTRL-6 in the Controls register.
• Every page shows the document number, version and confidentiality marking in the header and footer, with “Page X of Y”.
• Links in the PDF are clickable. Evidence opens in Azure DevOps or on the web, for readers with access.
• Azure DevOps evidence shows the version you cited, such as a work item's revision or a file's commit, not whatever it looks like today.
• “Generated on” gives the exact time the package was made, in your organization's time zone. Overdue items are judged as of that day.

Packages never change

Once a package is generated, its PDF is fixed. To update it, regenerate it. That creates a new version, and every earlier version is kept. See Create a new version of a package.

Who can do what

Next steps

Create an audit package template

A template decides which sections every package built from it includes, and in what order. Templates are shared by every project in your organization.

Before you start

• You need permission to manage audit package templates. The Compliance Program Manager and Org Administrator roles include it.
• Go to Organization settings > Compliance4DevOps > Audit Packages.

Create a template

1. Select New template.
2. Choose a preset to start from, or Blank. Presets are starting points: you can change every section afterward.
   • Statement of Applicability
   • Assessment Report
   • Findings Register
   • Evidence Index
   • Combined Applicability & Assessment
   • Gap Report
   • Remediation Plan
3. Enter the template's Name, for example “Annual Assessment Report”.
4. Enter a Type Code, for example “SOA”. It goes into document numbers. See Set your branding, document numbering and markings.
5. Continue to the builder.

Build the outline

The builder has three panes:

• The cover page and table of contents are always included. The cover always prints first.
• Document control prints straight after the cover, if you include it.
• Each section has options, such as which columns a table shows, how it's grouped, or whether it starts on a new page. Open a section's options in the outline.
• Add at least one section besides the cover and table of contents.

Sections marked Coming soon can't be added yet.

Save the template

Select Save template. A new template is Active and appears in every project's Generate package dialog.

Check the advisories

Document properties lists advisories about the layout, such as a section that will print nothing with its current options. Advisories never block saving or generating.

After a template is used

• A template locks once it has generated a package, so existing packages can always be regenerated the same way.
• To change a locked template, duplicate it and edit the copy.
• To stop a template being used for new packages, archive it. Archived templates can still regenerate packages already made from them.

Next steps

Set your branding, document numbering and markings

Package settings apply to every package your organization generates: your name and logo, how documents are numbered, the confidentiality markings, and standard wording.

Before you start

• You need permission to manage package settings. The Compliance Program Manager and Org Administrator roles include it.
• Go to Organization settings > Compliance4DevOps > Audit Packages, and open Package settings.

A live preview shows the running header and footer as you change settings.

Organization

Page setup

Markings

Markings are the confidentiality levels a package can carry, such as None, Internal and Confidential.

• Add, remove or rename markings, and choose the Default.
• The marking prints on the cover, in each page's header in red, and in the footer. “None” prints nothing in the header.
• The person generating a package can choose a different marking for that document.

Numbering

Every package gets a document number, built from a format you set:

For example, {ORG}-{TYPE}-{SEQ} produces a number like NMD-SOA-029.

Sequence scope sets whether numbers run Per organization or Per project. A package keeps its number through every new version.

Approval

Approval roles are the sign-off lines in Document control and the Approval signature block. For example: Prepared by, Reviewed by and Approved by.

• Rename a role by editing its label.
• Mark a role Required to make the person generating the package fill in a name for it.

Standard statements

• Determination values: The overall results the person generating a package can choose from, such as Compliant, Compliant with observations, Partially compliant and Non-compliant. Packages that show a determination can't be generated without at least one value.
• Attestation statement default text: The statement pre-filled in the Attestation statement section. It can be edited for a single package.

Date and time formats

Dates, times and the time zone used in packages are set on the General tab of Organization settings. They also apply to how dates show across the app.

When changes take effect

Next steps

Generate, preview and download a package

Build a package from an event's data, check it, then download the PDF.

Before you start

• You need permission to generate packages. The Project Compliance Manager role includes it.
• Your organization needs at least one active template with sections, and a legal name set in package settings.
• Finalize the event first if you can. You can generate at any time, but a package generated before the event is finalized is marked DRAFT in the package list.

Generate a package

1. Open the event and go to its Audit packages tab.
2. Select Generate package.
3. Template: Choose the template to use.
4. Content:
   • Standard: Choose which standard the package covers, if the event has more than one.
   • Clause scope: All clauses, Selected sections or Selected clauses. Scope only limits the clause-driven sections. It never changes which sections appear.
   • Confidentiality marking and Page size: These start with your organization's defaults. A change here applies to this document only.
5. Document details: Fill in what the template's sections need, for example:
   • Version name: A name for this version, such as “Q3 surveillance”. It defaults to V1.
   • Approvers: The name and position for each approval role. Names are printed, not signatures.
   • Determination and Supporting statement: The overall result and your explanation.
   • Assertion text and Signatories: For the Attestation statement.
   • Content for each custom narrative block.
6. Select Preview to check the document, or Generate.

Preview first

A preview shows the package with a DRAFT watermark on every page. It isn't saved and uses none of your package allowance. A preview doesn't read Azure DevOps, so Evidence record details shows placeholders until you generate.

While it generates

Generation runs in the background, and you can leave the page. The package list shows its progress:

Download the PDF

• In the package list, select Download PDF.
• Or select the package name to open its details, then select Download PDF.

The details panel also shows the document number, the sections included, the determination and the approvers.

Things to know

• One package per template and standard. Generating the same template for the same standard again creates a new version of the existing package. Using a different standard creates a separate package with its own document number.
• Each generation counts toward your plan's package allowance, including regenerations and retries.
• Deleting a package removes it and all its versions from the list.

Next steps

Create a new version of a package

Update a package without losing the earlier one. Every regeneration creates a new version with the same document number, and every earlier version is kept.

When to create a new version

• The event has changed: for example, findings were closed or verdicts were updated.
• The event was finalized after the package was generated. The package list marks the earlier version DRAFT, with the note “Generated before the event was finalized. Regenerate after finalizing for a clean copy.”
• Details changed, such as approvers or the determination.

Regenerate a package

1. Open the event and go to its Audit packages tab.
2. Open the package's Package actions menu and select Regenerate.
3. The Generate package dialog opens, filled in with the last version's details. Change what you need.
4. Give the new version a Version name, such as “Final after closure”.
5. Select Generate.

The new version is numbered v2, v3 and so on, and keeps the package's document number. It's built from the event's data as it is now.

See earlier versions

Open the package's Versions to see its version history. From there you can:

• Download any earlier version's PDF.
• Rename a version.

If a generation fails

A failed version shows Failed. Select Retry to try the same version again. A failed version isn't kept as an issued document.

Things to know

• Earlier versions never change. Each one stays exactly as it was issued.
• A regeneration uses the template as it was when the package was first generated. Templates lock once used, so to use different sections, duplicate the template and generate a new package.
• An archived template can still regenerate packages already made from it.
• Each regeneration counts toward your plan's package allowance.

Start a free trial and assign licenses

Try Compliance4DevOps free, then give licenses to the people on your team who need them.

Start a free trial

1. In Azure DevOps, go to Organization settings and select Compliance4DevOps.
2. Select Start free trial. No credit card is needed.

You get a license straight away, and the app opens. A Free trial tag at the top shows how many days are left. Select it to see your usage or compare plans.

What a license covers

Each person who uses Compliance4DevOps needs a license, also called a seat. Your plan sets:

• How many people can hold a license.
• How many compliance events and audit packages you can create. Usage counts reset on a regular cycle, and the usage panel shows when.

If your organization links several Azure DevOps organizations to one plan, they share these limits.

Assign a license

Only an organization admin can assign licenses. That means a Project Collection Administrator, or someone with the Org Administrator role.

1. Go to Organization settings > Compliance4DevOps > Access Permissions.
2. On the Members tab, find the person. Their License column shows Licensed or No license.
3. Open their menu and select Activate license.

You can also assign licenses from a project's Members tab. Adding a new organization member also uses a license.

Remove a license

Open the person's menu and select Deactivate license. The seat is free for someone else.

Someone can't open the app

People without a license see “You don't have a Compliance4DevOps license”. A Project Collection Administrator can select Activate my license to take a seat themselves. Everyone else needs to ask an admin.

When you reach a limit

If you've used all your seats, compliance events or audit packages, the app tells you which limit you've reached. Free up a seat, or select Compare plans to see larger plans.

When the trial ends

When the trial ends, the app shows “Your free trial has ended”. Choose a plan to keep using Compliance4DevOps. Your data is kept.

Every plan includes all features. Select Contact us to choose a plan, or Schedule a demo.

Next steps