Reference — Declared Available now
Supported frameworks
@ComplianceControl doesn’t hardcode a framework.
framework is a free-form string of the shape
<STANDARD>:<criterion> — the same annotation
covers SOC 2, GDPR, SOX, or an internal control catalog, whichever your
control actually satisfies.
| Framework | Example value | Notes |
|---|---|---|
| GDPR | GDPR:Art.30 |
Article number. See the consent-capture example. |
| SOC 2 | SOC2:CC6.1 |
AICPA Trust Services Criteria code. See the encryption-at-rest example. |
| SOX | SOX:<your-itgc-id> |
Codevidence doesn’t bundle a canonical SOX control-ID scheme. Use the ITGC identifiers your auditor already works from. |
| Custom / internal | <YOUR_CATALOG>:<id> |
For teams tracking controls in an internal catalog rather than an external standard. |
We deliberately don’t publish a specific SOX control-code example here — SOX ITGC identifiers vary by organization and auditor, and we'd rather point you at your own control matrix than invent one that looks authoritative but isn't.
Choosing a framework value
The plugin doesn't validate framework against a fixed
list — it's whatever string your organization's control matrix uses,
written straight through to the evidence record.