Bulk-upload your custom compliance frameworks

Custom Compliance Frameworks let your organization track its own set of regulatory controls and best practices alongside SecurityScorecard's built-in frameworks. When you create a custom framework, you can save time by bulk-uploading its controls from a .csv file instead of adding them one by one, making it ideal for frameworks with many controls.

This guide walks you through formatting the .csv file and uploading it while creating a custom framework.

Formatting your bulk-upload .csv

Let's start with the format the controls file must use:

• The file must use the .csv format (file.csv)
  • The .csv file must use semicolons (;) as the column delimiter.
  • There must be no header row;  the first line is treated as your first control.
  • There must be no empty lines, including at the end of the file.

• Column requirements:
  • Column 1: Required. The key identifier for the control. Only letters, numbers, periods, hyphens, and spaces are allowed, and each key must be unique within the framework. Example: 1.1
  • Column 2: Required. The name of the control. Allowed characters: letters, numbers, spaces, and the symbols . , - / & ( ) ' ? Example: Establish and Maintain Detailed Enterprise Asset Inventory
  • Column 3: Optional. A description for the control. Leave it blank if there is no description. Example: Establish and maintain an accurate, detailed, and up-to-date inventory …

Note: If a control's key or name contains a character outside the sets listed above, or if two controls share the same key, that row will be rejected and the file won't upload.

Here's an example of the correct file format:

Control Key 1;Control Name 1;Description Control 1;
Control Key 2;Control Name 2;Description Control 2;
Control Key 3;Control Name 3;;

Tip: Ending each row with a trailing semicolon, so every row has three semicolons, is the safest way to keep the columns aligned, even when the optional description is blank (as in the third row above). Make sure there are no empty lines at the end of the file.

With real values, it might look like this:

1.1;Establish and Maintain Detailed Enterprise Asset Inventory;Establish and maintain an accurate, detailed, and up-to-date inventory;
1.2;Address Unauthorized Assets;Ensure that a process exists to address unauthorized assets;
1.3;Utilize an Active Discovery Tool;;

Create the framework and upload your .csv

The controls file is uploaded while you create a custom compliance framework:

1. Go to My Organization and select My Scorecard.
2. Select Compliance on the left side of the screen, then select Create Custom.
3. In the Create Compliance Framework panel, complete the required fields: Name, Help URL, Short Description, and Long Description.
4. Under Controls (Optional), either click the Upload button to browse for your .csv file, or drag and drop the file into the dotted rectangle area.
5. After the file is read, you'll see the file name and the number of controls that were validated for upload. If there's a formatting problem, an error message will describe what needs to be fixed.
6. Click Create to finish creating the framework with its controls.