IMS frameworks, documents and evidence requests
Browse frameworks and the policies, procedures, records, regulatory timelines and evidence requests that support their requirements.
Browse IMS templates to find the documents, timelines, and requests for evidence you need to build compliance. The catalog connects these templates with framework requirements. Open the in-app record to check the available revision and whether it is active or withdrawn.
IMS means integrated management system. Your workspace needs Platform and IMS access. Workspace Readers can inspect the catalog. Creating or changing project content also depends on your role and the required artifact access. See Roles, access, and licenses.
Find the right catalog
| What you need | Where to look |
|---|---|
| Reusable IMS documents, timelines, or evidence requests | Artifact templates |
| Templates grouped by responsibility | Organizational domains |
| The requirements for a management system | Open Integrated Management System (IMS), select a system, and review its framework records. |
| Questions for a project assessment | Assessment questionnaires |
| A starting source for a contract | Contract starting documents |
Find documents and evidence requests
- Open Artifact templates and enter a title or topic in Search artifact templates.
- Narrow by Organizational domain, Catalog domain template, or Artifact family.
- Check Lifecycle. Active templates can be used for new content when your access permits it; withdrawn records remain readable to explain existing references.
- Open a title and review its summary, sections, checklist, suggested document defaults, Controls, Source references, and Expected by requirements. Read template controls and sources to interpret their links and obligation labels.
- To use the template, open the relevant management-system requirement and choose an eligible destination project. Follow Create IMS documents and evidence folders for the preview, reuse, and creation steps.
The catalog reader shows what a template contains. It does not create project content or apply suggested values when you open it. Review suggested classification, review frequency, retention, handling, and distribution against your organization's needs.
What each catalog entry creates
| Kind | Result and intended use |
|---|---|
| Policy | An organizational document stating principles, responsibilities, or direction. |
| Standard | An organizational document setting requirements or control rules. |
| Procedure | An organizational document describing how work is carried out. |
| Guideline | An organizational document giving practical guidance. |
| Plan | An organizational document describing planned work and responsibilities. |
| Register | An organizational document for recording decisions, activities, or results. |
| Evidence folder | A project folder for supporting material you supply. Review its evidence request and checklist, then add the relevant records. |
| Timeline | A project artifact containing dated events or milestones. Review dates and relevance before using it to plan work. |
Register in this table means an organizational document, including when its title refers to risks, people, or assets. Use Track risks for individual risk records. An evidence folder organizes supporting material; reviewers still need to check whether that material supports the requirement.
The IMS catalog also supports assessment and contract families when records of those kinds are available. The built-in titles in this reference cover organizational documents, evidence folders, and timelines. The separate assessment and contract libraries have their own selection flows.
Find content by area of work
A domain is an area of work, such as security or finance. It suggests who maintains the work and how you can organize its content. Choose the destination project separately. One topic can contribute templates to several domains.
| Domain | Browse the titles |
|---|---|
| Organization | Define the management system's scope, responsibilities, policies, objectives, reviews, and improvement work. |
| Security | Set security controls, review access and suppliers, prepare for incidents, and collect evidence of how controls operate. |
| IT | Document technology assets, operating procedures, backups, recovery, configuration, and change control. |
| Product | Plan product security, development, conformity work, release decisions, and information supplied with products. |
| Legal | Track obligations, notifications, contract-related controls, and regulatory milestones that need legal review. |
| Privacy | Document how personal information is collected, used, shared, retained, and protected, with records of privacy decisions and requests. |
| People | Set responsibilities for people, competence, awareness, recruitment, working arrangements, and changes in employment. |
| Finance | Record ICT incident costs and losses, fraud risk procedures, and insurance agreements. |
| Environment | Record environmental aspects, operating controls, permits, resource use, emissions, waste, and site arrangements. |
| Quality | Document customer requirements, process controls, production, measurement, nonconformities, and product or service quality. |
| Artificial Intelligence | Document AI governance, system and model lifecycle work, data quality, impact assessment, human oversight, and transparency. |
Browse frameworks
Find frameworks when creating a management system or reviewing an existing system's Frameworks tab. Open the framework record to inspect its requirements, version, and context. Search by the displayed title rather than assuming that similarly named editions are interchangeable.
These are catalog titles. A title's presence does not decide whether its requirements apply to your organization or whether you meet them.
ISO management and security standards
- ISO 14001:2026
- ISO 9001:2026
- ISO 27001:2022
- ISO 27005:2022
- ISO 27017:2026
- ISO 42001:2023
NIST frameworks and publications
- NIST AI 600-1:2024
- NIST AI RMF 1.0
- NIST CSF 2.0
- NIST Privacy Framework 1.0
- NIST SP 800-171A Rev 3
- NIST SP 800-171 Rev 3
- NIST SP 800-207
- NIST SSDF 1.1
- NIST SP 800-53A Rev 5
- NIST SP 800-53 Rev 5
ETSI standards and guidance
- ETSI EN 303 645 V2.1.1
- ETSI EN 303 645 V3.1.3
- ETSI TR 103 621 V2.1.1
- ETSI TR 103 838 V1.1.1
- ETSI TS 102 165-1 V5.3.1
- ETSI TS 103 645 V3.1.1
- ETSI TS 103 701 V2.1.1
- ETSI TS 103 815 V1.1.1
- ETSI TS 103 848 V1.2.1
- ETSI TS 103 927 V1.1.1
- ETSI TS 103 928 V1.3.1
Regulatory and assurance catalogs
- AU Cyber Security Act 2024
- EU Accessibility Act 2019/882
- EU AI Act 2024/1689
- EU CRA 2024/2847
- EU Data Act 2023/2854
- EU DORA 2022/2554
- EU ePrivacy 2002/58/EC
- EU GDPR 2016/679
- EU NIS2 2022/2555
- SOC 2 TSC 2017
- UK GDPR and DPA 2018
- UK PSTI 2022
- CCPA/CPRA 2026
- US COPPA
Create content from a catalog entry
Read the requirement's expected content and obligation before creating a document or evidence folder. Reuse appropriate existing content when the offered workflow permits it, check destination access, and review the preview before confirming. Use Supporting content for links and evidence, and Maintain organizational documents for the resulting document's review and publication workflow.
Screenshots show a demo workspace.
Requirement relationships and mappings
Compare mapped requirements across frameworks and systems, read relationship direction and share supporting document links.
Management system policies and records
Browse policies, audit plans, review records and procedures for managing scope, responsibilities and improvement.