Control Catalog

Controlio scans more than 180 security controls across seven categories. The evaluation is app-only, so the customer does not have to run any script. You can find the full list category by category in the Control Reference.

Categories

Identity and access (IAM), device (DEV), application (APP), security (SEC), data (DAT), threat protection (MAL) and governance (GOV).

Automatic and attested

A control is either automatic or attested. Controlio measures automatic controls app-only. Attested controls cannot be measured through an API; they are either a process or document control, or a setting that stays unreadable because a permission was deliberately not taken. The customer marks these.

What can't be verified is not counted

A control that cannot be verified is never marked pass or fail. Nor is an unnecessary attestation added for a setting that cannot be measured. Attestation is only for genuine process or deliberate-permission controls.

Accuracy

Controlio's app-only logic matches the downloadable canonical security scripts exactly. If it produces a different result, we treat that as a bug.