How do I create custom controls in OptiTech?

Quick answer

Go to Controls > New control, give it a name and description, map it to one or more framework requirements, assign an owner, and choose how it's verified: an automated check from an integration, a recurring manual task with evidence upload, or both. Custom controls behave exactly like built-in ones: they feed compliance scores, dashboards, and the evidence log.

When you need a custom control

The built-in control library covers the standard ground (access, backups, incident handling, suppliers), but real organizations have specifics:

A sector requirement your framework mapping doesn't capture, like a customer-contract security clause or a KLASSA-derived measure in public-sector work.
An internal policy you want tracked with the same rigor, like "production access requires a change ticket."
A compensating control, where you meet a requirement differently than the standard suggests and want that documented and verified.

Building a good control

Name it as a verifiable statement. "All production access is logged and reviewed monthly" beats "logging control."
Map it to requirements. Link every framework requirement the control satisfies; the cross-mapping is what makes one control count everywhere.
Choose the verification.
- Automated: bind it to an integration check, for example a query against Entra ID or AWS config state.
- Manual with cadence: a recurring task ("upload the quarterly access review") with a deadline and reminder.
Assign an owner. Unowned controls rot; see per-team ownership.

Testing before rollout

New controls start in draft. Run them against current state before publishing, so you know whether you're introducing a passing control or declaring an open finding; both are legitimate, but you want to know which. For staging changes to existing controls, see testing control changes before rolling them out. Custom controls can also be created through the API if you manage your control set as code.