Programs

A program is the container for a compliance effort with a defined goal and timeline: get System and Organization Controls 2 (SOC 2) ready, complete an ISO 27001 certification, run this year's risk assessment. It pulls the controls, evidence, tasks, risks, and people for that effort into one place.

An audit is a deadline with a scope, and both live on the program. Scoping a SOC 2 audit means knowing which controls are in, what evidence covers the audit period, and who is responsible for what; the program holds all three.

Programs also keep concurrent efforts from blurring together. Your SOC 2 Type 2 and your ISO 27001 certification can share underlying work, but each has its own scope, timeline, and audit details.

Create a program walkthrough

Creating a program

The program wizard walks you through setup and offers six starting points:

Starting point	Type	What it sets up
SOC 2	Quickstart	A SOC 2 program with the trust principles you choose
Risk Assessment	Quickstart	A risk register with default scoring and standard risk categories
Framework Based	Quickstart	A program for any standard in the catalog, such as ISO 27001 or the Health Insurance Portability and Accountability Act (HIPAA)
From Existing Program	Custom	A copy of another program's controls, auditor, and owner
Generic Program	Custom	A blank program structure
Advanced Setup	Custom	Every setting configured by hand

If you chose frameworks during onboarding, the matching template is marked Recommended when you create your first program.

Create New ProgramQuickstart

SOC 2RecommendedWe'll set up a SOC 2 program for you in under 2 minutes.

• Select core trust principles
• Choose templates or your own policies
• Invite your team now or later

Risk AssessmentTemplateEasily create a risk register with built-in scoring & reporting.

• Default risk scoring (likelihood x impact)
• Standard risk categories
• Sample controls pre-loaded

Framework BasedTemplateChoose the compliance standard and we'll get you started.

• Select from any existing compliance standard
• Choose templates or bring your own policies
• Invite your team now or later

Custom

From Existing ProgramReuse controls, auditor and owner from a program

Generic ProgramStart with a blank program structure

Advanced SetupManually configure everything from the ground up.

To create one:

1. From any page in the console, click the + button at the top of the side navigation bar
2. Select Create Program from the dropdown menu
3. Choose a template or custom option and follow the wizard prompts for the path you selected
4. Click Create to finalize the program

Framework-based programs come pre-populated with the relevant controls; a SOC 2 program additionally lets you include only specific domains (for example Security and Availability) if you don't want all of the Trust Services Criteria. Controls can be added or removed after creation from the program settings or the standards catalog, and any field you set in the wizard can be changed later from the programs page or program settings. The wizard choice gets you started; it doesn't lock you in.

Program status

A program's status tracks the effort from planning through completion. The one behavior worth knowing in advance: a completed program stays completed as the record of that cycle, and the next cycle (next year's audit period, the annual risk assessment) starts as a new program, which keeps each cycle's scope, evidence period, and audit details distinct.

Tracking program work

The Work tab on a program lists everything still to be done for it in one place. It covers every kind of object linked to the program, so you can see what is outstanding without opening each section of the console.

SOC 2 - 2026

OverviewWork

7Total

2Tasks

2Controls

2Evidence

1Internal Policies

0Procedures

Search workTableBoardColumnsFilter 1

ItemTypeWork statusAttentionOwnerDue dateRelated to

Review vendor SOC 2 reportsTaskOpenOverdueAJAvery JordanMay 22, 2026CC9.2

CC6.1ControlOpenNot ImplementedRCRiley Chen—SOC 2

Quarterly access review exportEvidenceOpenNeeds RenewalRCRiley Chen—CC6.2

Set up secondary environmentTaskIn Progress—AJAvery JordanJun 30, 2026CC7.2

CC8.1ControlIn ProgressChanges RequestedJLJordan Lee—SOC 2

Access Control PolicyInternal PolicyIn ProgressDraftJLJordan Lee—CC6.1

Penetration test reportEvidenceIn ReviewSubmittedAJAvery Jordan—CC4.1

Work status

Each of those objects has its own status values, so the Work tab maps them onto four shared stages:

Work status	Tasks	Controls	Evidence	Policies and procedures
Open	Open	Not Implemented	Requested, Needs Renewal	None
In Progress	In Progress	Preparing, Draft, Changes Requested	Draft, Missing Artifact, Rejected	Draft
In Review	In Review	Needs Approval	Submitted, In Review	Needs Approval, Pending
Completed	Completed, Won't Do	Approved, Not Applicable, Archived	Ready for Auditor, Auditor Approved	Approved, Published, Archived

By default the tab shows only outstanding work, which is anything not yet completed. When an item's own status says more than its stage, such as a control with changes requested or evidence that needs renewal, the Attention column shows it. Tasks past their due date also get an Overdue badge there.

What each item shows

Column	What it shows
Owner	The assignee for a task, the owner for a control, the approver for a policy or procedure, and the owners of the supported controls for evidence
Due date	The due date for tasks. Other objects do not carry one.
Related to	The control or framework the item belongs to

Items are sorted by stage, with overdue tasks first and then the oldest items.

Finding your work

The summary cards at the top count outstanding items by type. Click a card to show only that type, or click Total to show everything again. Switch between the Table and Board views to see the same items as a list or grouped into a column per stage.

Use the My Work quick filter to see items you own, or Overdue tasks to see tasks past their due date. The full filters cover status, object type, owner, and overdue tasks, and the search box matches names, titles, and ref codes.

SOC 2 - 2026

OverviewWork

7Total

2Tasks

2Controls

2Evidence

1Internal Policies

0Procedures

Search workTableBoardFilter 1

Open3

Review vendor SOC 2 reportsTaskOverdueAJAvery Jordan

CC6.1ControlRCRiley Chen

Quarterly access review exportEvidenceRCRiley Chen

In Progress3

Set up secondary environmentTaskAJAvery Jordan

CC8.1ControlJLJordan Lee

Access Control PolicyInternal PolicyJLJordan Lee

In Review1

Penetration test reportEvidenceAJAvery Jordan

info

The Work tab loads up to 100 items per object type. When more than that match your filters, a message tells you how many are hidden. Narrow the filters to see the rest.

Working with auditors

Programs carry your audit details: the audit firm, the auditor, and the audit period. You can grant your auditor access directly during program setup, so evidence review happens in Openlane instead of through a third-party portal upload.

How programs connect

A program scopes controls from your enabled frameworks, coordinates evidence collection against the audit period, and tracks the work through tasks and risks. For the full field list, see the GraphQL object reference. For framework-specific guidance, see the Standards section.

FAQ

Do I need one program per framework?

Usually, yes; each framework has its own scope, controls, and audit timeline. Work that overlaps (a control mapped to both SOC 2 and ISO 27001) doesn't get duplicated; both programs reference the same underlying controls and evidence.

Can I change what's in a program after creating it?

Yes. Controls can be added or removed at any time from the program settings or the standards catalog, and any field you set in the wizard can be changed later.

What's the difference between a program and a standard?

A standard is the framework itself: the catalog of requirements. A program is your organization's initiative against it: the scoped controls, the timeline, the team, and the audit.