What are parent and child controls?
Not every control in the Risk Ledger framework is shown to every supplier. Some controls only appear once an earlier control has been answered in a particular way. We call the earlier control the parent control and the controls it unlocks the child controls (sometimes called conditional controls).
For example, a supplier is only asked whether they are Cyber Essentials Plus certified (B2) if they have already said they are Cyber Essentials certified (B1). If they answer No to B1, B2 never appears.
This works in both directions:
For clients: if a child control is missing from a supplier's profile, the supplier has most likely not answered the parent control in the way that unlocks it.
For suppliers: if you change your answer to a parent control, the child controls beneath it will appear or disappear.
This article lists every parent control, every child control, and the four scoping questions, based on version 63 of the Risk Ledger framework. It covers the Core Framework and all Add-On domains.
Scoping questions
Parent controls decide whether individual controls appear. Scoping questions work one level above that: they decide whether a whole domain appears at all.
Four domains sit behind a scoping question. Each one is a single Yes or No question asked at the top of the domain. Answering Yes opens the domain. Answering No skips the entire domain, and none of its controls are asked.
Domain | Controls in the domain | Scoping question |
E. Software Development | 23 | Does your organisation develop any software or apps? |
F. Network & Cloud Security | 36 | Does your organisation run any of its own servers, networks or cloud systems? |
G. Physical Security | 11 | Does your organisation use any buildings, such as offices, warehouses, or data centres? |
J. Data Protection | 16 | Does your organisation collect, process, or store personal data, other than that of your own employees? |
How to answer the scoping questions
Each scoping question comes with guidance. Read it carefully before answering, because answering No removes a whole section of the profile.
E. Software Development: Does your organisation develop any software or apps?
Answer "Yes" if your organisation designs, develops, or maintains any app, website, or system, both internal or external.
Need help with this scoping question? https://riskledger.com/support/framework/e/0
F. Network & Cloud Security: Does your organisation run any of its own servers, networks or cloud systems?
Answer "Yes" if your organisation runs websites, apps or tools, either on your own self-hosted servers and networks, or in the cloud, such as on AWS, Azure, or GCP. This includes anything you set up or manage yourself, even if it's in the cloud or supported by an outsourced provider.
Need help with this scoping question? https://riskledger.com/support/framework/f/0
G. Physical Security: Does your organisation use any buildings, such as offices, warehouses, or data centres?
Answer "Yes" if you need any physical space to run your organisation or provide your services, even if you don't own the space.
Need help with this scoping question? https://riskledger.com/support/framework/g/0
J. Data Protection: Does your organisation collect, process, or store personal data, other than that of your own employees?
Answer "Yes" if your organisation handles information that would identify specific individuals. This would be names, contact details, historical records, data collected through web cookies etc. This excludes any personal data related to your employees.
Need help with this scoping question? https://riskledger.com/support/framework/j/0
How scoping questions and parent controls work together
In a scoped domain, a child control has two gates to pass. The scoping question must be answered Yes to open the domain, and then the parent control must be answered in the way that unlocks the child.
For example, G3 asks how many days CCTV footage is kept. It only appears if the Physical Security scoping question is answered Yes, and then G2 (whether CCTV is used) is answered Yes. A No at either point and G3 never appears.
Tip: if a control is missing from a profile and it sits in domain E, F, G or J, check the scoping answer first, then the parent control.
Summary
Domain | Scoped? | Parent controls | Child controls |
A. Security Governance | No | 1 | 1 |
B. Security Certifications | No | 2 | 3 |
D. IT Operations | No | 4 | 7 |
E. Software Development | Yes | 3 | 3 |
F. Network & Cloud Security | Yes | 7 | 10 |
G. Physical Security | Yes | 2 | 2 |
H. Business Resilience | No | 4 | 13 |
J. Data Protection | Yes | 1 | 2 |
K. Artificial Intelligence | No | 4 | 16 |
XA. Financial Risk | No | 6 | 13 |
XB. Environmental, Social & Governance | No | 4 | 6 |
XD. NHS Data Security and Information Governance | No | 1 | 1 |
In the tables below, each parent control is shown in bold, followed by the child controls it unlocks. The Shown if column tells you which answer to the parent control makes the child control appear.
Core Framework
A. Security Governance
Control | Shown if | Question |
A13 | Parent | Does your organisation prevent the use of removable media, and is this enforced technically? |
A14 | No to A13 | If the use of removable media is not prohibited and enforced technically, is its use subject to other compensatory controls? |
B. Security Certifications
Control | Shown if | Question |
B1 | Parent | Is your organisation Cyber Essentials certified? |
B2 | Yes to B1 | Is your organisation Cyber Essentials Plus certified? |
B5 | Parent | Does your organisation store, process, transmit or otherwise have the ability to impact the security of cardholder data (CHD) or sensitive authentication data (SAD)? |
B6 | Yes to B5 | Has your organisation performed validation of compliance to the Payment Card Industry Data Security Standard (PCI DSS) v4 or above for your services or environments that impact cardholder data or sensitive authentication data? |
B7 | Yes to B5 | Does your organisation have a defined process for managing and monitoring Third-Party Service Providers (TPSP) that provide services impacting your PCI DSS compliance? |
D. IT Operations
Control | Shown if | Question |
D8 | Parent | Does your organisation regularly audit employee access rights for all IT services (whether internal or third party based)? |
D9 | Yes to D8 | How many access audits does your organisation conduct each year, for regular employee accounts? |
D10 | Yes to D8 | How many access audits does your organisation conduct each year, for privileged employee accounts? |
D12 | Parent | Do all of your organisations systems automatically lock after a short period of inactivity (requiring re-authentication)? |
D13 | Yes to D12 | For how many minutes does a user have to be inactive before the system is locked? |
D24 | Parent | Does your organisation allow staff to access company data or services from employee-owned devices? |
D25 | Yes to D24 | Does your organisation enforce equivalent technical security controls on BYOD endpoint devices before allowing access to company data or services? |
D26 | Yes to D24 | Can your organisation perform a remote wipe of organisation data on all BYOD endpoint devices? |
D32 | Parent | Does your organisation take regular immutable backups of its digital production data in line with current best practise guidelines? |
D33 | Yes to D32 | Does your organisation encrypt the backups using appropriate cryptographic standards to prevent unauthorised access to the backup data? |
D34 | Yes to D32 | Does your organisation regularly test backups to ensure their effectiveness? |
E. Software Development
Control | Shown if | Question |
E12 | Parent | Does your organisation ensure that appropriate logging and monitoring is in place for all apps or systems it develops? |
E13 | Yes to E12 | Is this logging and monitoring used to detect unauthorised changes to applications or system components? |
E14 | Parent | Is your organisation able to demonstrate the composition and provenance of software it develops (including third-party and open-source components)? |
E15 | Yes to E14 | Does your organisation continuously monitor all software components for vulnerabilities? |
E17 | Parent | Does your organisation control and authorise all access to data and services in your software, products or services? |
E18 | Yes to E17 | Are service credentials for your software, products or services rotated regularly, and can they be revoked promptly if compromised? |
F. Network & Cloud Security
Control | Shown if | Question |
F1 | Parent | Are all ingress and egress points for traffic through your network or cloud environment protected by firewalls? |
F2 | Yes to F1 | Were the firewalls implemented using a deny all policy, with rules built around your organisation's requirements? |
F3 | Yes to F1 | Does your organisation review its firewall rules at least annually? |
F4 | Parent | Does your organisation have web application firewalls (WAFs) implemented to protect web applications? |
F5 | Yes to F4 | Were the WAFs implemented with rulesets that have been built or tailored to your organisation's requirements? |
F6 | Yes to F4 | Does your organisation review its WAF rules at least annually? |
F16 | Parent | Does your organisation keep a list of approved network connections (such as site to site VPNs) between your corporate network and third parties? |
F17 | Yes to F16 | Is each of the approved network connections subject to a risk assessment? |
F18 | Yes to F16 | Is each of the approved network connections subject to regular review? |
F19 | Parent | Does your organisation conduct regular automated vulnerability scans of its public facing IT infrastructure and remediate any findings? |
F20 | Yes to F19 | How many external automated vulnerability scans does your organisation conduct each year? |
F21 | Parent | Does your organisation conduct regular automated vulnerability scans of its internal IT infrastructure and remediate any findings? |
F22 | Yes to F21 | How many internal automated vulnerability scans does your organisation conduct each year? |
F29 | Parent | Does your organisation record and store user activity logs for all cloud environments, networks and associated services? |
F30 | Yes to F29 | For how many months does your organisation store its user activity logs? |
F31 | Parent | Does your organisation record and store the logs of root/super user/ administrator actions for all cloud environments, networks and associated services? |
F32 | Yes to F31 | For how many months does your organisation store its root/super-user/administrator logs? |
G. Physical Security
Control | Shown if | Question |
G2 | Parent | Does your organisation use CCTV to monitor entry and exit points of all premises? |
G3 | Yes to G2 | For how many days does your organisation keep CCTV footage? |
G4 | Parent | Does your organisation use an access control system on its premises entry and exit points that includes logging of access? |
G5 | Yes to G4 | For how many months does your organisation keep its physical access control audit logs? |
H. Business Resilience
Control | Shown if | Question |
H1 | Parent | Does your organisation have a documented Incident Response Plan? |
H2 | Yes to H1 | Does your organisation's Incident Response Plan allow for the classification of information security events? |
H3 | Yes to H1 | Does your Incident Response Plan include consideration of legal and regulatory commitments? |
H4 | Yes to H1 | Does your organisation's Incident Response Plan include roles and responsibilities in the event of an incident? |
H5 | Yes to H1 | Does your organisation's Incident Response Plan include alternative communication systems in case your usual systems are disrupted? |
H6 | Yes to H1 | Does your organisation's Incident Response Plan get tested through regular exercises, incorporating lessons from past incidents (including those affecting other organisations) and scenarios informed by threat intelligence and your own risk assessment? |
H11 | Parent | Does your organisation have an approved Business Continuity Plan to ensure the continuity of service in a disaster? |
H12 | Yes to H11 | Is your organisation's Business Continuity Plan based on a current risk assessment of your business? |
H13 | Yes to H11 | Does your organisation's Business Continuity Plan address the backup and restoration of your business data and the data you process for your clients? |
H14 | Yes to H11 | Does your organisation's Business Continuity Plan include operation of business activities from an alternative location? |
H15 | Yes to H11 | Does your organisation's plan include the maintenance of security controls in a disaster? |
H17 | Parent | Has your organisation set Recovery Time Objectives (RTO) and / or Recovery Point Objectives (RPO)? |
H18 | Yes to H17 | What is your Recovery Time Objective (RTO)? |
H19 | Yes to H17 | What is your Recovery Point Objective (RPO)? |
H20 | Yes to H17 | Did your organisation's most recent Business Continuity/Disaster Recovery test meet its defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)? |
H21 | Parent | Does your organisation have cyber insurance? |
H22 | Yes to H21 | What is the limit of your organisation's cyber insurance policy (in GBP)? |
J. Data Protection
Control | Shown if | Question |
J14 | Parent | Does your organisation process personal data on behalf of another organisation? |
J15 | Yes to J14 | does your organisation have procedures in place to inform and obtain authorisation (if required) from the data controller before engaging a sub-processor? |
J16 | Yes to J14 | does your organisation ensure that processing activities are only carried out under the documented instructions of the data controller? |
K. Artificial Intelligence
Control | Shown if | Question |
K2 | Parent | Does your organisation use Machine Learning or Generative Artificial Intelligence (AI) models for internal use-cases? |
K3 | Yes to K2 | Has your organisation conducted a risk assessment of each internal use of AI models? |
K4 | Yes to K2 | Do you have processes in place to ensure your service user evaluates the AI model responses before use? |
K5 | Parent | Does your organisation use automated decision-making technologies (e.g. Machine Learning models, AI agents) for internal use-cases that can take actions or make decisions without human review? |
K6 | Yes to K5 | Where automated decision-making technologies are used, are technical and/or procedural guardrails implemented to prevent actions that could adversely impact critical systems or services? |
K7 | Yes to K5 | Where automated decision-making technologies are used, can system or service configuration decisions be reproduced through testing with identical inputs and do you retain sufficient records to identify any variance in decisions? |
K8 | Parent | Does your organisation embed Machine Learning or Generative AI (AI) capabilities within any service(s) you provide to clients? |
K9 | Yes to K8 | Has your organisation conducted a regulatory compliance and security risk assessment of how your AI or AI-supported service processes and responds to client data and information? |
K10 | Yes to K8 | Do your AI or AI-supported service(s) encourage service users to evaluate the AI model's responses before use? |
K11 | Yes to K8 | Is client data processed by the AI model discarded and erased from memory when processing of that data has completed? |
K12 | Yes to K8 | Is sensitive data (including personal or confidential data) removed, masked or otherwise prevented from being input into AI models for all services you provide? |
K13 | Yes to K8 | Is client data and information (e.g. prompts) used to train AI models? |
K14 | Yes to K8 | Is client data, and any AI model trained or fine-tuned using it, kept segregated so that it is not accessible to your other clients or to your AI model providers beyond what is required to deliver that client's own service? |
K15 | Yes to K8 | Does your organisation have a formal AI model change management process that gives consideration to information security and regulatory requirements and includes notification to relevant clients? |
K16 | Yes to K8 | Does your organisation have processes in place to identify, triage and remediate the effects of AI model updates? |
K17 | Parent | Is client data otherwise exposed to Machine Learning or Generative AI models outside of the direct AI-enabled service(s) your client has purchased (for example, through internal tools used by your staff, sub-processors, or other products)? |
K18 | Yes to K17 | Is client data exposed to AI outside your direct service discarded and erased once processing is complete? |
K19 | Yes to K17 | Is sensitive data (including personal or confidential data) removed, masked, or otherwise prevented from being input into these AI models? |
K20 | Yes to K17 | Is client data exposed to AI outside your direct service used to train AI models? |
K21 | Yes to K17 | Is client data exposed to AI outside your direct service, and any model trained or fine-tuned using it, kept segregated so that it is not accessible to your other clients or reused by the AI provider or sub-processor beyond what's needed for that specific use? |
Add-On Domains
XA. Financial Risk
Control | Shown if | Question |
XA5 | Parent | Does your organisation have a documented set of policies and procedures for managing compliance with all applicable anti-bribery and corruption (AB&C) legislation or regulations in the jurisdictions in which you operate? |
XA6 | Yes to XA5 | Does your organisation have a policy to manage conflicts of interest relevant to anti-bribery and corruption? |
XA7 | Yes to XA5 | Does your organisation provide employees with regular anti-bribery and corruption compliance training, including at onboarding? |
XA8 | Yes to XA5 | Does your organisation conduct assurance against its third party suppliers, agents, and sub-contractors to ensure that they have a required level of anti-bribery policies and procedures in place? |
XA9 | Parent | Does your organisation have a documented set of policies and procedures to ensure compliance with financial and trade sanctions? |
XA10 | Yes to XA9 | Does your organisation have a compliance officer or equivalent role dedicated to financial crime, including economic and trade sanction compliance? |
XA11 | Yes to XA9 | Does your organisation conduct ongoing due diligence to ensure your company is not dealing with a sanctioned company or individual? |
XA12 | Yes to XA9 | Does your organisation have pre-transaction screening processes that makes use of all applicable economic and trade sanctions lists? |
XA13 | Yes to XA9 | Does your organisation provide employees with regular sanctions training, including at onboarding? |
XA14 | Parent | Does your organisation have an established, consistent, and documented framework in place covering the detection, prevention, response to and investigation of suspicious or fraudulent activity? |
XA15 | Yes to XA14 | Does your organisation have a documented fraud response plan? |
XA16 | Yes to XA14 | Is financial crime considered at senior management level within your organisation? |
XA17 | Yes to XA14 | Does your organisation provide employees with regular fraud prevention training and/or awareness sessions, including at onboarding? |
XA18 | Parent | Does your organisation have public liability insurance? |
XA19 | Yes to XA18 | What is the limit of your organisation's public liability insurance policy (in GBP)? |
XA20 | Parent | Does your organisation have professional indemnity insurance? |
XA21 | Yes to XA20 | What is the limit of your organisation's professional indemnity insurance policy (in GBP)? |
XA22 | Parent | Does your organisation have Employers' Liability insurance? |
XA23 | Yes to XA22 | What is the limit of your organisation's employers' liability insurance policy (in GBP)? |
XB. Environmental, Social & Governance
Control | Shown if | Question |
XB6 | Parent | Does your organisation measure its scope 1, scope 2, or scope 3 emissions as per Greenhouse Gas (GHG) Protocol standards? |
XB7 | Yes to XB6 | What are your scope 1 emissions (tonnes of CO2 equivalent per year)? |
XB8 | Yes to XB6 | What are your scope 2 emissions (tonnes of CO2 equivalent per year)? |
XB9 | Yes to XB6 | What are your scope 3 emissions (tonnes of CO2 equivalent per year)? |
XB10 | Parent | Is your organisation working towards a net zero carbon emissions target? |
XB11 | Yes to XB10 | When do you expect to achieve net zero carbon emissions? |
XB12 | Parent | Does your organisation have a documented Health & Safety Policy? |
XB13 | Yes to XB12 | Does your organisation have a senior manager or board member who is responsible for your Health & Safety Programme? |
XB21 | Parent | Does your organisation provide a confidential method (also known as a whistleblowing procedure) for employees and contract staff to freely report any perceived issues that might impact your clients or their customers? |
XB22 | Yes to XB21 | Does your organisation clearly inform employees and contract staff how to access and utilise the whistleblowing procedure to confidentially report any issues? |
XD. NHS Data Security and Information Governance
Control | Shown if | Question |
XD1 | Parent | Have you completed an NHS Data Security and Protection Toolkit (DSPT) self-assessment? |
XD2 | Yes to XD1 | What is your current DSPT standard? |
💡 If there is anything we haven't covered, please feel free to contact us at support@riskledger.com or alternatively, select the Chat icon in the bottom right corner.