You are here:
IT Compliance Data Kit
The IT Compliance data kit enriches your Data Cloud instance with governance, risk, and compliance data. By ingesting risk, policy, audit, and evidence records, it prepares your compliance data to streamline audit readiness, automate evidence collection, and track remediation progress across your compliance landscape.
The IT Compliance data kit unifies your governance and compliance data so you can analyze risk posture, monitor policy lifecycles, and report on audit and evidence activity from a single, connected data model. For each compliance object, the data kit provisions a Data Lake Object (DLO), an Ingestion API, and a Data Model Object (DMO) to ingest and map your data.
Data Streams
The IT Compliance data kit includes multiple data streams across four compliance domains: Risk, Policy, Audit, and Evidence.
The Risk domain captures your risk register, evaluations, and the controls that mitigate each risk.
| Data Stream | what it does |
|---|---|
| Risk | Core risk register identified risks with categories, severity, ownership, and review dates. Foundation for risk posture analytics. |
| Risk Evaluation | Individual risk assessments with inherent and residual scores and current-state tracking. Enables risk trend analysis. |
| Risk Compliance Control Version | Links risks to mitigating controls. Powers mitigation efficacy calculations. |
| Risk Evaluation Survey Invitation | Survey-based assessment invitations connecting evaluations to methodology. |
The Policy domain captures your policy register, versioned snapshots, and the communications that share policies with your organization.
| Data Stream | what it does |
|---|---|
| Compliance Policy | Master policy register — policies with scope, ownership, and review dates. |
| Compliance Policy Version | Versioned policy snapshots with effective-from and effective-to dates and lifecycle status. |
| Compliance Policy Communication | Policy communication campaigns — when and how policies are shared with the organization. |
| Compliance Policy Comms Recipient | Individual recipients of policy communications. |
| Compliance Policy Comms Response | Recipient acknowledgements and responses to communications. |
The Audit domain captures your audit programs and the policy clauses, regulation clauses, and risks each audit assesses.
| Data Stream | what it does |
|---|---|
| Compliance Audit | Audit programs with execution and observation periods and status. |
| Compliance Audit Policy Clause | Links audits to specific policy clauses under review. |
| Compliance Audit Regulation Clause | Links audits to regulation clauses being assessed. |
| Compliance Audit Risk | Links audits to risks evaluated during the audit. |
The Evidence domain captures evidence collection requests, the artifacts collected, and the links between them.
| Data Stream | what it does |
|---|---|
| Compliance Evidence Request | Evidence collection requests with due dates and status. |
| Compliance Evidence Artifact | Collected evidence artifacts with validity periods. |
| Compliance Evidence Request Artifact | Junction linking evidence requests to collected artifacts. |
- Deploy the IT Compliance Data Kit
Deploy the IT Compliance data kit to ingest your risk, policy, audit, and evidence data into Data Cloud. After you assign a data space and deploy the IT Compliance Bundle, your compliance data is mapped to data model objects that power the Compliance Analytics dashboards.
