Document Management Overview

Compliance documents are any files that serve as evidence for security controls, including:

Technical Documentation:

Operational Records:

Security Assessments:

Contractual Documents:

Certificates and Attestations:

Organizational Documentation:

Proper document management provides:

Audit Efficiency: Organized evidence makes audits faster and smoother

Evidence Completeness: Centralized storage prevents lost or missing evidence Version Control: Historical records show continuous compliance

Access Control: Sensitive documents remain secure but accessible when needed Compliance Mapping: Clear connections between documents and controls

Time Savings: Quick retrieval beats searching email or shared drives

Understanding the distinction:

Policies: Formal, approved statements of how you approach security topics Documents: Artifacts that support or demonstrate control implementation

Evidence: Broader category including both documents and automated data

Example for Access Control:

All three work together to prove compliance.

Navigate to Compliance > Documents to view your document library.

The documents page displays:

DSALTA organizes documents into categories:

Architecture & Design:

Reports & Assessments:

Procedures & Runbooks:

Contracts & Agreements:

Training & Awareness:

Compliance & Legal:

Operational Logs:

Proper categorization helps with filtering, searching, and audit preparation.

DSALTA serves as your compliance document repository, but consider:

Compliance-specific documents:

Security-relevant records:

Operational documents: Link to documents in existing systems rather than duplicating:

DSALTA integrations automatically reference these when appropriate.

Each document in DSALTA includes metadata:

Basic Information:

Compliance Mapping:

Classification:

Review Information:

Rich metadata makes documents discoverable and manageable.

Control who can view sensitive documents:

Public (within organization): All team members can view

Restricted: Only assigned roles or individuals

Auditor Access: External auditors during engagements

Admin Only: Highly sensitive documents

Balance security with accessibility—auditors need access during certification processes.

Good naming conventions include:

Examples:

Avoid:

For documents that evolve:

Write brief descriptions explaining:

Periodically:

Documents follow a lifecycle:

Creation/Upload: Document is added to DSALTA

Review: Periodic reviews ensure currency

Update: Modified versions replace outdated ones

Archive: Historical versions are preserved

Retention: Documents kept per retention policy

Disposal: Secure deletion when no longer needed

DSALTA tracks documents through this lifecycle automatically.

Find documents quickly using:

Full-text search: Search document contents and metadata

Filters: By category, control, framework, date range

Tags: Custom tags for cross-cutting themes

Control mapping: Find all documents for a specific control

Framework view: See documents supporting a framework

An effective search prevents recreating evidence you already have.