# Compliance program

A Probo organization is the boundary for a company’s compliance records and memberships. Inside it, a compliance program connects external requirements to the work and proof that demonstrate how those requirements are met.

## Core model

1. A **framework** groups requirements from a standard or a custom program.
2. A **control** describes an outcome the organization is expected to achieve.
3. A **measure** describes what the organization actually operates to satisfy one or more controls.
4. A **task** assigns a concrete piece of work, optionally with a due date.
5. **Evidence** is a file or URL supporting the operation of a measure.

Controls and measures are many-to-many. A reusable measure such as an access review can support controls in several frameworks, which avoids duplicating the same implementation work.

## Applicability

A Statement of Applicability records which controls apply to an organization and why. It is versioned separately from day-to-day measure work so teams can review and publish a deliberate scope.

## Program records

Frameworks, controls, measures, tasks, evidence, risks, documents, audits, and obligations can be linked rather than copied. These relationships provide traceability from a requirement to its implementation, supporting material, risks, and audit results.

Publishing a list or statement creates a stable representation for review. Draft records remain editable until the responsible team is ready to publish them.

## Ownership and access

Organization membership determines access to the program. Assign work to named users and use the [audit log](/docs/product/audit-log) to investigate important changes. See [Roles and permissions](/docs/product/roles-and-permissions). SSO and SCIM manage access to Probo itself; [access reviews](/docs/product/access-review/overview) review access imported from Probo and connected systems.

## Automation

Frameworks, controls, measures, tasks, evidence, and statements of applicability are available through the console and developer interfaces.

- [CLI framework](/docs/developers/cli/commands/framework) — Import and manage frameworks from the command line
- [CLI measure](/docs/developers/cli/commands/measure) — Manage measures that implement controls
- [CLI SoA](/docs/developers/cli/commands/soa) — Work with statements of applicability
- [MCP frameworks and controls](/docs/developers/api/mcp/tools/catalog/frameworks-and-controls) — Operate frameworks and controls from supported AI tools
- [MCP measures, tasks, and evidence](/docs/developers/api/mcp/tools/catalog/measures-tasks-and-evidence) — Create and update implementation work through MCP
- [n8n Framework](/docs/developers/api/n8n/resources/framework) — Automate framework operations in n8n
- [n8n Measure](/docs/developers/api/n8n/resources/measure) — Automate measure operations in n8n