Generated Documents

Generated Documents turns the control data you already maintain — scope, implementation status, owners, maturity, evidence, risks — into the documents an auditor asks for. A Statement of Applicability, a Risk Treatment Plan, domain policies and procedures.

The point is not the first draft. Any tool can produce a first draft. The point is the second one: you edit a generated document, your control data moves on, you regenerate, and your edits are still there.

Open it from Documents → Generated Documents in the sidebar.

The feature is off until an administrator turns it on

Generating documents from SCF content has a licensing dimension, so it ships disabled and must be enabled per organisation by an administrator who acknowledges the SCF licence position. If the page tells you the feature is unavailable, that is the switch — see the administrator guide.

What you can generate

Documents come in two families, and the difference matters for more than technical reasons.

Data-driven documents

These are rendered directly from your control data. No language model is involved, the output is deterministic, and the same inputs always produce the same document.

Document	What it contains
Statement of Applicability	In-scope controls with implementation status, owner, maturity level and justification, grouped by domain
Control Status Report	Implementation progress across every scoped control, with per-domain completion rates and an exceptions list
Risk Treatment Plan	Identified risks with inherent and residual scores, treatment decisions, owners and due dates
Evidence Schedule	Evidence artefacts your scoped controls require, with collection method, owner, frequency and current tracking state
Maturity Assessment Report	Capability maturity distribution by domain, the gap to target, and the controls holding each domain back

AI-augmented documents

These ask a language model to write prose from your control descriptions and assessment objectives. They are produced one per SCF domain, so you choose which domains you want.

Document	What it contains
Domain Policy	Formal security policy for one domain, written from the domain principle, control descriptions and assessment objectives
Domain Procedure	Step-by-step operational procedure implementing that policy, with responsibilities, triggers and records
Domain Standard	Technical standard specifying the mandatory configuration and control parameters for one domain

These need a second switch

AI-augmented documents rework SCF content into new prose, which makes them derivative work under the SCF licence. They are gated separately from the data-driven ones. An administrator can enable the feature for Statements of Applicability alone and leave the AI-augmented generators off — see the licence position.

Generating

1. Open Documents → Generated Documents.
2. Pick the documents you want. Domain-scoped generators expand into a domain picker showing how many scoped controls each domain has — a domain with no scoped controls has nothing to write about, and generating for it will tell you so.
3. Select Generate.

Generation runs in the background with a progress bar. One run at a time per organisation: if a colleague starts a run while yours is going, theirs waits rather than racing yours.

Why a document sometimes says “skipped”

Before generating, the platform fingerprints the inputs — the control data in scope, the template, the prompt, and your catalogue version. If nothing has changed since the last run, the document is left alone and reported as skipped.

That is the intended behaviour, not a failure. It means:

• regenerating everything weekly costs nothing when nothing has moved;
• an AI-augmented document is not rewritten (and not charged for) just because you pressed the button;
• a document that does regenerate did so because something real changed, and the run tells you what — “4 controls changed”, “catalog 2025.2 to 2025.3”, “template updated”.

If you want to force a rewrite anyway — you have changed a prompt, or you simply want a fresh take — tick Force regeneration before generating.

Editing

Open any document to edit it section by section. The outline on the left lists every section with its current status; the editor on the right holds the Markdown.

Edits are saved per section. You are always editing the merged document — the thing your organisation actually publishes.

Editing an approved document sends it back for review

If you edit a document that has already been approved, it returns to In review automatically. An approved document that has changed since approval has not really been approved, and the lifecycle says so rather than letting the label drift.

What happens to your edits when you regenerate

This is the part worth understanding properly, because it is the reason the feature exists.

The platform keeps every document as three layers:

Layer	What it is
Generated	The most recent machine output. Never edited, only replaced.
Human	Your edits, held per section, independent of the generated layer.
Merged	The operative document — what you read, export and publish.

When you regenerate, each section is compared across both layers and given a status:

Status	What happened	What you get
Unchanged	Neither layer moved	Nothing to do
Updated	The generated text changed; you had not edited this section	The new text
Preserved	You edited it; the generated text did not change	Your text, untouched
Conflict	You edited it and the generated text changed	Your text. The machine’s alternative is kept in the version history for you to compare against
New	The generator produced a section that did not exist before	The new section, flagged so you notice it
Retiring	Your data no longer supports a section you have	The section stays, flagged. Nothing is deleted for you

Two of those deserve emphasis.

On a conflict, your text wins. The generated alternative is not lost — it sits in the document’s history and the conflict is flagged in the outline so you can compare and decide — but the operative document never silently reverts to machine output over something a person wrote.

Nothing is ever deleted. If you de-scope a set of controls and a section no longer has data behind it, that section is marked Retiring, not removed. Deciding whether documentation should disappear is your call, not a side effect of a scoping change.

Review and approval

Documents move through four states:

Draft  →  In review  →  Approved  →  Published

Transition	Who can do it
Submit for review	Editors and above
Approve	Administrators
Publish	Administrators
Send back to draft	Editors and above

Every transition is recorded — who, when, from what to what, and any reason you gave — and that record cannot be edited or removed. When an auditor asks who approved a policy and when, the document answers.

Exporting

Export any document as Markdown, HTML, or PDF from the document view.

Every exported document carries an attribution footer for the Secure Controls Framework. That is a licence requirement, it applies to all documents regardless of type, and it is not optional — but the wording differs depending on whether the document is derivative.

Things worth knowing

Generated documents are not evidence of themselves. A policy this feature produced is marked as platform-generated. It is a real document and you can treat it as one, but be deliberate about using a document the platform wrote as the evidence that a control the platform tracks is implemented.

Regeneration is safe to run often. Fingerprinting means an unchanged document is not rewritten, so a scheduled weekly run costs nothing and tells you exactly which documents your control data has outgrown.

A catalogue upgrade marks documents stale, it does not rewrite them. When your organisation moves to a new SCF catalogue version, existing documents are flagged as generated against the old one. Nothing regenerates until you ask it to. See Catalog Updates.

Related

• Framework Gap Analysis — where your scope falls short before you document it
• Document Generation (administrators) — enabling the feature and the licence position