Core Concepts
Understand the key building blocks of Dictiva: governance statements, assemblies, domains, the library, optional modules, and how they connect across the compliance lifecycle.
The Building Blocks
Dictiva is built around a small number of powerful concepts. Understanding these will help you get the most out of the platform.
Your Workspace and Its Modules
A Dictiva workspace opens on your policies. The first screen lists your policies and standards, surfaces the most recently updated document, and offers a search box. Everything else is reached from the Policies menu in the top bar and from Settings.
Policies and statements are the permanent core of every workspace. Five further areas are optional modules, off by default, that an administrator turns on in Settings > Modules when the workspace needs them:
| Module | Adds |
|---|---|
| Organizations | Groups and organizational structure |
| Members | People directory and governance responsibilities |
| AI & Agents | Agent guidance, AI assistance, policy commitment attestations, agent audit log, Developer API |
| Processes | Process universe, procedures, risk assessment and business criticality |
| Acknowledgements | Acknowledgement requests and comprehension checks |
A module changes what is visible, not what is allowed: roles, permissions and plan limits still apply inside it, and turning a module off keeps every record. The settings guide explains each switch.
Statements
A governance statement is the atomic unit of compliance in Dictiva. It's a single, clear requirement that prescribes, prohibits, or permits a specific behavior.
Example:
"All employees must complete security awareness training within 30 days of hire and annually thereafter."
Statement Anatomy
Every statement in Dictiva has:
- Title: A short, descriptive name
- Body: The full text of the requirement
- Domain: The governance area it belongs to (e.g., Information Security)
- Maturity Level: Foundational, Intermediate, Advanced, or Exemplary
- Modality: The obligation level (Must, Should, May)
- Version: Tracked automatically with change history
Maturity Levels
Not all organizations need the same level of governance rigor. Dictiva uses four maturity levels:
| Level | Who It's For | Example |
|---|---|---|
| Foundational | Startups, early-stage programs | "Passwords must be at least 8 characters" |
| Intermediate | Growing companies, established programs | "Passwords must be at least 12 characters with complexity requirements" |
| Advanced | Regulated industries, mature programs | "Authentication must use phishing-resistant MFA for all privileged accounts" |
| Exemplary | Leading programs setting the bar for their industry | "Authentication events must be continuously evaluated for risk and step-up challenges issued automatically" |
The onboarding wizard uses a simpler crawl / walk / run scale to pick your first template. That scale describes your program; the four levels above describe individual statements.
Policies & Standards
An assembly is a collection of statements organized into a coherent document. Assemblies are what most organizations call "policies," "standards," or "procedures."
Assembly Types
- Policy: Organizational intent and high-level requirements
- Standard: Specific technical or operational requirements
- Procedure: Step-by-step operational instructions
- Guideline: Recommended practices (non-mandatory)
A standard can be attached to a parent policy. On the workspace home page, standards are listed under the policy they support, so a reader sees the policy first and its supporting standards next to it.
Assembly Lifecycle
- Draft: Create an assembly and add statements to it
- Review: Share with reviewers for feedback
- Publish: Lock the assembly version and make it official
- Acknowledge: Send to stakeholders for acknowledgment (Acknowledgements module)
Published assemblies are versioned. When you update a statement and republish, the assembly gets a new version; previous versions are preserved for audit trail.
Domains
Governance domains organize your content into thematic areas. Dictiva ships with 33 domains:
Data Governance, Data Management, Data Privacy, Data Security, Data Quality, Data Engineering, Data Architecture, Data Products, Metadata Management, Master & Reference Data, Business Intelligence, AI Governance, Information Security, IT Service Management, Cloud Governance, SDLC Governance, Technology Governance, Enterprise Architecture, Change Management, Content Management, Operational Risk, Third-Party Risk, Business Continuity, Regulatory Compliance, Internal Audit, Ethics & Conduct, Board Governance, Governance Foundations, Policy Management, Project Governance, ESG Governance, Financial Governance, and Healthcare Governance.
Your plan decides how many domains you can select; see Understanding Domains.
The Library
The governance library is Dictiva's curated collection of 10,000+ pre-written governance statements. Library statements are:
- Professionally authored across all 33 domains
- Available at multiple maturity levels
- Mapped to 57 regulatory frameworks
- Ready to adopt into your workspace
When you adopt a library statement, it creates a copy in your tenant that you can customize. Your adopted version is independent: you can modify it without affecting the library original.
Regulations
Dictiva maps governance statements to specific requirements in 57 regulatory frameworks including SOC 2, ISO 27001, GDPR, HIPAA, PCI DSS, NIST CSF, and more.
These mappings let you:
- See which regulations a statement satisfies
- Identify compliance gaps in your program
- Generate framework-specific reports
- Respond quickly when regulations change
Glossary
The glossary provides clear, accessible definitions for governance terminology. Both the library glossary (Dictiva-curated) and your tenant glossary (organization-specific) are reachable from the Policies menu under Content, and from search.
Use the glossary to ensure your team has a shared understanding of terms like "data controller," "risk appetite," "control objective," and hundreds of other governance concepts.
Frequently Asked Questions
- What is a governance statement? +
- A governance statement is the atomic unit of compliance in Dictiva. It is a single, clear requirement that prescribes, prohibits, or permits a specific behavior, for example, 'All employees must complete security awareness training within 30 days of hire.' Statements are versioned, assigned a maturity level, and can be mapped to regulatory frameworks.
- What is an assembly? +
- An assembly is a collection of governance statements organized into a coherent document. Assemblies represent what most organizations call policies, standards, or procedures. They follow a lifecycle from draft to review to publication, and each published version is preserved for audit trail.
- What are governance domains? +
- Governance domains are thematic areas that organize your compliance content. Dictiva ships with 33 domains including Data Governance, Information Security, Data Privacy, Operational Risk, and AI Governance. Each domain contains statements, glossary terms, and regulatory mappings relevant to that area.
- What is the governance library? +
- The governance library is Dictiva's curated collection of 10,000+ pre-written governance statements across all 33 domains and 57 regulatory frameworks. When you adopt a library statement, it creates an independent copy in your workspace that you can customize without affecting the original.
- What are modules? +
- Modules are the optional areas of a Dictiva workspace: Organizations, Members, AI & Agents, Processes, and Acknowledgements. Policies and statements are always on. Every other module is off until a workspace administrator turns it on in Settings > Modules. Modules change what is visible; roles, permissions, and plan limits still apply.