Prove → Compliance → Controls lists every control across your entire company — not scoped to one framework, since the same control is often reused across several (SOC 2, ISO 27001, GDPR, and so on all draw from the same control set where their requirements overlap).

Open any control's Tests tab to see exactly what it's evaluated against:

This control shows 2/3 OK — two automated tests passing, one failing — and that's enough to mark the whole control as failing, not "mostly passing." Every mapped test (automated and manual) has to pass for the control itself to show green. If you're trying to figure out why a control that "looks mostly fine" still shows as failing, this is almost always why — check the Tests tab for the one holdout.

Select one or more controls from the list and you'll see Activate / Deactivate — notably, no Delete:

Standard, framework-provided controls can only be deactivated, never deleted — they're part of the framework's own definition, so removing one outright isn't offered here. Deactivating pulls a control out of your active readiness calculations without destroying its history.

A custom control you've created yourself (via Add Control) is the one case where deletion becomes possible, though it's not available from this bulk bar — check that control's own detail page. If you've built a custom control with no framework mappings or evidence attached, deactivate is still the safe default; only delete if you're certain nothing else depends on it.