Corporate governance & accountability
Delegation and accountability register. Confirm delegation and escalate uncovered decisions.
ISO/IEC 27001 clauses 4–6 · NIST SP 800-53 PM
Portfolio / 20 connected governance workflows
Inspect the logic.
Change the data.
Explore work across AI governance, third-party risk, audit readiness, privacy and executive risk. Each module exposes the method, source fields, decision logic and guardrails.
Start with the decision.
Then inspect the system.
Filter by the governance problem instead of reading ten projects in sequence.
AI governance
Inventory, oversight & monitoring.
AI use-case governance, evaluation evidence, Article 50 transparency, human review and post-deployment change monitoring.
Filter AI work →Third-party AI risk
Vendors, LLMs & dependencies.
Vendor intake, data use, subprocessors, assurance evidence, concentration and accountable treatment decisions.
Filter vendor work →Audit & assurance
Evidence, exceptions & retest.
Control evidence, freshness, test states, remediation ownership, questionnaires and customer assurance.
Filter assurance work →29connected domain projects
13GRC domains
16shared record types
103register & reporting views
One shared record / multiple governance views
Trace the same fact
across decisions.
Edit a supplier, AI or evidence record once, then inspect how the connected workspace recalculates priorities, review queues and decision outputs.
Open connected workspace ↗Browser-local demo · transparent scoring · exportable outputs.
20 projects
Enterprise risk & appetite
Risk appetite exception memo. Escalate exposure above the approved appetite.
NIST SP 800-53 RA · ISO/IEC 27001 clause 6
Regulatory applicability & change
Applicability and change impact register. Assign unmapped obligations before reliance.
GDPR · EU AI Act · NIST SP 800-53 PL
Policy lifecycle
Policy release and acknowledgement pack. Close acknowledgement gaps before policy release.
ISO/IEC 27001 clause 7 · NIST SP 800-53 PL
Control implementation & ownership
Control implementation gap register. Assign implementation and failed-test actions.
NIST SP 800-53 · ISO/IEC 27001 Annex A · SOC 2 TSC
Internal audit & independence
Audit independence and sampling plan. Resolve independence and sampling gaps.
ISO/IEC 27001 clause 9 · NIST SP 800-53 CA
External audit & certification readiness
Audit request and evidence index. Assign incomplete requests and reviewer follow-up.
SOC 2 TSC · ISO/IEC 27001 clauses 9–10
Continuous assurance & remediation
Monitoring exception and treatment queue. Prioritize exceptions beyond tolerance.
NIST SP 800-53 CA-7 · SOC 2 CC4
Supplier lifecycle & concentration
Supplier decision and concentration pack. Escalate concentration and contractual gaps.
NIST SP 800-53 SR · ISO/IEC 27001 Annex A
Procurement & customer assurance
Evidence-backed questionnaire response pack. Keep unsupported answers in the review queue.
SOC 2 CC9 · NIST SP 800-53 SR
Privacy & individual rights
Individual rights response plan. Escalate overdue requests and verify the applicable deadline.
GDPR Articles 5, 12–22, 25, 35
Processors & cross-border transfers
Processor and transfer decision register. Resolve missing agreements and transfer assessments.
GDPR Articles 28, 30, 44–49
Data classification & retention
Retention and disposal exception register. Review overdue disposal against legal hold obligations.
GDPR Article 5 · NIST SP 800-53 MP, PT
AI inventory & lifecycle authorization
AI use-case release review pack. Resolve inventory and release prerequisites.
NIST AI RMF · ISO/IEC 42001
AI fairness, safety & oversight
AI evaluation and oversight report. Review unsafe evaluation results before release.
NIST AI RMF MEASURE/MANAGE · ISO/IEC 42001
AI transparency & content provenance
AI disclosure and provenance checklist. Close disclosure and provenance gaps.
EU AI Act Article 50
Shadow AI & acceptable use
Unapproved AI use triage register. Contain unapproved use and assign an owner.
NIST AI RMF · ISO/IEC 27001 Annex A
Continuity, recovery & crisis readiness
Recovery exercise and dependency report. Address recovery objective breaches and dependent services.
NIST SP 800-53 CP · ISO/IEC 27001 Annex A
Incident governance & reporting
Incident notification and decision timeline. Escalate overdue notification review; verify trigger and jurisdiction.
NIST SP 800-53 IR · GDPR Articles 33–34
Workforce, physical & organizational security
Joiner mover leaver control exception pack. Resolve missed personnel control actions.
NIST SP 800-53 AT, PS, PE · ISO/IEC 27001 Annex A
Financial, fraud & ethical conduct risk
Conduct exception and segregation review. Escalate unresolved conduct exceptions.
NIST SP 800-53 PM, RA
Sector, market & contractual obligations
Sector and contract obligation map. Assign unmapped sector or contract requirements.
FedRAMP Rev5 when in scope
Security scope & authorization boundary
Authorization boundary and interface dossier. Document uncovered interfaces before authorization review.
NIST RMF · NIST SP 800-53 PL-2, CA-3
Identity, least privilege & segregation
Privilege and segregation exception register. Revoke or formally review excess privilege.
NIST SP 800-53 AC, IA · SOC 2 CC6
Cloud configuration & change
Cloud change drift and release record. Resolve baseline drift before release review.
NIST SP 800-53 CM · SOC 2 CC8
Threat, vulnerability & supply-chain assurance
Vulnerability and dependency treatment plan. Assign overdue critical findings and validate treatment.
NIST SP 800-53 RA-5, SI-2, SR
Logging, evidence integrity & provenance
Evidence provenance and integrity manifest. Exclude unverified objects from the relied-on evidence set.
NIST SP 800-53 AU · SOC 2 CC7
Agent, tool & data authorization
Agent tool and data permission contract. Block unbounded actions pending permission review.
NIST SP 800-53 AC · NIST AI RMF
Assessment, authorization & ongoing monitoring
Reauthorization trigger and decision record. Route material changes to reauthorization review.
NIST SP 800-53 CA-2, CA-6, CA-7 · FedRAMP Rev5
No matching projects
How to evaluate this portfolio
Evidence before
self-description.
Open a project for its workflow, source fields, decision criteria and guardrails. Then inspect the connected workspace and exact repository history. Public scenario data is synthetic; the implementation is inspectable.
Governance coverage
AI lifecycle, supplier assurance, privacy, regulatory obligations, controls, internal audit, technology risk, resilience, policy, remediation, KRIs and program oversight connect through owned records and decision evidence.
Organization evaluations →