Customer assurance that can be defended
Structure security and compliance responses around approved evidence, accountable owners, review cadence and explicit exceptions so recurring diligence is consistent and inspectable.
01 / Executive value
Built around the decisions serious governance teams own.
Business value appears when evidence, ownership and risk treatment move together.
Control assurance with an operating cadence
Connect control intent to evidence, testing, exceptions, remediation and retesting so assurance work can operate continuously instead of becoming a one-time audit exercise.
AI governance tied to real decisions
Translate AI inventories into risk classification, ownership, human oversight, evaluation, monitoring and transparency decisions using NIST AI RMF, ISO/IEC 42001 and EU AI Act concepts.
Third-party risk proportionate to exposure
Prioritize vendor scrutiny by criticality, data exposure, assurance evidence, processor obligations and residual risk rather than treating every questionnaire as equally material.
Risk score model
208
Inherent Risk Score
127
Residual Risk Score
Residual radar view
15 sample risks
Open risks: 8 · Monitor risks: 7 · Inherent 208 → Residual 127.
Risk compression
15-risk illustrative model
38.9%
modeled score reduction
Arithmetic is derived from the sample register shown here: 208 inherent points minus 127 residual points = 81 points, or 38.9%.
Evidence coverage matrix
Domain
Control
Evidence
Owner
Decision
Access
●
●
●
●
Encryption
●
●
●
●
Incident
●
●
●
●
Vendor
●
●
●
●
AI governance
●
●
●
●
● Evidence path defined across control, evidence, owner and decision.
Evidence cadence
Q1
Owner check
Q2
Evidence refresh
Q3
Exception review
Q4
Retest / decision
A recurring assurance rhythm connects evidence freshness, exceptions and remediation decisions.
One control, multiple lenses
Operating area
SOC 2
ISO 27001
NIST AI RMF
ISO 42001
Governance
●
●
●
●
Access / data
●
●
○
○
AI oversight
○
○
●
●
Evidence / review
●
●
●
●
● Full mapping · ○ Partial or context-dependent mapping.
02 / Architecture
Enterprise Assurance Evidence Fabric.
Integrated modules turn assurance, third-party risk and AI governance into traceable decision systems.
Enterprise Assurance Evidence Fabric
A control-to-evidence architecture that decomposes broad trust claims into accountable owners, reviewable evidence, framework references, exceptions and remediation decisions.
15
Evidence domains
SOC 2 + ISO
Primary lenses
Traceable
Operating model
| Domain | Decision question | Evidence path | Priority |
|---|---|---|---|
| Privileged access | Can admin access be defended for the review period? | IdP role export · MFA policy · reviewer sign-off | High |
| Encryption | Can data protection be evidenced in transit and at rest? | TLS configuration · KMS policy · storage encryption evidence | High |
| Incident response | Can escalation, exercise and notification timing be proved? | IR plan · exercise record · notification decision log | High |
| Customer assurance | Can a trust claim be tied to approved evidence and scope? | SOC/ISO scope · control owner · evidence record · exception state | High |
Third-Party Risk Decision Engine
A vendor-governance model that turns criticality, public assurance evidence, processor obligations and AI-provider risk into approve, remediate, accept or reject decisions.
10
Vendors modeled
20
Risk questions
4
Decision states
| Vendor | Decision question | Evidence path | Decision |
|---|---|---|---|
| OpenAI | What retention, model-use and subprocessor conditions apply? | DPA · admin settings · retention/model-use evidence | Conditional |
| AWS Bedrock | Are IAM, KMS and region boundaries aligned to criticality? | IAM policy · KMS keys · region architecture · logging | Approve + monitor |
| Slack | Are OAuth apps, exports and sensitive collaboration data governed? | App inventory · admin policy · DLP/export settings | Remediate / approve |
| GitHub | Are source, tokens, secrets and AI coding features controlled? | Branch protection · secret scanning · token policy · Copilot settings | Approve + monitor |
AI Governance Decision Register
An enterprise AI inventory model connecting business purpose, stakeholders, oversight, NIST AI RMF functions, risk treatment, monitoring and EU AI Act transparency decisions.
15
AI use cases
15
Transparency cases
4
RMF functions
| Use case | Decision question | Evidence path | Action |
|---|---|---|---|
| Support chatbot | When must account, billing or security issues hand off to a human? | AI disclosure · sampled transcripts · escalation test · owner sign-off | Implement |
| Voice agent | How are disclosure, consent and material-issue handoff evidenced? | Call disclosure · consent record · transfer test · quality review | Implement |
| Code assistant | How are secret leakage and insecure-code risks constrained? | Usage policy · secret scanning · PR review · CI security gates | Control |
| Risk summarizer | How are unsupported or misstated risk conclusions prevented? | Source citations · reviewer approval · change log · exception trigger | Control |
AI risk & transparency matrix
Risk exposure vs. human oversight
Risk exposure →
Human oversight ↑
Move across a use case to inspect oversight and transparency evidence. Touch and keyboard are supported.
Risk
0–15
Human oversight
1–5
Active node
nearest pointer / focus
High exposure
4 / 7 at 15
Oversight 5/5
4 / 7
Register coverage
7 / 15 shown
Seven representative cases are plotted for readability; the portfolio register contains 15 modeled AI use cases.
Portfolio domain mix
10 systems · explicit allocation
40%
30%
30%
Assurance / GRC
Controls, assurance, audit operations
40%
AI governance
Inventory, transparency, model risk
30%
TPRM / risk
Vendor criticality, obligations, treatment
30%
03 / Selected systems
Governance systems designed to withstand scrutiny.
Ten systems spanning assurance, technology risk, third-party risk and AI governance. Each shows the operating logic, evidence path, ownership model, exception state and decision structure behind the work.
Assurance Architecture
Architects a governed path from buyer question to evidence, owner, exception and remediation decision.
SOC 2 TSC · ISO/IEC 27001:2022 · GDPR Art. 28AI Governance OS
Turns AI principles into an accountable inventory, risk model, oversight structure, evaluation plan and monitoring workflow.
NIST AI RMF 1.0 · NIST GenAI Profile · ISO/IEC 42001:2023TPRM Decisioning
Creates an evidence-led approve / remediate / accept / reject decision trail for critical vendors and AI providers.
GDPR Art. 28 · SOC 2 · ISO/IEC 27001Control Evidence
Connects control intent to evidence, cadence, ownership, test logic, exceptions and retesting.
AICPA Trust Services Criteria · ISO/IEC 27001:2022Executive Risk
Translates control and compliance activity into accountable residual-risk decisions, treatment plans and KRIs.
ISO 27001 risk treatment · NIST AI RMF · Enterprise GRCArticle 50
Maps interactive and synthetic AI use cases to provider/deployer transparency, provenance, marking and disclosure decisions.
EU AI Act Article 50 · NIST AI RMF · ISO/IEC 42001Shadow AI DLP
Defines preventive and detective controls for sensitive-data exposure through unsanctioned or poorly governed AI use.
NIST GenAI Profile · ISO/IEC 27001 · ISO/IEC 42001Security Triage
Standardizes high-friction security answers around governed evidence, ownership and review dates.
SOC 2 · ISO 27001 · GDPR · NIST AI RMFArticle 28
Converts processor and subprocessor obligations into operational controls, evidence requests and accountable decisions.
GDPR Article 28 · ISO 27001 supplier/privacy controlsAudit Operations
Structures evidence cadence, request ownership, exception tracking, remediation and retesting for repeatable assurance operations.
SOC 2 · ISO/IEC 27001 · Continuous GRC
04 / Capabilities
Capabilities connected to evidence.
Each capability points to a system, artifact, control model or decision structure that can be inspected and discussed in a technical interview.
Technology GRC
GRC & ComplianceRisk, controls, evidence, ownership, exceptions, remediation and assurance workflows.
Applied in · 10-system operating portfolioSOC 2
GRC & ComplianceTrust Services Criteria translated into control, evidence, testing and assurance structures.
Applied in · 15-domain control inventoryISO/IEC 27001
GRC & ComplianceISMS control architecture, risk treatment, ownership and evidence mapping.
Applied in · Control-to-evidence architectureSecurity Questionnaires
GRC & ComplianceGoverned buyer answers with evidence paths, accountable owners and review cadence.
Applied in · 25-question assurance knowledge baseControl Testing
GRC & CompliancePopulation/sample logic, expected results, exceptions, remediation and retesting.
Applied in · Audit-operations systemNIST AI RMF
AI GovernanceGovern, Map, Measure and Manage applied to enterprise AI inventory and risk decisions.
Applied in · 15-use-case AI governance registerEU AI Act Article 50
AI GovernanceProvider/deployer transparency analysis for interactive and synthetic AI use cases.
Applied in · 15-use-case transparency registerISO/IEC 42001
AI GovernanceAI management-system concepts integrated with accountability, risk and evidence workflows.
Applied in · AI governance operating architectureAI Risk Registers
AI GovernancePurpose, data, stakeholder, oversight, evaluation, monitoring and residual-risk mapping.
Applied in · AI governance decision registerShadow AI Governance
AI GovernanceApproved channels, prompt classification, secret detection, redaction and unsanctioned-use controls.
Applied in · 12-control governance standardThird-Party Risk
TPRM & RiskCriticality tiering, evidence review, contractual risk, findings and treatment decisions.
Applied in · 10-vendor TPRM registerGDPR Article 28
TPRM & RiskProcessor instructions, subprocessors, assistance, deletion, audit rights and evidence requirements.
Applied in · 12-clause processor control setVendor Risk Assessments
TPRM & RiskEvidence requests spanning assurance, IAM, cryptography, privacy, resilience and AI providers.
Applied in · 20-question vendor-risk assessmentExecutive Risk
TPRM & RiskLikelihood, impact, residual risk, appetite, treatment, KRI and escalation logic.
Applied in · 15-risk executive registerPython
AutomationData transformation and repeatable artifact-generation workflows for governance and evidence operations.
Applied in · GRC evidence workbooksHTML / CSS / JavaScript
AutomationResponsive interfaces, progressive enhancement, accessible interaction states and browser-native portfolio tooling.
Applied in · This portfolio runtimeStatic Web Architecture
AutomationStatic-first delivery, metadata, clean routing, build validation and deployment portability across static hosts.
Applied in · Cloudflare Pages + Vercel build outputGit / GitHub
AutomationVersion control, change traceability, repository documentation and delivery workflow.
Applied in · Portfolio repositoryData Modeling / SQL
AutomationStructured thinking for evidence inventories, risk registers, ownership and relational decision data.
Applied in · Computer Science systems foundation + GRC systemsSystems Thinking
AutomationTechnical foundation for decomposing governance problems into inputs, states, dependencies and decision logic.
Applied in · Computer Science systems foundation + operating portfolio
05 / Framework depth
Standards translated into operating logic.
Framework knowledge matters when it changes how controls are designed, evidence is collected, ownership is assigned, exceptions are handled and decisions are made.
NIST AI RMF 1.0
Govern, Map, Measure and Manage provide the primary risk lifecycle used across the AI inventory, oversight, evaluation and monitoring architecture.
Open primary source ↗ISO/IEC 27001:2022
ISMS requirements inform risk treatment, accountable control ownership, evidence structure and the relationship between governance intent and operating proof.
Open primary source ↗AICPA Trust Services Criteria
Security, availability, processing integrity, confidentiality and privacy criteria inform control-and-evidence structures used in customer assurance and audit operations.
Open primary source ↗EU AI Act Article 50
Transparency obligations guide deployer/provider decisions for interactive AI, synthetic media, generated text and disclosure contexts.
Open primary source ↗GDPR Article 28
Processor obligations are translated into subprocessor, audit-right, deletion, assistance, confidentiality and security-evidence requirements.
Open primary source ↗
Live / Public risk signal
Current exploited-vulnerability pressure, translated into governance action.
This view reads CISA's public Known Exploited Vulnerabilities data when the page opens and turns the latest entries into the control, evidence and decision questions a Technology Risk, GRC or TPRM team would own.
Connecting to CISA KEV…
Public source · refreshes on page load
Open CISA KEV ↗
Waiting for the public feed.
The rest of the portfolio remains fully usable if the source is unavailable.
Governance response
01
Confirm asset/vendor exposure
→
02
Assign accountable owner
→
03
Capture remediation evidence
→
04
Record exception + residual risk
Direct conversation
Bring the governance problem that cannot stay ambiguous.
I am open to high-ownership opportunities across Technology Risk, GRC, Security Compliance, Third-Party Risk and AI Governance. Send the role, business context and hardest unresolved risk question. My portfolio shows the architecture and decision logic I would bring to the conversation.
Direct path
Role, context, hard problem.
The fastest useful conversation starts with the mandate and the unresolved decision. The evidence behind the work is already available below.