Back The blueprint

Eight phases. Seven artifacts

Implementation runs as a programme. Each phase produces auditable deliverables and explicit decisions, and the deliverables are not optional: that is what makes the framework self-auditing.

F0 to F7

Scoping and design run first, human-led. The analytical engine then runs on its own cadence while translation and audit close the loop, back into the next cycle.

Direction and scope

The governing body declares purpose, objectives with measurable targets, and the materiality scope. Nothing starts before it is signed.

Business map

A Business Grid workshop maps the organization into bounded contexts around stakeholder impact, with interfaces and dependencies explicit.

Event discovery

Event Storming with the people who do the work: the real events, commands and policies, not a reference model.

Metric catalog

At least one lagging outcome and one leading signal per objective, causal link explicit, every metric gate-validated before it enters the registry.

Causal analysis

The DCCA pipeline stands up in coverage mode and runs on its own published cadence from the first cycle, no outcome labels needed.

Intervention design

Pipeline output becomes a control library with test procedures and owners. Staggered rollout preserves a holdout, so effects stay measurable.

GRC translation

The work becomes the documents the organization operates on: policies, procedures, registers, and the executive dashboard.

Audit and improve

The first internal audit runs against the new baseline. Findings feed the improvement plan, and the next cycle of F0 to F3.

The key invariant: no metric reaches executive visibility without traversing all eight phases at least once. A metric introduced outside the sequence is an unauthorized metric until it is anchored to an objective, a context, an event and a registry entry.

Minimum viable compliance

Seven artifacts, one repository

A0 to A6 constitute a defensible compliance baseline. The artifact layer is a view over a shared repository, so the same obligation, risk or control appears in several artifacts without duplication.

Scope statement and stakeholder map

Delimits the boundaries of governance across the security, privacy and AI management scopes. Prevents perimeter creep.

Owner governing body
Anchors ISO/IEC 27001, ISO 37301, ISO/IEC 42001, ISO/IEC 27701

Compliance obligations register

A living list of obligations, regulatory and contractual. GDPR and the EU AI Act anchor here alongside their ISO counterparts.

Owner compliance function
Anchors ISO 37301, GDPR, EU AI Act

Policy portfolio

Security, compliance, privacy and AI policies: intent, objectives and improvement commitments, approved by top management.

Owner compliance and system owners
Anchors ISO/IEC 27001, ISO 37301, ISO/IEC 27701, ISO/IEC 42001

Risk methodology and criteria

Acceptance, evaluation and treatment criteria, so risk decisions are repeatable, comparable and documented with justification.

Owner risk function
Anchors ISO 31000, ISO/IEC 27001, ISO 37301, ISO/IEC 42001

Statements of applicability

Security and AI. Evidence that the necessary controls were considered, with every exclusion rationalized and traceable.

Owner security and AI leads
Anchors ISO/IEC 27001 Annex A, ISO/IEC 42001 Annex A

AI system impact register

Identifies, evaluates and addresses the impacts of AI systems. EU AI Act classification anchors here.

Owner AI governance lead
Anchors ISO/IEC 42001, EU AI Act

Internal audit and management review

Converts conformity into a cycle of verification and improvement. The one role independent of delivery, which is what makes its findings credible.

Owner internal audit
Anchors ISO/IEC 27001, ISO 37301, ISO/IEC 27701, ISO/IEC 42001

Every artifact is versioned, owned, classified and retained under one documentary-control template. The governing body stays accountable for all of it; delegation never transfers accountability.

Operating rhythm

Four cadences. One loop

Continuous

The pipeline

Criterion scores, composites, snapshots and attribution, on the published cadence.

Monthly

Operational review

Compliance, risk owners and security review the scorecard and in-flight remediation.

Quarterly

Executive review

The governing body reviews control effectiveness, objectives and scope changes.

Annual

Strategic review

Full re-evaluation of direction and scope against the year's evidence. The next cycle begins.

10–12

Weeks, minimum, in a small organization. Parallel workstreams in a larger one.

The recommended sequence

Sign F0. Purpose, objectives, materiality scope. Produce the scope statement.
Run F1 and F2 in parallel. Business Grid with the executive team, then Event Storming per context.
Run F3. One lagging outcome and one leading signal per objective, registered with formula, cadence, owner and evidence.
Stand up F4 in coverage mode. Useful scores from the first cycle; no waiting for outcome history.
Draft the obligations register and policies in parallel.
Produce the risk methodology and the statements of applicability.
Run F5. Controls with tests and owners, rolled out staggered.
Run F6. Publish the dashboard, the responsibility matrix and the runbooks.
Run F7. First internal audit against the new baseline; findings feed the next cycle.