Tagged: GRC
Governance, Risk, Compliance concepts and workflows
Pages with this tag
Ch 19 deliverable: Over-engineering stress test — radically simplify with narrow tiered escape hatch
13Fresh-agent adversarial research deliverable for Challenge 19. Bottom line: the architecture has lost the property of 'simpler thing becomes default because it's more adoptable.' Five concrete arguments: (1) competitive landscape (Hyperproof/Drata/Vanta hide crosswalk complexity from users; Excel + SharePoint baseline is what Crosswalker actually competes with); (2) SSSOM has zero GRC adoption (~50K downloads/month all biomedical); STRM (NIST IR 8477) + OSCAL is what NIST OLIR / SCF actually use; (3) audit trail wildly over-specified vs FRE 902(13)/(14) requirements (hash + qualified-person cert + git is the legal floor); (4) 5 MB three-engine WASM bundle is 10–50× Obsidian plugin median; SCF (1,400 controls × 261 frameworks) ships as one Excel file; recursive CTEs handle 3-hop closures over 10K edges in single-digit ms; (5) concrete 'simple default' proposal: markdown + YAML frontmatter (STRM) + git + signed releases + Dataview + STRM-TSV/OSCAL export, under 500 KB. Layered engines as separate opt-in companion plugins.
Control-centric vs obligation-centric compliance
14Two distinct jobs both called "compliance" — control-centric (maintain a control library + framework crosswalks) vs obligation-centric (track laws and their changes). They need different tools. An informal-but-useful distinction (not a formal standard, and not the IIA Three Lines Model).
Framework standards & tools
15Reference guide to compliance frameworks, mapping standards, and GRC tools relevant to Crosswalker.
Institutional landscape
16The entities, relationships, and dynamics of who creates, maintains, maps, mandates, and consumes structured ontologies — the human side of ontology management.
Operational landscape
17Who does what work across the ontology ecosystem — institutions × components × resources. The combined view of effort, ownership, and sustainability.
Related tooling (GRC, audit, compliance, risk)
18The landscape of tools the internal-audit, GRC/risk, compliance, and TPRM teams already use — and where Crosswalker fits among them. Not Crosswalker's own ecosystem; these are adjacent/related platforms across the same problem domains.
For GRC / risk (operational compliance)
19How a GRC / information-security risk-management team uses Crosswalker — own the control + crosswalk spine, map controls to many frameworks at once, collect evidence once and reuse. This is Crosswalker's home turf (control-centric — operational/control compliance, distinct from regulatory compliance).
Unified risk model (for risk & GRC teams)
20A recommended implementation for risk/GRC/audit/compliance teams — a shared data model (ontology) they operate on together, with CRI Profile as the authority-of-record and every other framework crosswalked to it. The "assess once, comply many" backbone Crosswalker (or any related tool) can implement. A domain-specific application, not a universal Crosswalker concept.
For GRC teams
21How Crosswalker solves the evidence mapping problem — link your policies, audit findings, and technical docs directly to framework controls with structured metadata.
Security & GRC framework corpus
22A directory of the cybersecurity, information security, GRC, risk-management, internal-audit and regulatory-compliance frameworks worth crosswalking — each with a durable source link, license tier, and source-data status — plus how Crosswalker handles their licensing on the way from ingestion to mapping.
Registry
23Organizations, standards, methodologies, and foundational publications that are cornerstones of the ontology lifecycle ecosystem — the stakes in the ground from decades of research that Crosswalker's architecture has to respect.
CRI
24Cyber Risk Institute — publishes the CRI Profile for financial institution cybersecurity and resilience.