ABDULLAH AL OWASID01
Corporate governance & accountability
Corporate governance & accountability
Delegation and accountability register. Confirm delegation and escalate uncovered decisions.
ISO/IEC 27001 clauses 4–6 · NIST SP 800-53 PM
Connected GRC operating workspace / AI · vendor · assurance
Inspect the evidence.
Trace the decision.
Stop buying more checklists. Inspect bounded AI, supplier and audit decisions with named reviewer actions and downloadable handovers.
Agentic assurance / post-checklist GRC
Automate the legwork.
Preserve accountable judgment.
AI can gather evidence, draft registers and prepare audit work. The portfolio now makes the next layer explicit: evidence validity, control effectiveness, agent/tool/data authorization, exceptions, residual risk and human sign-off.
29 projects
D02
Enterprise risk & appetite
Enterprise risk & appetite
Risk appetite exception memo. Escalate exposure above the approved appetite.
NIST SP 800-53 RA · ISO/IEC 27001 clause 6
D03
Regulatory applicability & change
Regulatory applicability & change
Applicability and change impact register. Assign unmapped obligations before reliance.
GDPR · EU AI Act · NIST SP 800-53 PL
D04
Policy lifecycle
Policy lifecycle
Policy release and acknowledgement pack. Close acknowledgement gaps before policy release.
ISO/IEC 27001 clause 7 · NIST SP 800-53 PL
D05
Control implementation & ownership
Control implementation & ownership
Control implementation gap register. Assign implementation and failed-test actions.
NIST SP 800-53 · ISO/IEC 27001 Annex A · SOC 2 TSC
D06
Internal audit & independence
Internal audit & independence
Audit independence and sampling plan. Resolve independence and sampling gaps.
ISO/IEC 27001 clause 9 · NIST SP 800-53 CA
D07
External audit & certification readiness
External audit & certification readiness
Audit request and evidence index. Assign incomplete requests and reviewer follow-up.
SOC 2 TSC · ISO/IEC 27001 clauses 9–10
D08
Continuous assurance & remediation
Continuous assurance & remediation
Monitoring exception and treatment queue. Prioritize exceptions beyond tolerance.
NIST SP 800-53 CA-7 · SOC 2 CC4
D09
Supplier lifecycle & concentration
Supplier lifecycle & concentration
Supplier decision and concentration pack. Escalate concentration and contractual gaps.
NIST SP 800-53 SR · ISO/IEC 27001 Annex A
D10
Procurement & customer assurance
Procurement & customer assurance
Evidence-backed questionnaire response pack. Keep unsupported answers in the review queue.
SOC 2 CC9 · NIST SP 800-53 SR
D11
Privacy & individual rights
Privacy & individual rights
Individual rights response plan. Escalate overdue requests and verify the applicable deadline.
GDPR Articles 5, 12–22, 25, 35
D12
Processors & cross-border transfers
Processors & cross-border transfers
Processor and transfer decision register. Resolve missing agreements and transfer assessments.
GDPR Articles 28, 30, 44–49
D13
Data classification & retention
Data classification & retention
Retention and disposal exception register. Review overdue disposal against legal hold obligations.
GDPR Article 5 · NIST SP 800-53 MP, PT
D14
AI inventory & lifecycle authorization
AI inventory & lifecycle authorization
AI use-case release review pack. Resolve inventory and release prerequisites.
NIST AI RMF · ISO/IEC 42001
D15
AI fairness, safety & oversight
AI fairness, safety & oversight
AI evaluation and oversight report. Review unsafe evaluation results before release.
NIST AI RMF MEASURE/MANAGE · ISO/IEC 42001
D16
AI transparency & content provenance
AI transparency & content provenance
AI disclosure and provenance checklist. Close disclosure and provenance gaps.
EU AI Act Article 50
D17
Shadow AI & acceptable use
Shadow AI & acceptable use
Unapproved AI use triage register. Contain unapproved use and assign an owner.
NIST AI RMF · ISO/IEC 27001 Annex A
D18
Continuity, recovery & crisis readiness
Continuity, recovery & crisis readiness
Recovery exercise and dependency report. Address recovery objective breaches and dependent services.
NIST SP 800-53 CP · ISO/IEC 27001 Annex A
D19
Incident governance & reporting
Incident governance & reporting
Incident notification and decision timeline. Escalate overdue notification review; verify trigger and jurisdiction.
NIST SP 800-53 IR · GDPR Articles 33–34
D20
Workforce, physical & organizational security
Workforce, physical & organizational security
Joiner mover leaver control exception pack. Resolve missed personnel control actions.
NIST SP 800-53 AT, PS, PE · ISO/IEC 27001 Annex A
D21
Financial, fraud & ethical conduct risk
Financial, fraud & ethical conduct risk
Conduct exception and segregation review. Escalate unresolved conduct exceptions.
NIST SP 800-53 PM, RA
D22
Sector, market & contractual obligations
Sector, market & contractual obligations
Sector and contract obligation map. Assign unmapped sector or contract requirements.
FedRAMP Rev5 when in scope
D23
Security scope & authorization boundary
Security scope & authorization boundary
Authorization boundary and interface dossier. Document uncovered interfaces before authorization review.
NIST RMF · NIST SP 800-53 PL-2, CA-3
D24
Identity, least privilege & segregation
Identity, least privilege & segregation
Privilege and segregation exception register. Revoke or formally review excess privilege.
NIST SP 800-53 AC, IA · SOC 2 CC6
D25
Cloud configuration & change
Cloud configuration & change
Cloud change drift and release record. Resolve baseline drift before release review.
NIST SP 800-53 CM · SOC 2 CC8
D26
Threat, vulnerability & supply-chain assurance
Threat, vulnerability & supply-chain assurance
Vulnerability and dependency treatment plan. Assign overdue critical findings and validate treatment.
NIST SP 800-53 RA-5, SI-2, SR
D27
Logging, evidence integrity & provenance
Logging, evidence integrity & provenance
Evidence provenance and integrity manifest. Exclude unverified objects from the relied-on evidence set.
NIST SP 800-53 AU · SOC 2 CC7
D28
Agent, tool & data authorization
Agent, tool & data authorization
Agent tool and data permission contract. Block unbounded actions pending permission review.
NIST SP 800-53 AC · NIST AI RMF
D29
Assessment, authorization & ongoing monitoring
Assessment, authorization & ongoing monitoring
Reauthorization trigger and decision record. Route material changes to reauthorization review.
NIST SP 800-53 CA-2, CA-6, CA-7 · FedRAMP Rev5