Make a decision
What is in front of the decision?
Start from the concern you own, the kind of page you need, or the domain you oversee. The concerns, their board-question groups and the kinds of page are curated in the site generator; their counts and the domain list are generated at build time. A newly published leadership page fails the build until it is mapped to a concern, so every published leadership page appears on at least one concern page.
Note
Adopting a page this path leads to decides nothing for you. The leadership pages this path leads to are explanatory and advisory; they establish no requirement and prove nothing about your organization. Every claim in them resolves to the governing reference documents in the corpus, and it is those documents that govern.
Concerns, 4
Can we withstand what hits us?
- Could we take the hit and keep operating?Cybersecurity and operational resilience. 4 leadership pages, 30 governing documents.
- Do we control our information from creation to destruction?Data, privacy and the information lifecycle. 4 leadership pages, 28 governing documents.
- How exposed are we through the parties we depend on?Supplier and cloud dependency. 3 leadership pages, 26 governing documents.
- What is AI doing on our behalf, and who approved it?AI and autonomous systems. 6 leadership pages, 38 governing documents.
Concerns, 5
Can we prove we are in control?
- Who owns this decision, and where is that written?Accountability and decision rights. 3 leadership pages, 26 governing documents.
- Can we show, with evidence, that our controls operate?Compliance and assurance. 4 leadership pages, 33 governing documents.
- Which risks have we knowingly accepted, and who signed?Risk acceptance and exceptions. 2 leadership pages, 19 governing documents.
- Do we govern our crypto-asset and blockchain activity before it starts?Crypto-asset governance. 3 leadership pages, 9 governing documents.
- Do we know our enterprise risk is actually governed, not just listed?Enterprise risk governance. 3 leadership pages, 10 governing documents.
Concerns, 5
Are we running and funding it well?
- What is our accumulated technology debt costing us?Enterprise architecture and technology debt. 1 leadership page, 10 governing documents.
- Do the people running the controls have the mandate to run them?Workforce, conduct and the operating model. 1 leadership page, 11 governing documents.
- Do we know our IT operations run under a controlled governance model?IT operations governance. 3 leadership pages, 10 governing documents.
- Do we build our software under a controlled secure-development model?Secure-development governance. 3 leadership pages, 9 governing documents.
- Where does our programme stand, and what would better look like?declared gapProgramme establishment and maturity. 0 leadership pages, 1 governing document.
Kinds
The kind of page you need
- Executive briefs10What should we require before we approve this?
- Scenarios9What does the bad day look like, and would we cope?
- Journeys3How does one thing move through governance end to end?
- Outcome maps3How would we know, with evidence, that the outcome holds?
- Oversight question sets7What should we ask, and what evidence should come back?
- Decision narratives2What are the options on a genuine choice, and the trade-offs?
Domains
The domain you oversee
- AI65AI governance, assurance, and lifecycle risk controls
- Privacy57Data protection, privacy engineering, and multi-jurisdiction obligations
- Governance43Charters, policies, registers, and the programme operating model
- Compliance38Regulatory mapping, control frameworks, and sector audit readiness
- Security38Information-security controls, architecture, and operations
- Operations27Operational security, monitoring, and IT service management
- Resilience22Business continuity, disaster recovery, and incident response
- Supply chain19Third-party, vendor, and supply-chain security management
- Dev security18Secure development lifecycle, CI/CD, and pipeline controls
- Risk15Risk methodology, assessment, and treatment
- Architecture8Reference architectures and secure-design control patterns
- Crypto8Crypto-asset and blockchain governance: classification, custody, and platform risk