Governance

Compliance & controls

A control catalog with dated evidence, a findings register that closes rather than accumulates, periodic access reviews, and one dashboard that reads across all of them — plus backup freshness, because a control nobody can evidence is a claim.

The compliance dashboard

One page reads across every register: the control catalog's latest evidence, open findings by severity, the current access-review cycle, integration health, vendor review status, and whether last night's backup actually ran and was ever restored.

Nothing on it is new data. Every number is read from a table another page already owns, which is what makes it a rollup you can trust rather than a second set of books that drifts from the first.

Controls & evidence

A control is a statement about how the company operates — backups are taken nightly, access is reviewed quarterly, secrets are encrypted at rest. Each one carries its latest result and the date that result was recorded, so the dashboard can distinguish three states that look identical in a spreadsheet: passing, failing, and nobody has checked in eleven months.

Evidence has a shelf life

Freshness is computed, not asserted. A backup control whose last successful run is three weeks old reads as stale on the dashboard even though the run itself succeeded — because the question the control answers is "is this true now".

The findings register

Findings are the register of things that are wrong: security-review findings, automated control-check failures, your repository's own security alerts, and issues reported by hand. Each is tracked from open through to closure with an owner and, where there is one, the commit that fixed it.

Source

Review findings, failed control checks, GitHub security alerts, manual reports — one register rather than four places to forget.

Severity

Ranked, and summarised by severity on the dashboard so the top of the list is the top of the list.

Owner

A person, not a team. A finding with no owner is the one that ages.

Closure

Closed with the fix commit where a commit exists, so the register links to the change rather than to an assertion that it happened.

Access reviews

Section access is enforced live — the roster grants access per section, and a disabled account loses it on its next request. An access review is the separate thing live enforcement cannot provide: the periodic record that someone actually looked at who has what and signed it off.

A cycle snapshots who has access to what, routes it for sign-off, and keeps the result. That snapshot is the evidence an auditor asks for, and it is the artefact that catches the account nobody meant to leave enabled.

Vendors & integration health

Every connected third party is both an integration and a vendor. Control tracks them as both: health — is this connection currently working — and review status — has anyone assessed what this vendor processes on our behalf, and is the paperwork in place.

control catalogfindingsaccess-review cyclesvendor DPAsbackup freshness