# Sources

Sources below support the inline evidence. Older publications are retained where they remain relevant; release-specific documentation must be checked against the version and terms actually proposed to the buyer.

### Expert identification and practitioner perspectives

1. GRC 20/20 — Michael Rasmussen biography: `https://grc2020.com/person/michael-rasmussen/`
2. OCEG — Carole Switzer: `https://www.oceg.org/carole/`
3. Norman Marks — About Norman: `https://normanmarks.wordpress.com/about/`
4. GRC Engineer — Build vs. Buy: We Did Both. Here’s What We Learned: `https://grcengineer.com/p/build-vs-buy-we-did-both-here-s-what-we-learned-rsac-2026-talk-summary/`
5. Gregory and Maria Rasner — Speaker kit: `https://rasner.com/speaker-kit/`
6. NIST — Apostol Vassilev: `https://www.nist.gov/people/apostol-vassilev`

### Operating model, delivery and commercial evidence

7. OCEG — What is GRC?: `https://www.oceg.org/ideas/what-is-grc/`
8. Deloitte — From Implementation to Adoption and Beyond, 2026: `https://www.deloitte.com/content/dam/assets-zone3/us/en/docs/services/audit-assurance/2026/aa-optro-placemat-0402.pdf`
9. Optro — Rebrand announcement, 9 March 2026: `https://optro.ai/blog/auditboard-is-now-optro`
10. IBM — OpenPages supported migration items: `https://www.ibm.com/docs/en/openpages/9.1.x?topic=environments-supported-migration-items`
11. IBM — Migrating OpenPages environments: `https://www.ibm.com/docs/en/openpages/9.1.x?topic=guide-migrating-openpages-environments`
12. Archer — Managing Data Feeds, version-specific documentation: `https://help.archerirm.cloud/platform_2025_04/en-us/content/platform/integration/int_dfm_managing.htm`
13. First Horizon recruitment listing — Senior GRC Administrator: `https://recruiting.ultipro.com/FIR1007FTN/JobBoard/c005ef3e-175a-49c4-ba29-9f431f673944/OpportunityDetail?opportunityId=3d3259bf-0bb5-474b-8eb4-639fe8f63a6b`
14. ServiceNow — IRM entitlements, effective 1 May 2025: `https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/other-document/entitlements/PROD12020.pdf`
15. Archer — Export Assessment in Engage, updated 1 July 2026: `https://community.archerirm.com/hc/en-us/articles/52147245311379-Export-Assessment-in-Engage-is-Live`

### Assurance, risk and regulatory sources

16. NIST — IR 8286C Revision 1, December 2025: `https://csrc.nist.gov/pubs/ir/8286/c/r1/final`
17. PCAOB — AS 1105, Audit Evidence: `https://pcaobus.org/oversight/standards/auditing-standards/details/AS1105`
18. The IIA — Statements of Position, including July 2026 updates: `https://www.theiia.org/en/resources/statements-of-position`
19. The IIA — Three Lines Model: Assurance and Advice in Support of Effective Governance: `https://www.theiia.org/globalassets/site/resources/statements-of-position/tlm_assurance_advice_support_effective_gov_en.pdf`
20. Federal Reserve — SR 24-2, community-bank third-party risk guide and status: `https://www.federalreserve.gov/supervisionreg/srletters/SR2402.htm`
21. Federal Reserve — Third-Party Risk Management: A Guide for Community Banks: `https://www.federalreserve.gov/frrs/guidance/third-party-risk-management-a-guide-for-community-banks.htm`
22. Federal Reserve — Proposed third-party risk management guidance, 11 September 2026: `https://www.federalreserve.gov/newsevents/pressreleases/bcreg20260911a.htm`
23. HHS — HIPAA Security Rule NPRM: `https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/index.html`
24. Reginfo.gov — Unified Agenda search results for RIN 0945-AA22: `https://www.reginfo.gov/public/Forward?Image61.x=19&Image61.y=7&SearchTarget=Agenda&textfield=0945-AA22+`
25. NYDFS — Cybersecurity Resource Center: `https://www.dfs.ny.gov/industry_guidance/cybersecurity`
26. NYDFS — Covered-entity implementation timeline: `https://www.dfs.ny.gov/system/files/documents/2023/11/cybersecurity_implementation_timeline_covered_entities.pdf`

### AI evaluation and security

27. NIST — Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile: `https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf`
28. NIST — Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations, March 2025: `https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2025.pdf`