# What should the investment committee approve?

Approve a bounded scope, named operating capacity and measurable acceptance gates. Keep proposed benefits separate from evidenced results. Treat an unresolved migration or permission problem as a decision to make—not a footnote to an attractive feature score.

**Reply prompt:** For Q1, which decision needs the most scrutiny: replacing the incumbent, expanding it or proving that an AI add-on is worth operating?

*This outlook is procurement research, not legal advice. Recheck regulatory status, product availability and contractual terms before acting.*

---

# Sources

All sources below were located for this research pass. Dates are document or announcement dates where stated. Product announcements are first-party claims; public contractual documents may differ from negotiated agreements. The podcast reference is based on its published episode description, not a claimed review of the full recording.

1. **NIST — SP 800-221 Revision 1, initial public draft**, 22 October 2026; comment deadline 7 December 2026. `https://csrc.nist.gov/pubs/sp/800/221/r1/ipd`
2. **Optro — Agentic Third-Party Risk Management licensing terms**, 22 October 2026. `https://optro.ai/download/agreements/service-specific-licensing-terms/optro-agentic-tprm-service-specific-licensing-terms-10222026.pdf`
3. **Caterpillar — ERP Application Security GRC Admin vacancy**, posted 22 October 2026. `https://careers.caterpillar.com/en/jobs/r0000400442/erp-application-security-grc-admin/`
4. **Federal Register/GovInfo — Proposed Third-Party Risk Management Guidance**, 15 September 2026; comment deadline 16 November 2026. `https://www.govinfo.gov/content/pkg/FR-2026-09-15/html/2026-18859.htm`
5. **OCC Bulletin 2026-46 — Third-Party Risk Management: Proposed Guidance and Request for Comment**, 11 September 2026. `https://occ.gov/news-issuances/bulletins/2026/bulletin-2026-46.html`
6. **Optro — AuditBoard rebranding announcement**, 9 March 2026. `https://optro.ai/blog/auditboard-is-now-optro`
7. **Optro — Standard implementation statement of work**, 6 October 2026; particularly implementation terms and migration exclusions. `https://optro.ai/download/agreements/implementation/optro-standard-implementation-statement-of-work-10062026.pdf`
8. **Optro — Domain-trained agent announcement**, 14 October 2026. `https://optro.ai/blog/optro-launches-domain-trained-agents-for-audit-compliance-third-party-risk-and-ai-governance`
9. **ServiceNow — AI Passport and expanded governance announcement**, 15 October 2026. `https://investor.servicenow.com/news/news-details/2026/ServiceNow-advances-its-operational-harness-for-enterprise-AI-with-AI-Passport-and-expanded-governance-capabilities/default.aspx`
10. **Spring Labs — Winnow acquisition and SpringGRC announcement**, 7 October 2026; company release distributed by PR Newswire. `https://www.prnewswire.com/news-releases/spring-labs-acquires-winnow-to-connect-the-law-to-the-daily-work-of-compliance-302901357.html`
11. **Wolters Kluwer — Internal-audit AI webinar polling**, 15 October 2026; includes sampling limitations. `https://www.wolterskluwer.com/en/news/internal-audit-ai-use-governance-skills-become-priorities`
12. **NYDFS — Guidance on conducting and using cybersecurity risk assessments**, 10 September 2026. `https://www.dfs.ny.gov/industry_guidance/industry_letters/il20260910-cyber-risk-assessment`
13. **HHS — HIPAA Security Rule NPRM**, official proposal page, last reviewed 27 December 2024; checked during this research pass. `https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/index.html`
14. **IBM — OpenPages 9.1.x FastMap overview**, version-specific documentation. `https://www.ibm.com/docs/en/openpages/9.1.x?topic=fastmap-overview`
15. **Archer — Evolv Foundation and Workplace announcement**, 14 September 2026. `https://www.archerirm.com/press-releases/archer-launches-archer-evolv-foundation-and-archer-evolv-workplace`
16. **NIST — AI Agent Standards Initiative**, created 17 February 2026, updated 14 August 2026. `https://www.nist.gov/artificial-intelligence/ai-agent-standards-initiative`
17. **YouAttest/#AuditTuesday — Worried About Rogue AI? Start with Identity Governance**, episode description, 29 September 2026. `https://www.buzzsprout.com/2296327/episodes/19884818-worried-about-rogue-ai-start-with-identity-governance-audittuesday-w-justin-roy-and-jeff-kushner?t=0`

**Editorial exclusions:** The supplied market-size, software-price, implementation-multiple and buying-cycle estimates are not used as verified benchmarks. No live landing pages were supplied for the proposed desk tools, so the drafts use reply prompts rather than invented download links.