# Readiness quiz

Controlspan Research Desk · Last updated 28 October 2026

# What does this GRC readiness assessment measure?

**It measures whether you can give suppliers a sufficiently clear, evidenced buying brief.** Answer for one defined first release—not every workflow your organisation might eventually want.

The underlying research supports examining more than software features. KPMG’s GRC implementation guidance explicitly addresses process maturity, data rationalisation and migration, testing criteria, and post-production support. Those subjects inform this quiz, but KPMG does not endorse its scoring. ([kpmg.com](https://kpmg.com/kpmg-us/content/dam/kpmg/pdf/2024/implement-grc-technology-right-way.pdf))

Use it for:

- Moving from spreadsheets to GRC software.
- Replacing an incumbent enterprise GRC platform.
- Expanding an existing platform into a materially different workflow.
- Deciding whether to repair the current operating model before purchasing more technology.

The assessment deliberately awards no points for choosing a particular brand, buying more modules or adopting AI.

---

# How should your team answer and calculate the score?

1. **Define the assessment boundary.** Record the first workflow, legal entities, business units, current repositories and intended decision date.
2. **Choose one answer per question:** A = 0, B = 1, C = 2, D = 3 points.
3. **Choose the highest answer you can fully substantiate.** D includes the relevant preparation described in C. If evidence is missing or stakeholders disagree, use the lower supported answer.
4. **Treat unknown as zero.** Record the unanswered issue separately; do not turn uncertainty into an assumed capability.
5. **Keep all 15 questions in the denominator.** Deliberately excluding AI or integrations can earn full points where the exclusion is documented and controlled, as described below.
6. **Add the points, then apply the mandatory gates.** A gate failure changes the recommended action, not the arithmetic.

Ask the programme lead to consolidate responses from the sponsor, process owners, IT/security, finance/procurement and internal audit where relevant. One person may cover several roles; the test is accountable capacity, not job-title count.

**Evidence standard:** an approved email, decision log, sample extract or working spreadsheet can qualify. A verbal intention cannot. Keep sensitive evidence in your own approved systems; synthetic or redacted examples are sufficient for quiz discussions.

**Pre-selection distinction:** full marks mean the buyer has prepared and rehearsed the evaluation requirements. They do not mean an unselected platform has passed them. Supplier demonstrations, due diligence and implementation acceptance remain separate steps.

---

---

# Domain 1: Have you agreed what the platform must accomplish?

NIST’s organisational-profile guidance distinguishes current and target outcomes and uses their differences to prioritise action. The IIA’s July 2026 Three Lines statement emphasises clear responsibilities, collaboration and safeguards for independence. These are useful foundations for defining a buying brief without confusing shared technology with shared accountability. ([csrc.nist.gov](https://csrc.nist.gov/pubs/sp/1301/final?trk=article-ssr-frontend-pulse_little-text-block))

### 1. Who can approve scope, resolve disputes and commit resources?

- **A — 0:** We have interest in a platform, but no accountable executive sponsor or programme owner.
- **B — 1:** A sponsor is named, but decision rights and escalation routes are informal.
- **C — 2:** The sponsor and programme lead have accepted their responsibilities; scope, funding and escalation decision rights are documented.
- **D — 3:** The governance group has used those arrangements to resolve a real scope or resource trade-off, with the decision recorded.

**Evidence to retain:** sponsor mandate, decision-rights table and decision log.

**Mandatory gate:** score at least 2.

### 2. Is the first-release scope specific enough to price and evaluate?

- **A — 0:** The brief is essentially “one enterprise GRC platform”.
- **B — 1:** Preferred modules are listed, but workflows, entities and exclusions remain unsettled.
- **C — 2:** The first workflow, participating entities, relevant obligations, retained systems and exclusions are approved; an appropriate specialist owns obligation applicability.
- **D — 3:** Business owners have also agreed measurable outcomes, a current baseline and the conditions under which scope may expand.

**Evidence to retain:** a one-page scope charter and requirements register linking each requirement to an owner and acceptance method.

**Mandatory gate:** score at least 2. Do not substitute a supplier’s framework library for your own applicability decisions.

### 3. Have you separated control ownership, challenge and independent assurance?

- **A — 0:** We expect the software or implementation partner to determine accountability.
- **B — 1:** Owners exist, but risk acceptance, exception approval, testing or escalation responsibilities conflict.
- **C — 2:** Responsibilities for operating controls, reviewing evidence, accepting risk, approving exceptions and providing assurance are documented, including applicable independence safeguards.
- **D — 3:** The team has rehearsed a failed control, disputed risk score and overdue action; each scenario reaches a named decision-maker without unresolved role conflicts.

**Evidence to retain:** responsibility matrix and scenario decision records. Where internal audit is outside the first release, document how the design preserves its access and assurance role rather than marking the question irrelevant.

**Mandatory gate:** score at least 2.

---

---

# Domain 2: Can you migrate information without losing its meaning?

IBM’s OpenPages documentation distinguishes configuration items from instance data and parent–child relationships, with different migration mechanisms for different information types. That is a product-specific example—not a claim about every platform—but it supports asking separately about records, relationships and configuration. ([ibm.com](https://www.ibm.com/docs/en/openpages/9.1.0?topic=environments-supported-migration-items))

### 4. Do you have a usable risk, control and organisational data model?

- **A — 0:** Records have inconsistent names, identifiers or entity assignments, with no agreed definitions.
- **B — 1:** There is a draft taxonomy, but business units still interpret key fields differently.
- **C — 2:** Required fields, stable identifiers, ownership, entity hierarchy, risk scales and relationships are defined for the first release.
- **D — 3:** Representative source records have been mapped against that model; conflicting definitions and duplicate concepts have documented resolutions.

**Evidence to retain:** field dictionary, relationship map and reviewed sample. Distinguish a control definition from its operation in a particular entity, and evidence from the conclusion drawn about that evidence.

### 5. Have you measured migration defects rather than assumed the data is clean?

- **A — 0:** No source profiling has been performed.
- **B — 1:** A few spreadsheets have been inspected, without a repeatable issue log.
- **C — 2:** A deliberately selected sample has been checked for missing owners, duplicate identifiers, invalid values and broken relationships; defects have owners and remediation tasks.
- **D — 3:** A representative subset has been cleaned and independently checked, and the remaining source inventory, cleansing workload and reconciliation criteria are documented.

**Evidence to retain:** source inventory, sampling rationale, defect counts, remediation backlog and validation results.

**Scoring caution:** sample results establish the condition of that sample. Do not present them as a measured defect rate for the entire estate without an appropriate sampling basis.

### 6. Can you preserve evidence, history and reporting traceability?

- **A — 0:** The migration plan covers current register rows only.
- **B — 1:** Attachments and historical records are recognised, but their treatment is undecided.
- **C — 2:** The plan distinguishes what moves, what remains in an accessible archive, and what may be disposed of following authorised retention decisions; ownership and access requirements are recorded.
- **D — 3:** The team has traced a representative management-report figure to its underlying records, evidence and approval history, and demonstrated retrieval from the proposed source or archive arrangement.

**Evidence to retain:** evidence manifest, history/retention decision log and a traceability example. Specify timestamps, versions, approvals and relationships—not merely filenames.

---

---

# Domain 3: Are security, integrations and AI requirements testable?

NIST CSF 2.0 includes identity, authentication and access-control outcomes. At a concrete implementation level, LogicGate’s API troubleshooting documentation explains that an authenticated request can still fail because the user or token lacks the necessary permissions. Treat access behaviour as something to test, not infer from a connector name. ([nvlpubs.nist.gov](https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf))

### 7. Has security approved the requirements for sensitive GRC information?

- **A — 0:** We have not classified the information the platform will contain.
- **B — 1:** A generic supplier-security questionnaire exists, but workflow-specific restrictions are missing.
- **C — 2:** Security and relevant privacy/legal owners have approved requirements for identity, privileged access, sensitive findings, audit trails, hosting, retention, resilience and supplier due diligence.
- **D — 3:** A synthetic test pack specifies both permitted and denied actions across business units, administrators, integrations and reporting; reviewers have agreed the pass/fail criteria.

**Evidence to retain:** approved requirements, access matrix and negative-access tests—for example, a user who must not retrieve another entity’s restricted finding.

**Mandatory gate:** score at least 2. Production-data access still requires separate authorisation.

### 8. Have you specified integration behaviour and maintenance ownership?

- **A — 0:** We are relying on statements such as “integrates with Jira” or “has an API”.
- **B — 1:** Systems are listed, but data direction, ownership and failure handling are unclear.
- **C — 2:** Each first-release interface specifies objects, fields, identifiers, authentication, synchronisation direction, frequency, error handling and a maintenance owner.
- **D — 3:** Representative source payloads or extracts have been checked against the proposed mappings; tests cover failed authentication, retries, duplicate processing, stale data and reconciliation.

**Evidence to retain:** interface register, sample payloads, failure scenarios and responsibility split between buyer, supplier and partner.

**No automated integrations planned?** Apply the same progression to the controlled manual-import process. Full marks require a tested import/reconciliation procedure and an approved boundary on what remains manual.

### 9. Have you made an explicit, controlled decision about AI features?

- **A — 0:** We have not decided what AI may access or do.
- **B — 1:** AI demonstrations are being assessed mainly for convenience or apparent accuracy.
- **C — 2:** Each proposed AI use has an owner, permitted data, approval boundaries and evaluation criteria—or AI is explicitly excluded from the first release.
- **D — 3:** For included AI, a reviewed test pack covers source traceability, incorrect outputs, restricted evidence, human approval and stopping or reversing actions where relevant. For excluded AI, the exclusion is written into procurement requirements and later activation requires approval.

**Evidence to retain:** AI use-case register and test pack, or an approved exclusion and change-control decision.

NIST’s Generative AI Profile recommends verifying output sources and citations and cautions against extrapolating capability from narrow, anecdotal assessments. That supports testing on buyer-relevant material rather than treating a successful demonstration as general assurance. ([doi.org](https://doi.org/10.6028/NIST.AI.600-1))

---

---

# Domain 4: Can you implement and operate the platform?

NIST’s March 2026 workforce guide connects workforce decisions to risk and planned responses. ServiceNow’s January 2026 implementation certification blueprint separately covers configuring, implementing and maintaining its risk and compliance applications. Neither source establishes a universal staffing ratio; use them as prompts to identify the work your organisation must resource. ([csrc.nist.gov](https://csrc.nist.gov/pubs/sp/1308/final))

### 10. Have you allocated buyer-side delivery capacity and dependencies?

- **A — 0:** The supplier or partner is expected to handle implementation with little buyer involvement.
- **B — 1:** People are named, but their availability and responsibilities are unconfirmed.
- **C — 2:** Process design, cleansing, integration, testing, decisions and cutover planning have accountable owners, allocated time and documented dependencies.
- **D — 3:** The team has challenged the plan against a missed dependency, unavailable specialist or delayed migration extract, and agreed revised sequencing, contingencies and go/no-go ownership.

**Evidence to retain:** a resource-loaded GRC implementation project plan, buyer/partner responsibility split and dependency log.

**Mandatory gate:** score at least 2. An examination or renewal deadline should be recorded as a constraint, not treated as proof that the work fits.

### 11. Who will administer the platform after implementation support ends?

- **A — 0:** No ongoing service owner or administrator has been identified.
- **B — 1:** Someone is nominated, but capacity, backup and support arrangements are undefined.
- **C — 2:** Administration, access reviews, workflow changes, integration support, upgrades and user support have owners, capacity allocations and a funded sourcing plan.
- **D — 3:** Those owners have rehearsed a change request, support incident and handover scenario; training gaps, documentation requirements and external escalation arrangements are addressed.

**Evidence to retain:** an operating plan, administration task list, workload assumptions, backup arrangements and handover acceptance checklist.

**Mandatory gate:** score at least 2. Managed services can qualify; responsibility and funding must still be explicit.

### 12. Can occasional users complete the work, and can evaluators judge it?

- **A — 0:** Evaluation is limited to the core GRC team watching standard demonstrations.
- **B — 1:** Business users have been consulted, but tasks and acceptance criteria are not written.
- **C — 2:** A buyer-specific demonstration script covers an ordinary contribution, rejected evidence, an overdue action, a disputed score, a restricted record and an administrator change.
- **D — 3:** Representative contributors have rehearsed the tasks using mock-ups or synthetic records; the team has agreed completion, usability, training and support criteria for supplier evaluation.

**Evidence to retain:** demonstration script, user feedback and acceptance register. Record supplier outcomes as demonstrated, partly demonstrated or not demonstrated—not automatically “unsupported”.

Microsoft’s Dynamics 365 go-live guidance recommends testing edge cases, migrated data and correct security roles, alongside business sign-off. This is a transferable enterprise-implementation practice, not GRC-specific product evidence. ([learn.microsoft.com](https://learn.microsoft.com/en-gb/dynamics365/guidance/implementation-guide/prepare-go-live-checklist))

---

---

# Domain 5: Can you afford the commitment and preserve your options?

The US banking agencies’ community-bank guide covers planning, supplier selection, contracts, monitoring and termination. It is voluntary supervisory guidance for its stated audience, not a universal GRC purchasing law or a compliance safe harbour. Its lifecycle approach informs the following buyer questions. ([occ.gov](https://www.occ.gov/news-issuances/news-releases/2024/pub-third-party-risk-management-guide-for-community-banks.pdf))

### 13. Is there a credible three-year ownership model and funding route?

- **A — 0:** We do not have a cost model or identified funding owner.
- **B — 1:** The budget covers headline software pricing only.
- **C — 2:** A USD model includes software, implementation, migration, integrations, internal delivery work, ongoing administration, training, support and overlap with retained systems; unknowns are visible and an approval route is named.
- **D — 3:** Finance has reviewed scope and volume assumptions, downside scenarios and the affordability ceiling; discovery and evaluation funding are authorised, with a defined route for the final commitment.

**Evidence to retain:** a three-year GRC total cost of ownership worksheet, assumption register and funding decision.

**Mandatory gate:** score at least 2. A supplier estimate is an input, not approval of the complete business case.

### 14. Have procurement and legal defined the commercial questions?

- **A — 0:** We plan to review terms after choosing the preferred supplier.
- **B — 1:** Procurement is involved, but quote comparison focuses on subscription price.
- **C — 2:** The comparison schedule covers user categories, modules, entities, environments, APIs, connectors, content, support, implementation deliverables, acceptance, renewal and change requests.
- **D — 3:** Procurement and legal have approved negotiation positions, evidence requests and escalation routes; the team knows who owns unresolved technical, commercial and contractual assumptions.

**Evidence to retain:** commercial clarification schedule, draft statement-of-work requirements and approval matrix.

**Concrete reason to check:** LogicGate’s published API getting-started page states that API access requires an add-on purchase. Confirm the terms of the actual offer rather than generalising that documentation into a market-wide pricing rule. ([logicgate.ai](https://www.logicgate.ai/developer/risk-cloud-api-getting-started/))

### 15. Have you checked renewal, portability and exit before committing?

- **A — 0:** Renewal dates, source-data access or future export requirements are unknown.
- **B — 1:** Key dates are known, but export completeness and transition effort are untested.
- **C — 2:** The plan records notice dates, source access, required export contents, archive needs, transition responsibilities and the future supplier’s proposed exit obligations.
- **D — 3:** A representative current-source export or archive retrieval has been checked for records, attachments, relationships and history; future supplier portability tests and an exit-cost scenario are ready for evaluation.

**Evidence to retain:** renewal/notice calendar, export manifest, test results and exit assumptions.

**First-time buyer?** Test extraction from your current spreadsheets and repositories, and define the new platform’s future export requirements. You do not need an incumbent software contract to score well.

---

---

# What does your score mean?

**Add Q1–Q15 for a raw score out of 45. Then apply the mandatory gates below.** These bands are editorial routing thresholds, not probabilities of implementation success.

| Raw score | Readiness band | What it means in this rubric | Recommended next step |
|---|---|---|---|
| **0–14** | **Establish the foundations** | Too much of the buying brief is unowned, undefined or unsupported. | Approve a sponsor, first workflow and responsibility model. Use the **Minimum Viable GRC Scope Builder** specification to produce a scope charter before seeking comparable proposals. |
| **15–26** | **Build the buying case** | There is a credible problem, but suppliers would still need to make substantial assumptions. | Complete the **Requirements Scorecard**, **Migration Readiness X-Ray** and preliminary **TCO Calculator**. Limit supplier engagement to discovery against explicit questions. |
| **27–35** | **Prepare a controlled shortlist** | Much of the brief is documented, but material weaknesses need targeted attention. | Close failed gates, investigate the weakest domain and issue the same workflow requirements to each candidate. Prepare an **Integration Check** and buyer-specific **Demo Script**. |
| **36–45** | **Ready for rigorous supplier evaluation** | The buyer has assembled a strong evaluation brief and evidence base for the defined scope. | Run scenario demonstrations, technical proof, implementation scoping, reference checks and commercial due diligence. Use an **Operating Plan** and **Exit Planner** before final commitment. |

**Tool names identify recommended desk worksheets or outputs.** No landing-page availability is assumed; the evidence requirements in this quiz can be used to build them internally.

### Which mandatory gates override the score?

**If any listed question scores below 2, label the result “Readiness hold” and identify the failing gate.** You may continue research and bounded discovery, but this rubric does not recommend advancing to a scored shortlist or preferred-supplier decision until the gate is closed.

| Gate | Questions that must each score at least 2 | Required correction |
|---|---|---|
| Mandate and scope | Q1, Q2 | Establish accountable sponsorship and approve the first-release boundary. |
| Accountability and ongoing ownership | Q3, Q11 | Resolve process responsibilities and provide an operating owner with a funded sourcing plan. |
| Security preparation | Q7 | Approve workflow-specific security requirements and the due-diligence route. |
| Delivery capacity | Q10 | Allocate buyer-side work and document dependencies. |
| Affordability preparation | Q13 | Create the ownership-cost model and identify the funding route. |

**Illustrative result:** a team scores **39/45**, but Q7 scores zero because sensitive findings have not been classified. Its result is **“39/45 — Readiness hold: security preparation”**, not “ready to buy”. The next action is to approve the information-handling requirements, not to use the remaining points to offset the gap.

Closing a gate means producing the missing evidence and rescoring the question. It is not a verbal waiver. Any actual contractual or regulatory decision remains with the organisation’s authorised owners.

---

# Which weak area should you tackle first?

**Use domain scores to route the work; do not let the overall total obscure a weak domain.** Each domain has a maximum of nine points.

| Domain | Calculation | If this is your weakest area, produce… | Suggested accountable role |
|---|---|---|---|
| Mandate and operating model | Q1 + Q2 + Q3 | Scope charter, decision rights and responsibility matrix | Sponsor and programme lead |
| Data and migration | Q4 + Q5 + Q6 | Data dictionary, profiling results and history/evidence migration plan | Data owner and programme lead |
| Security, integrations and AI | Q7 + Q8 + Q9 | Access tests, interface specifications and AI decision record | CISO and enterprise architect |
| Delivery and operation | Q10 + Q11 + Q12 | Resource plan, operating model and user acceptance pack | Programme lead and service owner |
| Cost, contracts and exit | Q13 + Q14 + Q15 | Normalised three-year model, commercial questions and portability plan | Finance, procurement and legal |

**Our recommended priority order:** failed gates first; then zero-point answers; then the lowest-scoring domain. If two domains tie, prioritise the one blocking the earliest real decision or creating the most consequential unresolved exposure.

### What should the three-year GRC cost worksheet include?

Use the following as this desk’s modelling structure, not a market-price benchmark:

**Three-year ownership cost = one-off delivery costs + recurring external costs over 36 months + internal delivery and operating labour over the same period.**

Include:

- Software and applicable modules, user categories and usage allowances.
- Implementation, configuration, cleansing and migration.
- Integrations, API access, environments and testing.
- Training, change management, administration and support.
- Retained tools and any incremental dual-running costs.
- Renewal changes and expansion assumptions as explicit scenarios.

Separate cash expenditure from allocated internal labour, and avoid counting the same work twice. Show unknown charges as unresolved—not zero. Model exit separately unless an exit is actually planned within the three-year period.

---

# What should you do immediately after completing the quiz?

**Turn the result into an evidence backlog, not a presentation about the score.** Assign each missing item an owner, a due date and a decision it blocks.

Use this result sheet:

| Field | Your entry |
|---|---|
| Assessed workflow, entities and exclusions | … |
| Assessment date and rubric version | … |
| Raw score and band | … / 45; … |
| Mandatory gates passed or failed | … |
| Five domain scores | … / 9; … / 9; … / 9; … / 9; … / 9 |
| Three most consequential evidence gaps | … |
| Next permitted buying activity | … |
| Accountable owners and review date | … |

For each question, retain the selected option and a reference to its supporting evidence. When the score changes, record what changed—not merely the new total.

**Suggested next working session:** agree the failed-gate actions, inspect one representative migration sample, review one restricted-evidence scenario and reconcile the largest unknown cost items. This is a working agenda, not an implementation-duration estimate.

If an incumbent renewal is approaching, assess retain, repair and replace options in parallel. Do not interpret a low readiness score as a requirement to buy, or a high score as proof that replacement is preferable.

---

# What still needs checking before contract signature or go-live?

**Even 45/45 only means the buying team is prepared to evaluate.** Before contract signature, require evidence for the proposed product, configuration, implementation scope and commercial offer—not merely a completed buyer questionnaire.

This desk recommends a separate decision record confirming:

- [ ] Essential workflows and specialist requirements have been demonstrated against agreed criteria.
- [ ] Security, privacy, resilience and supplier due diligence have been completed by the appropriate owners.
- [ ] Migration and integration assumptions have been tested sufficiently to support the proposed scope and price.
- [ ] Implementation responsibilities, deliverables and acceptance arrangements are agreed.
- [ ] Funding covers the approved scope and operating model.
- [ ] Material contractual, renewal and portability issues have been resolved or formally escalated.

Before go-live, require a further release decision covering actual migrated data, user acceptance, access tests, operational support, cutover and recovery arrangements. Microsoft’s implementation guidance explicitly separates these readiness and sign-off activities; they are not replaced by a pre-purchase assessment. ([learn.microsoft.com](https://learn.microsoft.com/en-gb/dynamics365/guidance/implementation-guide/prepare-go-live-checklist))

---

# How was this quiz researched, and what are its limits?

**The rubric is an editorial synthesis of primary guidance and implementation documentation.** Regulatory and professional sources inform governance questions; vendor documentation supplies concrete examples of technical and commercial dependencies. Supplier sources establish what those sources document, not independent proof of delivery outcomes.

The research also reviewed industry coverage, employer/job-board material and practitioner recordings to identify practical questions. Those channels were not used to invent staffing ratios, market prices, implementation timelines or success rates.

For current professional context, the IIA’s refreshed Three Lines materials were published on **8 July 2026**, and NIST SP 1308 reached final publication on **23 March 2026**. Older foundational sources remain identified by their own dates rather than being presented as newly published research. ([theiia.org](https://www.theiia.org/en/resources/statements-of-position))

The quiz does not determine which laws apply to your organisation, validate an entire migration estate from a small sample, or certify any supplier. Sector-specific interpretation belongs with your legal, compliance, security and assurance specialists.

---

# Sources

1. **KPMG — Implement GRC Technology the Right Way**, 2024. GRC process preparation, migration, testing and support. `https://kpmg.com/kpmg-us/content/dam/kpmg/pdf/2024/implement-grc-technology-right-way.pdf`
2. **NIST SP 1301 — Creating and Using Organisational Profiles**, 26 February 2024. Current/target outcomes and prioritisation. `https://csrc.nist.gov/pubs/sp/1301/final`
3. **The IIA — Statements of Position**, including the Three Lines statement published 8 July 2026. Accountability, coordination and independence safeguards. `https://www.theiia.org/en/resources/statements-of-position`
4. **The IIA — Three Lines Model: Assurance and Advice in Support of Effective Governance**, 2026. Full statement. `https://www.theiia.org/globalassets/site/resources/statements-of-position/tlm_assurance_advice_support_effective_gov_en.pdf`
5. **IBM OpenPages 9.1.x — Supported Migration Items.** Configuration, instance data and relationship migration distinctions. `https://www.ibm.com/docs/en/openpages/9.1.x?topic=environments-supported-migration-items`
6. **NIST — Cybersecurity Framework 2.0**, 26 February 2024. Governance, identity and access-control outcomes. `https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf`
7. **LogicGate — Risk Cloud API Troubleshooting Guide.** Authentication and authorisation failure examples. `https://www.logicgate.ai/developer/api-troubleshooting-guide/`
8. **NIST AI 600-1 — Generative Artificial Intelligence Profile**, July 2024. Evaluation, source verification and limits on capability claims. `https://doi.org/10.6028/NIST.AI.600-1`
9. **NIST SP 1308 — Cybersecurity, Enterprise Risk Management, and Workforce Management Quick-Start Guide**, final 23 March 2026. Risk-informed workforce planning. `https://csrc.nist.gov/pubs/sp/1308/final`
10. **ServiceNow — Certified Implementation Specialist, Risk and Compliance Exam Blueprint**, updated January 2026. Configuration, implementation and maintenance competencies. `https://learning.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0011655`
11. **Microsoft Learn — Use the Go-Live Checklist to Make Sure Your Solution Is Ready.** Dynamics 365 guidance used only for transferable implementation practices. `https://learn.microsoft.com/en-gb/dynamics365/guidance/implementation-guide/prepare-go-live-checklist`
12. **Federal Reserve, FDIC and OCC — Third-Party Risk Management: A Guide for Community Banks**, May 2024. Planning, due diligence, contracting, monitoring and termination. `https://www.occ.gov/news-issuances/news-releases/2024/pub-third-party-risk-management-guide-for-community-banks.pdf`
13. **LogicGate — Risk Cloud API: Getting Started**, page labelled updated 20 January 2023. Published API-access add-on statement; actual offer terms require confirmation. `https://www.logicgate.ai/developer/risk-cloud-api-getting-started/`