Sources

Sources below support the inline evidence. Older publications are retained where they remain relevant; release-specific documentation must be checked against the version and terms actually proposed to the buyer.

Expert identification and practitioner perspectives

1. GRC 20/20 — Michael Rasmussen biography: https://grc2020.com/person/michael-rasmussen/
2. OCEG — Carole Switzer: https://www.oceg.org/carole/
3. Norman Marks — About Norman: https://normanmarks.wordpress.com/about/
4. GRC Engineer — Build vs. Buy: We Did Both. Here’s What We Learned: https://grcengineer.com/p/build-vs-buy-we-did-both-here-s-what-we-learned-rsac-2026-talk-summary/
5. Gregory and Maria Rasner — Speaker kit: https://rasner.com/speaker-kit/
6. NIST — Apostol Vassilev: https://www.nist.gov/people/apostol-vassilev

Operating model, delivery and commercial evidence

7. OCEG — What is GRC?: https://www.oceg.org/ideas/what-is-grc/
8. Deloitte — From Implementation to Adoption and Beyond, 2026: https://www.deloitte.com/content/dam/assets-zone3/us/en/docs/services/audit-assurance/2026/aa-optro-placemat-0402.pdf
9. Optro — Rebrand announcement, 9 March 2026: https://optro.ai/blog/auditboard-is-now-optro
10. IBM — OpenPages supported migration items: https://www.ibm.com/docs/en/openpages/9.1.x?topic=environments-supported-migration-items
11. IBM — Migrating OpenPages environments: https://www.ibm.com/docs/en/openpages/9.1.x?topic=guide-migrating-openpages-environments
12. Archer — Managing Data Feeds, version-specific documentation: https://help.archerirm.cloud/platform_2025_04/en-us/content/platform/integration/int_dfm_managing.htm
13. First Horizon recruitment listing — Senior GRC Administrator: https://recruiting.ultipro.com/FIR1007FTN/JobBoard/c005ef3e-175a-49c4-ba29-9f431f673944/OpportunityDetail?opportunityId=3d3259bf-0bb5-474b-8eb4-639fe8f63a6b
14. ServiceNow — IRM entitlements, effective 1 May 2025: https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/other-document/entitlements/PROD12020.pdf
15. Archer — Export Assessment in Engage, updated 1 July 2026: https://community.archerirm.com/hc/en-us/articles/52147245311379-Export-Assessment-in-Engage-is-Live

Assurance, risk and regulatory sources

16. NIST — IR 8286C Revision 1, December 2025: https://csrc.nist.gov/pubs/ir/8286/c/r1/final
17. PCAOB — AS 1105, Audit Evidence: https://pcaobus.org/oversight/standards/auditing-standards/details/AS1105
18. The IIA — Statements of Position, including July 2026 updates: https://www.theiia.org/en/resources/statements-of-position
19. The IIA — Three Lines Model: Assurance and Advice in Support of Effective Governance: https://www.theiia.org/globalassets/site/resources/statements-of-position/tlm_assurance_advice_support_effective_gov_en.pdf
20. Federal Reserve — SR 24-2, community-bank third-party risk guide and status: https://www.federalreserve.gov/supervisionreg/srletters/SR2402.htm
21. Federal Reserve — Third-Party Risk Management: A Guide for Community Banks: https://www.federalreserve.gov/frrs/guidance/third-party-risk-management-a-guide-for-community-banks.htm
22. Federal Reserve — Proposed third-party risk management guidance, 11 September 2026: https://www.federalreserve.gov/newsevents/pressreleases/bcreg20260911a.htm
23. HHS — HIPAA Security Rule NPRM: https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/index.html
24. Reginfo.gov — Unified Agenda search results for RIN 0945-AA22: https://www.reginfo.gov/public/Forward?Image61.x=19&Image61.y=7&SearchTarget=Agenda&textfield=0945-AA22+
25. NYDFS — Cybersecurity Resource Center: https://www.dfs.ny.gov/industry_guidance/cybersecurity
26. NYDFS — Covered-entity implementation timeline: https://www.dfs.ny.gov/system/files/documents/2023/11/cybersecurity_implementation_timeline_covered_entities.pdf

AI evaluation and security

27. NIST — Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile: https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf
28. NIST — Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations, March 2025: https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2025.pdf