Definitions

Every governance artifact this site describes, in one catalogue. An artifact has one page however you arrive at it: the title is the name used here, and the header lists the names Gemara, ISO/IEC 27001 and ISO/IEC 42001 give it. Those three pages are views onto this same set, in each standard's own vocabulary.

As discussed in the Governance Twin Factor, your governance definitions should be created as a set of structured entities, managed alongside the sensitive activity in question. For machine-readable shapes, see the Gemara schemas.

1DefineWhat good looks like

Organisation ContextPrincipleVectorGuidanceStakeholder RequirementAIMS ScopeManagement Objective

2AssessWhat could go wrong and what would stop it

CapabilityThreatApplicability ProfileControl

3DecideWhat we accept and what we require

RiskRisk AssessmentImpact AssessmentPolicy

4OperateThe activity and resources being governed

Sensitive ActivityGoverned ResourceAI SystemDatasetTool ResourceIncident

5EvaluateWhether the requirements are met

Evaluation LogManagement Review

6EnforceWhat happens when they are not

Enforcement LogCorrective Action

7AssureEvidence the whole thing works

Audit LogAudit ProgrammeReporting Obligation

Cross-cuttingReferenced from every band

Party RegisterCompetence RecordCommunication RequirementSupplier AssuranceGovernance Contract