Capability / ControlLedger
Risk & governance
Move from broad concerns to decisions someone can own.
Who can decide, accept and escalate?
Describe the scenario before choosing the response. Identify the information affected, the operating conditions and the consequences that matter. Establish who can approve treatment, who can accept the remaining uncertainty and which changes should trigger review.
The record we want to leave
A decision someone else can follow.
A treatment decision with an owner, rationale, review trigger and dependencies.
We keep the boundary, assumptions and unresolved questions visible. An output is useful when it helps the next person make or review a decision.
Before the work begins
Does this depend on a certification project?
No. The example service model supports broader information security governance and assurance. If certification is an objective, it must be addressed within a separately agreed scope.
What information would be needed first?
A description of the services and information involved, the decision to be made, relevant responsibilities and any known constraints. Avoid including sensitive evidence in an initial brief.
A focused starting point
What needs to become clearer?
Capture the review question, the systems involved and the decision you need to make.
A browser-local example. Nothing is submitted.