GRC Knowledge Model

Purpose

This section turns the ISO learning notes into a future compliance/evidence software model.

Do not build the SaaS yet. Build the knowledge model first.

Core entities

• Organization
• Asset
• Threat
• Vulnerability
• Risk
• Treatment
• Control
• Evidence
• Audit
• Finding
• Corrective Action
• Supplier
• Incident
• Policy
• Procedure
• Training
• Review

Core model notes

• Dataview Dashboard Index
• Dataview Home
• Asset Threat Vulnerability Risk Control Evidence Data Model
• ISO 27001 Implementer Auditor ISO 27005 Mapping
• A.5 Controls Implementation Audit Risk Mapping
• A.6 People Controls Implementation Audit Risk Mapping
• A.7 Physical Controls Implementation Audit Risk Mapping
• A.8 Technological Controls Implementation Audit Risk Mapping
• Risk and Control Mapping Table
• Evidence Request List

Query-first example

• ISO27001-A.5.7-Threat-Intelligence
• RISK-0001-Customer-Data-Compromise-Ransomware
• AQ-0001-Audit-Question-Threat-Intelligence

Design rule

Every serious note should eventually answer:

1. What object does this create?
2. What evidence proves it exists or operates?
3. Who owns it?
4. How often is it reviewed?
5. What audit question tests it?