Baseline estate posture — routine drift, no active major incident.
6 agents streaming

Risk & Compliance

Framework coverage, control status, evidence and the enterprise risk register with remediation dates.

Compliance score

60%9/15 controls

Risk heatmap

I1I2I3I4I5L5
2
1
1
L4
3
1
1
L3
2
1
1
L2
1
1
L1
1
1
1

Remediation

  • Risks tracked18
  • Critical3
  • Past due date3
  • Accepted3

Risk register (18)

RiskAssetCategoryL × ISeverityTreatmentOwnerDueFrameworks
Hallucinated advice reaching customersDocument Extraction Serviceai5 × 4criticaltransferS. Nakamura2026-08-28SOC 2 Type II, GDPR
Key rotation gaps in payments pathCRM Corecyber4 × 5criticalmitigateM. Haddad2026-11-19ISO 27001, SOC 2 Type II
Privileged access sprawlReporting Warehousecyber4 × 4criticalmitigateL. Marchetti2026-12-03EU AI Act
Unregistered AI usage bypasses governanceBackup & Recoveryai5 × 3warningmitigateA. Petrova2026-12-16NIST AI RMF, ISO 27001
Cross-border data transfer exposureContainer Platformregulatory3 × 4warningtransferC. Iversen2027-01-14GDPR
Single-region dependency for billingReporting Warehouseoperational5 × 2warningacceptA. Petrova2026-12-28SOC 2 Type II, ISO 27001
Shadow MCP connection to internal APIService Deflection Assistantcyber5 × 2warningmitigateE. Moreau2026-09-10NIST AI RMF, SOC 2 Type II
Insufficient human oversight at high autonomyElement Managerai2 × 5warningmitigateL. Marchetti2026-08-14SOC 2 Type II, EU AI Act
Ransomware exposure on file estateCRM Corecyber3 × 3warningmitigateM. Haddad2027-01-16NIST AI RMF, SOC 2 Type II
Model provider concentration riskAccess Aggregationthird-party4 × 2informationalmitigateM. Haddad2026-12-13EU AI Act, GDPR
Legacy platform end-of-supportPartner B2B Gatewayoperational4 × 2informationalmitigateA. Petrova2026-11-25NIST AI RMF, PCI DSS
Change failure rate above appetiteEvent Streaming Busoperational4 × 2informationalmitigateE. Moreau2027-01-24PCI DSS, ISO 27001
Token cost overrun on AI programmeMonitoring Platformoperational2 × 4informationalmitigateC. Iversen2027-01-04ISO 27001, SOC 2 Type II
Insufficient audit evidence for AI decisionsKnowledge Search (RAG)regulatory3 × 2informationalmitigateE. Moreau2026-08-22ISO 27001, EU AI Act
Third-party settlement feed reliabilityNetwork Inventorythird-party3 × 2informationalmitigateL. Marchetti2026-10-16PCI DSS, GDPR
Agent over-permissioning on billing toolsEvent Streaming Busai1 × 5informationalacceptD. Okonkwo2026-12-17EU AI Act, PCI DSS
Incomplete DPIA for a customer-facing modelERP Financialsregulatory1 × 4informationalmitigateE. Moreau2026-10-17ISO 27001, PCI DSS
Retrieval corpus contains stale policyMobile App Backendai1 × 3informationalacceptC. Iversen2026-09-18PCI DSS, ISO 27001

Controls & evidence (15)