Business Catalog
The layer that makes everything else mean something
Domain, capability, service and process, with objectives above them and an exhaustive link web below, so a control failure can be traced to the business service it affects.
- Domain, capability, service and process hierarchy
- Business objectives linked to capabilities, services and processes
- Typed links to risks, controls, policies, findings and assessments
- Business dependencies modelled explicitly
In the application · Govern
- Domains
- Capabilities
- Services
- Processes
- Dependencies
- Governance events
- PaymentsDomain
- Card acquiringCapability3 risks2 policies
- Merchant settlementService4 controls2 assets
- Daily reconciliationProcess1 risk2 controls1 finding
Every level links out to risks, controls, policies, findings, assessments, and assets
Linkage
Impact answered structurally
Because each level carries typed links, questions like which objectives depend on this process, or which services this asset supports, are queries rather than investigations.
- Objective links to capabilities, services, processes and org entities
- Process and service links to assets, risks, controls and findings
- Capability links to risks, policies, controls and assessments
- Governance events recorded against the catalog
Control
Privileged access is reviewed each quarter by the system owner
PPTDF applicability
One owner · one procedure · one evidence trail
Executive drill-down
Walk from a service outage to the objective it endangers
The executive view walks the catalog and its links as a journey: pick a process, see the assets under it, the risks on it, the controls that protect it and the objectives above it, with impact analysis along the path.
- Journey view from any catalog node in either direction
- Impact analysis across assets, risks and controls
- Catalog nodes owned by named people with RACI
- Same links drive the relationship panels on every record
- StrategyTechnology & cyber resiliencev3 · published
- ObjectiveResidual cyber risk within appetiteweight 10% · 2 risks
- InitiativeCyber defence modernisationfunded · on track
- ProjectPAM completionmilestone 31 Oct
- TaskMigrate service accountsdue Friday
- PersonSarah Whitfieldassignee
Framework alignment
Works with your control frameworks
This module shares the platform control library. International standards, sector regulations and your own internal standard are loaded the same way and mapped to one another, wherever you operate.
See the business catalog in your environment
A walkthrough scoped to your entities, your frameworks, and the way your programme is actually run.