Framework · Our IP
Reusable governance assets, not slideware.
Every engagement configures the same governance system: six assets that span data and AI. The signature asset is the unified control crosswalk, where one control is evidenced once and mapped to every regime it supports.
Six assets
The same system, configured for each client.
- IP · REF-ARCH
Reference architecture
The standard governance model across data and AI: structure, control layers, lifecycle gates and operational integration.
- IP · RSK-TAX
Data and AI risk taxonomy
Domains, categories and scenarios across data and AI, scored for inherent and residual risk and mapped to controls.
- IP · CTL-LIB
Control library
Specified, testable controls with implementation guidance, evidence requirements and maturity criteria for each.
- IP · LIFE-CYC
Lifecycle framework
Governance gates from data intake through model design, validation, deployment, monitoring and retirement.
- IP · MAT-MOD
Maturity model
A one-to-five scale across risk, control, lifecycle, monitoring and regulatory alignment for data and AI.
- IP · ASSESS-KIT
Assessment toolkit
Interview guides, evidence-based scoring matrices and heatmaps that produce findings a board can read.
Signature IP · LOOP-05
The unified control crosswalk.
Most organizations evidence the same control several times, once for each standard or regulation. In the crosswalk, a control such as sensitive-data access is defined once, evidenced once and mapped to each regime it supports. The sample below is illustrative.
| Control | ISO/IEC 42001 | NIST AI RMF | EU AI Act | DAMA-DMBOK | DCAM | CDMC |
|---|---|---|---|---|---|---|
| CTL-07 Sensitive-data access and purpose | Mapped | Mapped | Mapped | Mapped | Mapped | Mapped |
| CTL-12 Training-data lineage and provenance | Mapped | Mapped | Mapped | Mapped | Mapped | Mapped |
| CTL-21 Subject erasure across data and models | Mapped | Mapped | Mapped | Mapped | Mapped | Mapped |
Mapping is illustrative of method; it is not a statement of certification or legal compliance.
DCAM and CDMC. aerais maps to DCAM and CDMC. It does not reproduce EDM Council proprietary content.
Using the crosswalk
What it changes in practice.
- One test per control. A control is tested once, and the result is reused for each mapped regime.
- Gaps are visible. A requirement with no mapped control, or a control with no evidence, shows up as a gap rather than a surprise during review.
- Change is manageable. When a standard or regulation changes, the affected mappings are updated, not the whole program.
Confirm current requirements with counsel and the relevant regulators. The crosswalk organizes evidence; it does not interpret the law.
Maturity model · MAT-MOD
A five-level scale for data and AI governance.
Assessments score each domain on the same scale, so progress can be compared over time and across data and AI.
- Initial. Practices are ad hoc and depend on individuals.
- Emerging. Policies exist, with uneven adoption.
- Established. Defined controls and owners operate consistently.
- Managed. Controls are measured, tested and reported.
- Optimized. Evidence drives continuous improvement.
FAQ
Frequently asked questions
What is a unified control crosswalk?
A control library in which each control carries its mappings to the standards and regulations it supports. A control is evidenced once, and that evidence is reused wherever the control is mapped.
Does mapping a control mean it satisfies a regulation?
No. Mapping shows where a control is relevant to a requirement. Whether a requirement is met is a judgment for your counsel, auditors and regulators.
Do you reproduce DCAM or CDMC content?
No. aerais maps to DCAM and CDMC and does not reproduce EDM Council proprietary content.
Contact
Make your data and AI provable.
Start with a diagnostic: current-state maturity, risk exposure and a prioritized roadmap. We aim to reply within two business days.