{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","download":{"releaseId":"sha256:bce9657225cd01598d10e901416f1aedcc06fe22a5b2aa418dc3d393cc8c3dfd","slug":"grc-technology-investment-project-risk-governance","url":"/assets/agent_workflow-grc-technology-investment-project-risk-governance-4a4df67f.00760aa9ff4d239b.json"},"kind":"record","record":{"attributes":{"department":"executive","domain":"grc","lineOfDefense":"operate"},"canonicalUrl":"https://workflow-library.com/all/?w=grc-technology-investment-project-risk-governance","description":"Technology Investment & Project Risk Governance as a decision-aware checkpoint graph, run as a recurring workflow instance attached to the existing Process item for the technology-investment / portfolio-governance process (process_type: business_process) — each quarterly board cycle enriches that standing process record rather than creating a new one. In the cycle the investment board refreshes its criteria, scores and prioritizes the technology and innovation portfolio, routes the annual capital-planning leg that allocates security funding to the risk strategy, monitors in-flight value and reprioritizes or terminates where value is not realized, and enforces security-risk sections in every project gate with ERM-linked artifacts. In scope: the quarterly technology investment-board review (always), the annual capital-planning and security-budget leg (when the funding and staffing envelope must be set or re-planned this cycle), and every project stage gate falling due. Out of scope: individual project execution and delivery mechanics and day-to-day security operations. The cycle consumes the ERM cyber-risk register (Risk items, category: cyber_security) and the approved program business cases as standing inputs, and produces a board decision record and evidence pack as its named deliverable. There is no downstream workflow hand-off, so cross-references are recorded as linked records (Issue ↔ Risk) rather than routed onward; the scored portfolio, in-flight programs, and stage-gated projects have no native item type and live as step documents.","details":{"canonicalUrl":"https://workflow-library.com/all/?w=grc-technology-investment-project-risk-governance","capabilities":[],"controls":["UC-GOV-13","UC-GOV-11","UC-RISK-02"],"domains":["grc"],"lineOfDefense":"operate","mappingStatus":"mapped","releaseId":"sha256:bce9657225cd01598d10e901416f1aedcc06fe22a5b2aa418dc3d393cc8c3dfd","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:grc-technology-investment-project-risk-governance","standards":["cobit-2019","nist-csf-2","iso-31000","nist-800-53"],"teams":["executive","it"]},"id":"wf:G19","mapUrl":"https://controlsmap.com/?v=1&node=wf%3AG19","slug":"grc-technology-investment-project-risk-governance","sourceIds":["cobit-2019","iso-27001","iso-31000","nist-800-53","nist-csf-2"],"sourceUrl":null,"title":"Technology Investment & Project Risk Governance","type":"workflow"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3fbd82239f6df500432f0929dddfc1afeaf65cab4eacf1becc54aa55906a1cfc","properties":{},"sourceDetailPath":"/data/v1/records/wf-g19-77005a54.json","sourceId":"wf:G19","targetDetailPath":"/data/v1/records/uc-uc-gov-11-a13b60d3.json","targetId":"uc:UC-GOV-11","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8f038209b94c562feb26a8f4ae53f6dfe7e687e7f6549121eb205561c83cdf0c","properties":{},"sourceDetailPath":"/data/v1/records/wf-g19-77005a54.json","sourceId":"wf:G19","targetDetailPath":"/data/v1/records/uc-uc-gov-13-81b348eb.json","targetId":"uc:UC-GOV-13","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a20e813c4558411644b1958078da25ef79cb8c9959abae7d8baca26e28f6bd07","properties":{},"sourceDetailPath":"/data/v1/records/wf-g19-77005a54.json","sourceId":"wf:G19","targetDetailPath":"/data/v1/records/uc-uc-risk-02-0f8519bb.json","targetId":"uc:UC-RISK-02","type":"operates"}],"schemaVersion":1}