Prove your client is in control
Your clients are asked to run a governance, risk and compliance program, and most can’t staff one. Predictive GRC builds it from what the fabric already sees and runs it month after month. When something happens that could affect your client, it proposes the risk before it turns into an incident. Trust Center, built on it, shows your client’s customers what it can prove.
Your vCISO and your client’s owner approve what it drafts, so governance becomes a service you can run across your whole book.
06:12 · Payroll provider files a breach notice
Along the fabric to the clients that use it
Harbor Lending · risk registerNorthgate IT
- ProposedPayroll provider’s app can read every staff profile07:34 · evidence: the app’s permissions · 314.4(f)AcceptEditReject
- Not metMFA registered by 41 of 60 staff, required of nobodyRead from Entra · 314.4(c)(5)
- TreatingA lookalike domain aimed at the finance teamOwner approved: MFA for finance first
- ClosedExploited flaw on the VPN gatewayConfirmed fixed by two checks
Module 1 of 2
Predictive GRC
Predictive GRC starts from what the fabric already knows about your client, asks only for what it can’t see, and keeps the program current as the evidence changes. Your vCISO and your client’s owner make every decision.
- Covers
- Governance, risk and compliance
- Needs
- Your client confirms its suppliers and approves changes
- Lands in
- Your client’s registers, evidence packs and board report
Follow one client through Predictive GRC
Harbor Lending, a fictional 60-person mortgage broker, is protected by Northgate IT, a fictional MSSP. This is its program from the first day. The fabric does the reading, and a person makes every decision.
01Observe
The day you add Harbor Lending, Predictive GRC drafts its supplier register from what the fabric already holds.
Six suppliers, four of them never listed. Your client only has to confirm them.
02Map
Each rule that applies is mapped once, to one set of controls.
One test of MFA answers the FTC Safeguards Rule, the insurer’s form and a lender’s questionnaire.
03Test
Every control is tested against evidence, not answered yes or no.
MFA fails: registered by 41 of 60 staff and required of nobody, while the access policy says everyone. An amendment is drafted.
04Predict
At 06:12 the payroll provider files a breach notice. By 07:34 Harbor has a proposed risk.
It comes with the evidence and the reason it applies: the provider’s app can read every staff profile.
05Approve
Your vCISO accepts it, and Harbor’s owner approves the treatment.
The supplier register, the policies and the board report follow. Nothing changes without a named person.
06Prove
Harbor’s customers see what it can prove, on a Trust Center under your brand.
Every statement is dated and tied to evidence. MFA stays held back until practice matches policy.
Two ways to run a risk and compliance program
The usual way starts from a questionnaire and a library of templates, and records what your client says.
| The usual way | Predictive GRC | |
|---|---|---|
| Starts from | What your client remembers to say | What the fabric already observes, before anyone types a word |
| Suppliers | A spreadsheet your client fills in once | Found from evidence, confirmed by your client, and watched for as long as the relationship lasts |
| Risk register | Written for the annual review | Proposed as things happen, each risk with its evidence and the reason it applies |
| Controls | Answered yes or no | Tested against evidence: met, not met or can’t be evaluated, with a date |
| Policies | Templates | Your client’s own policies, tested against what actually happens |
| When something changes | Nobody knows until the next review | The register and policies follow within hours, and a Trust Center statement comes down as soon as its evidence lapses |
| Who does the work | Your vCISO writes it | Your vCISO and your client’s owner approve it |
From an event in the fabric to a proposed risk
- Something happensA breach, an outage, an insolvency or a newly exploited flaw
- Recorded onceOn the company it happened to, and dated
- Along the fabricTo everyone who depends on it or runs the same thing
- Does it apply?Tested rules decide, worked out for your client alone. If not, nothing is proposed
- Proposed riskWith its evidence and the reason it applies
- A person decidesYour vCISO accepts, edits or rejects it
- Everything followsThe register, the policies, the Trust Center and your view
- Kept under watchRe-tested as the evidence changes
When something happens at one point in the fabric, such as a breach at a supplier your client depends on, a newly exploited flaw in software it runs, enforcement against a firm like it or a new rule that will apply to it, it becomes a proposed risk with its evidence and the reason it applies. Each warning comes from a tested rule, worked out for your client alone, so you can see exactly why it applies.
A fast-moving event, such as a supplier breach, becomes a proposed risk within hours. A new or changed regulation, within a day.
A named person approves every change
| Who | What they do | What they get |
|---|---|---|
| Your vCISO | Reviews proposed risks, suppliers, policy amendments and questionnaire answers, sets how each risk is treated and runs the quarterly review | One queue across every client, and work to bill for |
| Your client’s owner | Confirms suppliers and scope, approves treatment and policy changes, accepts a risk until a set date, approves anything published or sent, and signs the annual report | A register they can show a board, a regulator, an insurer or a customer |
| Outerwall reviewer | Works the review queue every day: uncertain supplier matches, companies with similar names, events that need a person | Fewer wrong matches reaching you |
| Outerwall curator | Writes, cites and versions the library of rules and control mappings | A named person accountable for every mapping |
Nothing enters the register, changes a policy, goes on the Trust Center or is sent to a supplier without a named person approving it.
One set of controls, many rules
Every obligation maps to a control on one backbone, the 56 basic safeguards in CIS Controls IG1, so one test of MFA serves every rule that asks for it.
| Framework | Who it applies to | What it produces |
|---|---|---|
| FTC Safeguards Rule | Mortgage brokers and lenders, tax preparers and finance companies | An evidence pack mapped to 16 CFR 314 |
| NYDFS Part 500 | Banks, insurers and other firms licensed by New York’s financial regulator | Evidence mapped to the sections of Part 500 it supports |
| SEC Regulation S-P | Investment advisers and broker-dealers | Service provider oversight and incident response evidence |
| HIPAA Security Rule | Medical and dental practices | Evidence for the technical safeguards |
| NCUA Part 748 | Federally insured credit unions | Evidence for the information security program |
| State insurance data security laws | Insurers in states that adopted the NAIC Insurance Data Security Model Law | Evidence for the information security program, third-party oversight and board reporting |
| NIS2 | Medium and large organizations in critical sectors in Ireland and the EU, MSPs and MSSPs among them | Evidence for risk management, supply chain security, vulnerability handling and board oversight |
| DORA | Banks, insurers, investment firms and other financial entities in the EU | A supplier register to start the register of information from, and testing evidence |
| GDPR | Any organization that handles personal data in the EU | Evidence that security is regularly tested, and oversight of processors |
| ISO 27001 | Organizations going for certification | A Statement of Applicability drafted from evidence, as an extra |
Predictive GRC never certifies anyone and never says a client is compliant. Packs say what the evidence shows, and when.
Module 2 of 2
Trust Center
Your client’s customers, lenders and insurers see what it can prove, on a page on its own domain under your brand. It’s built on Predictive GRC, so every statement comes from a claim your client has approved.
- Covers
- What your client tells customers, lenders and insurers
- Needs
- Predictive GRC, and your client’s approval of every statement
- Lands in
- A page on your client’s own domain, under your brand
Every statement backed by evidence, or held back
Each statement is dated and tied to evidence, and it comes down the moment that evidence lapses. Live control states, scores and exposure findings never appear on it.
When a questionnaire arrives, the answers are drafted from the same approved claims and live evidence, for your client to approve, and each answer sent is kept with who it went to.
Why it matters: in 2022 Travelers asked a court to rescind a client’s cyber policy, because the application said MFA protected email, remote access and servers when it was only on the firewall. Source: Reed Smith, July 2022.
trust.harborlending.exampleunder your brand
- Customer data encrypted at restEvidenced Oct 3, 2026
- Suppliers reviewed and watchedEvidenced Oct 3, 2026
- Annual penetration testEvidenced Sep 12, 2026, through Validate
- MFA required for every accountHeld back until the evidence supports it
A statement whose evidence lapses comes down without waiting for anyone.
Governance your team can bill for, without writing it
Work you can bill for
- A vCISO retainer, built around the quarterly risk review
- A managed Trust Center and questionnaire service
- Supplier reviews, for new critical suppliers and yearly for the rest
- Policy review and ISO 27001 readiness
- The annual board report and insurance renewals
- Fixes that answer a line in your client’s own register
What it isn’t
- An audit or a certification. The certification body audits
- A library of template policies
- A security operations center
- A way to sell anything that doesn’t answer your client’s own register
See it on your own clients.
Start with your own domain, then turn it on for one client and see the register, controls and evidence pack it builds.