Table 1 Classification criteria for governance operating patterns
Minimum criteria (rubric indicator) | Compliance-driven | Framework-centric | Risk-based | Exposure-driven |
|---|---|---|---|---|
Decision cadence | Periodic audit cycles | Periodic reviews/ISMS cycles | Risk review cycles + triggers | Continuous/near-real-time |
Primary evidence | Audit artifacts, checklists | Control maps, assurance evidence | Risk registers, scenario rationale | Exposure closure evidence, KRIs/KPIs |
Telemetry use | Limited (evidence collection) | Selective monitoring to support controls | Telemetry informs likelihood/impact | Telemetry-first: asset/exposure signals |
Automation posture | Supports compliance workflows | Supports control maintenance | Guided by risk prioritization | Bounded automation with approval gates |