Governance Documentation

Security governance documentation should steer security choices and tell you whether operations are effective. In practice, it does neither.

Four layers, four audiences, invariants at every level. A model for documentation that steers choices and tells you whether operations are effective.

Your engineers define infrastructure as code. Your security governance lives in a Word document. The four-layer model makes it possible to close that gap.