Search and the popup inspector require JavaScript. All element descriptions remain available below.
ACT-01 · EDM01: Accountable Governance Who holds the authority to accept risk, approve spend, or sign off on AI use?
Kernel rule separating preparation (Operators/FDSEs) from non-delegable risk and scope decisions (Accountable Owner).
Failure to avoid: Allowing shared admins or external consultants to silently accept risk exceptions without owner sign-off.
Evidence example: L3: Authenticated owner decision record bound to scope revision + step-up verification (AAL2).
Accountable role: Accountable Owner (AAL2)
ACT-02 · DSS04: Continuity & Restore Proof If devices or servers are wiped today, can we restore critical data within our survival window?
Verifies offline/immutable backup isolation and measures actual restoration time against acceptable loss limits.
Failure to avoid: Assuming backup job "Success" emails mean data can actually be restored under ransomware or hardware loss.
Evidence example: L3: Timed restore test log + integrity digest; decays to Needs Review after 90 days or storage change.
Accountable role: Owner / IT Operator
ACT-03 · APO12: Dynamic Risk & Loss Ledger Which concrete loss scenarios can halt our operations, and what controls currently hold them back?
Links loss scenarios directly to scoped assets, active controls, and explicit owner risk-acceptance expirations.
Failure to avoid: Static spreadsheet risk registers that remain "Green" even after the underlying control fails or expires.
Evidence example: L2/L3: Linked control state graph; risk automatically re-opens if supporting evidence ages out or fails.
Accountable role: Owner / Risk Lead
ACT-04 · MEA02: Evidence & State Qualification Did someone merely claim this works (L0), or do we have fresh, independent proof (L3)?
Enforces the L0→L3 provenance ladder and PASS / PARTIAL / FAIL / NOT-ASSESSED states across all modules.
Failure to avoid: Treating self-reported questionnaire answers or policy drafts as verified control effectiveness.
Evidence example: L3: Scoped check plan + observed result + provenance timestamp + freshness window.
Accountable role: Verifier / FDSE / Owner
ACT-05 · MEA03: Obligation & Atlas Crosswalk Which legal, contractual, or framework requirements apply to us—and what shared evidence satisfies them?
Maps verified operational evidence across cataloged instrument clauses (ISO, SOC 2, NIS2, HIPAA, DORA) as an overlay.
Failure to avoid: Running duplicate compliance projects for each framework instead of collecting evidence once at the operational source.
Evidence example: L2/L3: Versioned applicability scope + linked control evidence with explicit coverage limits.
Accountable role: Compliance Lead / FDSE
ACT-06 · MEA04: Defensible Audit & History Pack Can we reconstruct what was operating, what failed, and what was known at a specific point in time?
Produces bounded, append-only historical snapshots showing state transitions, exceptions, and supporting artifacts.
Failure to avoid: Overwriting past failures or scrambling for unverified screenshots weeks before an external review.
Evidence example: L3: Time-bounded export package with append-only revision chain and SHA-256 byte integrity.
Accountable role: Auditor / FDSE / Owner
ACT-07 · EDM02: Objectives & Loss Boundaries What must never stop working, and how much administrative effort can we realistically sustain?
Establishes the organization or household North Star priorities, unacceptable losses, and maintenance load budget.
Failure to avoid: Adopting 40 complex controls that exceed available staff time until everything degrades into shelfware.
Evidence example: L1/L2: Signed scope contract declaring crown-jewel outcomes and explicit administrative load ceiling.
Accountable role: Owner / Executive
ACT-08 · APO02: Sequenced 30/90-Day Plan In what exact order should we stabilize our IT and security gaps over the next 30 to 90 days?
Uses practitioner playbooks to sequence foundational fixes before advanced tooling.
Failure to avoid: Buying advanced detection tools before basic asset inventory, MFA, and backups are working.
Evidence example: L2: Prioritized work queue with assigned owners, dependency order, and scheduled check dates.
Accountable role: CIO / CISO / FDSE
ACT-09 · APO04: Time-Boxed Pilot & Trial Gate How do we trial a new AI workflow or software tool safely with an automatic review deadline?
Permits bounded innovation under a Limited-Trial decision record with restricted data scope and mandatory expiry.
Failure to avoid: Temporary "quick pilots" quietly becoming permanent production dependencies without security review.
Evidence example: L2: Signed Limited-Trial record with automatic re-open trigger on nextReview date.
Accountable role: Owner / Approver (AAL2)
ACT-10 · APO08: Multi-Depth Role Translation Can the owner, the daily operator, and the technical engineer read the same truth in their own language?
Presents identical underlying state across Plain Human, Operator, and Technical registers without altering facts.
Failure to avoid: Technical jargon hiding critical risks from decision-makers, or executive summaries hiding broken controls.
Evidence example: L1: Deterministic view rendering bound to the same underlying SQLite state records.
Accountable role: All Roles
ACT-11 · APO01: Practice-Aligned Working Rules Do our written policies match how our people actually work, or are they fiction?
Drafts concise operational rules from the working-template collection and reconciles them against observed daily practice.
Failure to avoid: Maintaining boilerplate policies that contradict actual IT procedures and fail under auditor interview.
Evidence example: L2/L3: Versioned policy document + Policy-vs-Practice reconciliation check.
Accountable role: Operations / HR / IT
ACT-12 · MEA01: Freshness & Drift Telemetry Which of our previously verified controls have aged out or drifted because our environment changed?
Monitors evidence age, missed check cadences, and contextHash shifts without inventing composite vanity scores.
Failure to avoid: Static dashboards showing 100% green based on checks performed 14 months ago under a different setup.
Evidence example: L3: Live aging & context-drift state transitions visible in Posture Telemetry.
Accountable role: Owner / CISO / FDSE
ACT-13 · APO05: Capacity & Load Budgeting Do we have the time and skill to maintain these controls, or do we need to narrow scope or add help?
Tracks recurring maintenance burden against team bandwidth and flags when an arrangement exceeds capacity.
Failure to avoid: Assigning 20 hours/week of manual log review to a part-time office manager.
Evidence example: L2: Declared setup + recurring effort budget matched to named owner capacity.
Accountable role: Owner / COO / FDSE
ACT-14 · BAI11: Owned Work & Substitute Path Does every active task have one accountable human owner AND a backup owner if they are away?
Binds every operational arrangement to a primary owner, substitute owner, scope boundary, and check plan.
Failure to avoid: Critical renewals or incident actions stalling because the sole assigned admin is on vacation or left.
Evidence example: L2: Saved Operating Arrangement with primary + substitute owner and due-date escalation.
Accountable role: Project Owner / Operator
ACT-15 · BAI05: Friction & Bypass Verification Did we roll out this control in a way staff can follow without inventing insecure workarounds?
Checks real-world adoption friction after rollout to ensure security controls do not force shadow workflows.
Failure to avoid: Blocking file transfers without providing a safe alternative, causing staff to use personal email.
Evidence example: L3: Post-rollout operator walkthrough and exception/bypass review.
Accountable role: Operations Lead / IT
ACT-16 · BAI08: Continuity Runbooks & Handover If someone else had to step in tomorrow, are our core IT and recovery steps documented clearly?
Maintains plain-language operational runbooks for critical systems, vendor contacts, and manual fallback steps.
Failure to avoid: Tribal knowledge locked inside a single contractor or family member's memory.
Evidence example: L2/L3: Versioned runbook verified by a walkthrough with the designated substitute owner.
Accountable role: Owner / Substitute Owner
ACT-17 · APO03: Trust Boundaries & Zones Where are the real boundaries between our office, cloud tenants, remote homes, and production systems?
Maps shared identity, network, and data paths across sites so a single compromise cannot traverse the whole estate.
Failure to avoid: Sharing one flat domain admin or network bridge across sales laptops and critical production servers.
Evidence example: L2/L3: Scoped boundary map + verified isolation check between trust zones.
Accountable role: Architect / IT Lead
ACT-18 · APO09: Service Catalog & Dependencies Which core services (email, EHR, ERP, DNS, payments) run our work, and what is our manual fallback?
Catalogs essential business services, standard user request paths, upstream single points of failure, and manual workarounds.
Failure to avoid: Discovering during a cloud outage that staff have no offline contact list or manual intake procedure.
Evidence example: L2: Service dependency register + documented manual continuity mode.
Accountable role: COO / IT Service Lead
ACT-19 · DSS05+EXT: Safety-Constrained OT & Conduits Are shop-floor PLCs, medical devices, and building controllers isolated and managed without disruptive active scans?
Governs industrial/OT zones, maintenance laptop hygiene, and vendor remote jump-hosts under physical safety constraints.
Failure to avoid: Connecting legacy CNC/PLC controllers directly to office Wi-Fi or crashing them with aggressive IT port scanners.
Evidence example: L3: Passive conduit inspection + vendor jump-host MFA/session-approval check.
Accountable role: Plant / OT Lead / FDSE
ACT-20 · DSS05: Network & Wi-Fi Segmentation Are guest devices, IoT cameras, and untrusted gear isolated from computers holding banking and records?
Verifies VLAN/guest Wi-Fi separation, router admin lockdown, and encrypted DNS/egress basics.
Failure to avoid: Placing guest phones, smart TVs, and thermal printers on the same subnet as the file server.
Evidence example: L3: Cross-subnet reachability test confirming guest/IoT isolation from primary hosts.
Accountable role: Network Admin / Owner
ACT-21 · APO07: Role & Authority Delegation Who is allowed to view, prepare, or approve within each specific domain of our workspace?
Manages named human grants across Owner/Approver, Operator/Helper, FDSE Partner, and Read-Only Viewer/Auditor.
Failure to avoid: Shared generic logins where actions cannot be attributed to a named human actor.
Evidence example: L3: Active authority grant table with domain-scoped permissions and append-only audit trail.
Accountable role: Owner / Platform Admin
ACT-22 · BAI05+EXT: Role-Specific Point-of-Risk Drills Do our people practice handling the exact scam, wire change, or access request targeting their role?
Short, practical scenario drills tailored to reception, finance, IT helpdesk, shop floor, or household members.
Failure to avoid: Relying on generic annual compliance videos that never test actual payment or credential-reset procedures.
Evidence example: L2/L3: Completed role scenario drill + verified procedure adherence.
Accountable role: All Scoped Participants
ACT-23 · DSS05+EXT: Joiner, Mover & Leaver Lifecycle Are new hires provisioned cleanly, role changes adjusted, and departed staff/contractors revoked the same day?
Governs end-to-end onboarding baselines, role-transfer access cleanup, and immediate offboarding revocation across SaaS and tokens.
Failure to avoid: Former employees or contractors retaining active M365, VPN, or shared credentials months after departure.
Evidence example: L3: Sampled leaver/mover population reconciled against active directory, SaaS seats, and OAuth tokens.
Accountable role: HR / IT Admin / Owner
ACT-24 · DSS05+EXT: Out-of-Band & Voice-Clone Protocol If an urgent call or message demands a wire transfer, MFA code, or emergency help, how do we verify identity?
Establishes out-of-band callback numbers and shared verification protocols to defeat impersonation and synthetic voice scams.
Failure to avoid: Acting on urgent voice notes, texts, or emails without verifying through an independent pre-agreed channel.
Evidence example: L2/L3: Documented callback/verification protocol + tested challenge-response check.
Accountable role: Finance / Family / Execs
ACT-25 · APO14: Crown-Jewel Data & Retention Where do our highest-consequence records live, who can share them externally, and when are old copies purged?
Maps primary sensitive repositories, restricts anonymous public links, and enforces retention/minimization rules.
Failure to avoid: Leaving years of sensitive customer IDs or financials in folders set to "Anyone with the link can view."
Evidence example: L3: Crown-jewel repository permission export + external sharing link remediation check.
Accountable role: Data Owner / IT Admin
ACT-26 · APO04+EXT: AI System & Extension Inventory Which AI models, meeting bots, browser plugins, and copilots are touching our conversations and files?
Maintains a live inventory of internal and third-party AI tools, data-retention terms, and permitted use scopes.
Failure to avoid: Unvetted meeting note-takers and browser plugins silently ingesting confidential calls and documents.
Evidence example: L2: Scoped AI system inventory linked to workspace context and owner review.
Accountable role: Owner / AI Lead / FDSE
ACT-27 · MEA03+EXT: EU AI Act & ISO 42001 Governance What legal classification (EU AI Act) and management controls (ISO/IEC 42001) apply to each AI use case?
Separates legal risk classification (Prohibited/High-Risk/Limited) from ISO 42001 management system controls and impact assessments.
Failure to avoid: Conflating general IT policies with mandatory AI impact assessments, human-oversight rules, and legal applicability.
Evidence example: L2/L3: Use-case classification record + AI Impact Assessment + AAL2 signed operating decision.
Accountable role: Owner / Legal / CISO (AAL2)
ACT-28 · DSS05+EXT: Prompt Sanitization & Egress Guard How do we prevent staff from pasting raw patient names, account numbers, or secrets into external AI prompts?
Provides local pre-submission redaction for mediated workflows and defines clear egress boundaries and cloud DLP rules.
Failure to avoid: Assuming a written AI policy stops accidental copy-pasting of confidential records into public web chats.
Evidence example: L2/L3: Mediated prompt redaction check + configured workspace egress/sharing rules.
Accountable role: Operator / All Users
ACT-29 · BAI03+EXT: Bounded Agent Execution Contract Are automated AI agents restricted to explicit tool contracts without shell access or unapproved write authority?
Constrains internal research and drafting agents to deterministic read/propose loops with human approval required for state changes.
Failure to avoid: Granting LLM agents direct production database write keys, unrestricted web browsing, or shell execution.
Evidence example: L3: Runtime tool-boundary test + append-only agent job/event audit log.
Accountable role: Platform Admin / AI Lead
ACT-30 · MEA02+EXT: Model & RAG Retrieval Boundaries Can our internal AI assistant retrieve documents the asking user is not authorized to read?
Verifies that RAG indexing and model prompts respect per-user access controls and resist prompt-injection leakage.
Failure to avoid: Indexing an entire company file share into one vector store accessible to every employee chatbot query.
Evidence example: L3: Scoped adversarial retrieval test confirming unauthorized records are not returned.
Accountable role: FDSE / AI Security Lead
ACT-31 · APO06: IT & Security Spend Ledger What are we paying across software and IT contracts, when do they renew, and which domain do they support?
Maps recurring software and service expenditure against operational domains and renewal notice deadlines.
Failure to avoid: Auto-renewing unused annual contracts because nobody tracked the 60-day cancellation window.
Evidence example: L2: Spend and renewal ledger linked to owned capabilities and review reminders.
Accountable role: Owner / CFO / CIO
ACT-32 · EDM04: License & Overlap Optimization Where are we paying for duplicate tools—and have we actually configured and verified the native features we own?
Evaluates existing suite entitlements (e.g., M365 / Google Workspace) against third-party tools, requiring configuration proof before retirement.
Failure to avoid: Either paying twice for the same capability OR canceling a working tool before verifying the native replacement works.
Evidence example: L3: Reclaimed seat audit + verification check proving the replacement control is active before cutover.
Accountable role: Owner / IT Admin / FDSE
ACT-33 · APO10: Supplier Blast-Radius Tiering Which external vendors have network, identity, or crown-jewel data access that could halt or breach us?
Tiers suppliers by operational dependency and access blast radius rather than sending identical questionnaires to every vendor.
Failure to avoid: Spending weeks auditing low-risk suppliers while an MSP with global admin access goes unreviewed.
Evidence example: L2/L3: Tiered supplier register + verified least-privilege access check for Tier-1 vendors.
Accountable role: Owner / Procurement / CISO
ACT-34 · APO10+EXT: Contractual Notice, DPA & Exit Plan Do our critical vendor contracts define incident notification windows, data processing rules, and data export rights?
Reviews DPAs, security annexes, subprocessor registers, and practical exit/export procedures for critical suppliers.
Failure to avoid: Discovering during a vendor dispute or breach that you have no timely notice right or usable data export path.
Evidence example: L2: DPA & Security Annex review record + verified data export format check.
Accountable role: Legal / Owner / FDSE
ACT-35 · DSS05+EXT: Payment Routing & BEC Verification Before anyone changes a supplier bank account or sends a high-value wire, is out-of-band verification enforced?
Protects invoice and payroll workflows against Business Email Compromise (BEC) and lookalike-domain payment diversion.
Failure to avoid: Updating vendor ACH/IBAN routing details based solely on an emailed PDF invoice or thread reply.
Evidence example: L3: Two-step out-of-band phone verification log required on 100% of bank-routing changes.
Accountable role: Finance / Owner
ACT-36 · DSS05: Phishing-Resistant Identity & MFA Are admin and crown-jewel accounts protected with FIDO2/Passkeys, and are daily logins separated from admin rights?
Distinguishes phishing-resistant FIDO2/WebAuthn passkeys and hardware keys from phishable OTP codes, enforcing admin separation.
Failure to avoid: Relying on SMS or basic push/OTP codes that attackers bypass via real-time adversary-in-the-middle (AiTM) proxies.
Evidence example: L3: IdP/account export verifying FIDO2/Passkey enforcement on privileged and recovery accounts.
Accountable role: IAM Lead / Owner
ACT-37 · DSS05+EXT: SOC Triage & Competing Hypotheses When an alert, dark-web cohort signal, or suspicious artifact arrives, what discriminating check proves or disproves impact?
Ingests signed signals and dark-web cohort advisories into the Intelligence Inbox, preserving competing hypotheses until verified.
Failure to avoid: Either drowning in uncontextualized alert noise OR treating an automated AI summary as confirmed incident truth.
Evidence example: L2/L3: Scoped investigation record linking signal provenance, declared coverage hours, and verifying observation.
Accountable role: SOC Operator / FDSE
ACT-38 · APO12+EXT: Privacy, RoPA & Data Flows What personal or patient data flows through our systems, under what lawful basis, and how do we fulfill subject requests?
Maintains Records of Processing Activities (RoPA), PHI flow maps, DPIA screenings, and DSAR response procedures.
Failure to avoid: Collecting regulated personal or health data across forms and SaaS tools without a current processing map.
Evidence example: L2: Current RoPA / PHI flow register + tested data-subject request workflow.
Accountable role: Privacy Lead / Clinic Owner
ACT-39 · MEA02+EXT: Authorized Adversarial Validation Under explicit owner authorization, did a scoped boundary test prove our controls block a specific attack path?
Generates scoped test requests (`authorizationIncluded: false` until separately authorized by Owner/Admin) and qualifies returned observations.
Failure to avoid: Running unconsented scans OR assuming a clean point-in-time test proves an unbreachable perimeter.
Evidence example: L3: Counter-signed authorization + scoped test condition record + reviewed observation artifact.
Accountable role: Owner + Platform Admin / FDSE
ACT-40 · DSS04+EXT: Break-Glass Recovery Readiness If primary phones and admin tokens are lost simultaneously, is our offline recovery procedure tested and sealed?
Tracks recovery readiness, physical custody rules, and inheritance instructions while keeping raw secret keys out of general evidence.
Failure to avoid: Either locking yourself out permanently when a phone dies OR pasting raw master recovery keys into plaintext docs.
Evidence example: L3: Verified physical seal/custody check of offline recovery media (without exposing secret values).
Accountable role: Owner / Head of Household
ACT-41 · DSS05: Physical, Travel & Site Resilience If a laptop is stolen in transit or a site loses power/internet, are disk contents encrypted and operations protected?
Verifies full-disk encryption, screen-lock enforcement, travel device hygiene, and local power/comms continuity.
Failure to avoid: An unencrypted laptop or unlocked wiring closet exposing credentials and local databases in minutes.
Evidence example: L3: Full-disk encryption verification across in-scope endpoints + physical access check.
Accountable role: Device Owner / Facilities
ACT-42 · BAI02: Software & SaaS Intake Gate Before adopting a new app or AI plugin, did we check data ownership, license overlap, and minimum security?
Lightweight pre-adoption review preventing unmanaged Shadow IT and duplicative subscriptions before data is uploaded.
Failure to avoid: Teams signing up for dozens of overlapping SaaS tools with corporate email addresses and zero exit path.
Evidence example: L2: Pre-purchase intake record and owner approval before workspace rollout.
Accountable role: Department Lead / IT
ACT-43 · BAI03: Secure SDLC & Pipeline Controls Are branch protection, secret scanning, and peer review actually enforced in our code repositories?
Verifies software delivery controls directly from repository and pipeline configurations rather than static policy claims.
Failure to avoid: Maintaining a written SDLC policy while developers push unreviewed code or API keys straight to production.
Evidence example: L3: Sampled change/PR population + repository branch-protection and secret-scan check.
Accountable role: Engineering Lead / FDSE
ACT-44 · DSS05+EXT: M365 / Workspace & OAuth Hygiene Is our core email/collaboration tenant hardened, and have we revoked risky third-party OAuth app grants?
Covers core Microsoft 365 / Google Workspace admin baselines, forwarding blocks, SPF/DKIM/DMARC, and OAuth token pruning.
Failure to avoid: Attackers maintaining persistent mailbox/drive access via forgotten third-party OAuth grants or external auto-forwarding rules.
Evidence example: L3: Tenant mail-forwarding & DNS auth check + third-party OAuth grant review.
Accountable role: IT Admin / Owner
ACT-45 · BAI07+EXT: System Retirement & Decommissioning When we replace a server, app, or domain, did we export needed records, wipe data, and shut down old access?
Governs safe decommissioning so abandoned staging servers, old tools, and lapsed subdomains do not become backdoors.
Failure to avoid: Migrating to a new platform while leaving the unpatched legacy server and database exposed online.
Evidence example: L3: Archive export verification + decommission/DNS teardown confirmation.
Accountable role: IT Ops / Owner
ACT-46 · APO03+EXT: Cloud & Local Hosting Architecture Do we know where each workload is hosted, who controls the root tenant, and how sovereignty boundaries are kept?
Documents cloud root account custody, region/data residency boundaries, and local hardware/vault dependencies.
Failure to avoid: An external agency holding sole root ownership of the company's AWS, Azure, or domain registrar account.
Evidence example: L3: Root tenant & domain registrar custody check confirming owner-controlled recovery.
Accountable role: CIO / Infrastructure Lead
ACT-47 · BAI09: Asset, Endpoint & Patch Baseline Do we have an accurate list of devices accessing our work, and are critical OS/browser updates applied?
Maintains a scoped inventory of phones, laptops, workstations, and servers with encryption and patch currency checks.
Failure to avoid: Unmanaged personal or legacy machines accessing sensitive portals without updates or endpoint protection.
Evidence example: L3: Reconciled device population list + OS/browser patch currency sample.
Accountable role: IT Ops / Device Owner
ACT-48 · BAI06: Change Control & Rollback Readiness Before changing firewall rules, DNS, identity policies, or production configs, is there a review and rollback plan?
Requires pre-change impact checks, rollback steps, and post-change verification for consequential infrastructure edits.
Failure to avoid: Undocumented configuration edits causing outages or silently opening external firewall ports.
Evidence example: L3: Sampled infrastructure changes verified against change log and post-change check.
Accountable role: IT Ops / DevOps
ACT-49 · BAI04: Capacity, Expiry & Uptime Monitoring Are we monitoring storage capacity, certificate/domain renewals, and critical service health before outages hit?
Tracks storage/compute headroom, TLS/domain expiration clocks, and basic observability/uptime heartbeats.
Failure to avoid: Production halting because a disk filled up, a backup target ran out of space, or a domain expired.
Evidence example: L3: Active health/capacity check + verified renewal calendar for domains and certificates.
Accountable role: IT Operations
ACT-50 · DSS02: Incident Containment & Notice Clocks In the first hour of a breach or fraud event, who leads containment and which legal reporting clocks apply?
Guides severity triage, evidence preservation, and jurisdiction-specific notification workflows based on applicable obligations and qualified review.
Failure to avoid: Destroying forensic logs during panic recovery or missing statutory early-warning deadlines.
Evidence example: L2/L3: Scoped incident response runbook + regulatory applicability matrix + tabletop check.
Accountable role: Incident Lead / Owner / Legal
ACT-51 · DSS03: Root-Cause & Corrective Follow-Up After an outage, failed check, or near-miss, did we fix the underlying cause and verify the fix holds?
Links every failed check, audit nonconformity, or incident to a tracked corrective action and re-verification plan.
Failure to avoid: Closing tickets after a temporary reboot without fixing the broken boundary that allowed the failure.
Evidence example: L3: Root-cause record + completed corrective work + subsequent PASS re-verification.
Accountable role: Operations / CISO / FDSE
ACT-52 · DSS02+EXT: Service Desk & Reset Verification Can a caller socially engineer our helpdesk or MSP into resetting a password or MFA device without verification?
Secures everyday IT support requests by enforcing strict identity verification before any credential or MFA reset.
Failure to avoid: Helpdesk staff resetting MFA tokens for an attacker who calls in claiming a lost phone.
Evidence example: L3: Helpdesk reset protocol + mystery-caller / ticket sample verification check.
Accountable role: Service Desk / MSP / IT