Most organizations do not have a governance capability problem. They have a coordination problem. Security, privacy, legal, and data science each run a competent program against a framework of their own, and the risk sits in the gaps between them. A Governance Operating System closes those gaps structurally, and the ARISE Framework™ is built to be one.
Four programs, four pictures
Walk into a mid-sized healthcare system, a defense contractor, or a financial firm with an AI roadmap and the pattern repeats. The security team runs a program against ISO/IEC 27001 or NIST SP 800-53. The privacy office runs one against HIPAA or GDPR. Legal tracks the EU AI Act, the Colorado AI Act, and whichever state statute passed last quarter. The data science group has an AI committee and a document set that references ISO/IEC 42001 or the NIST AI RMF. Each program is defensible on its own terms.
The board sees four partial pictures and none of them tell it the whole thing. An incident response plan exists in three versions owned by three teams. The same evidence is collected three times for three assessors. When a new law lands, it becomes a new project rather than a change to something that already exists. The cost is not only duplicated effort; a finding that is visible to one domain is invisible to the other three until it becomes an incident.
I wrote about the source of this fragmentation in The Frameworks Meant to Unify Governance Are Fragmenting It. Each standard was written to solve a bounded problem well. The organization at the center is the only party responsible for making them form one picture, and most organizations have no structure for doing that.
What a Governance Operating System is
A Governance Operating System is one control framework that an organization implements once and maps every law, standard, and assessor to, so that AI, cybersecurity, privacy, and ethics are governed in a single system rather than four parallel programs. The analogy is deliberate. A server does not run four operating systems, one per application; it runs one, and the applications are written to it. Governance should work the same way. The organization runs on the operating system, and the standards map outward to it.
The output of a Governance OS is a common operating picture. Military and emergency management use that term for one shared view of the situation that every unit works from. In governance it means one control set, one evidence base, and one status view that the board, the CISO, the privacy officer, legal, and data science all read the same way. A finding in one domain is visible to every other domain at once, because there is only one place for it to be.
Three properties separate an operating system from another framework on the pile:
- One control, governed once. A governance function that serves two domains is written once and instantiated across both, with one owner and one evidence requirement.
- Implement once, map outward. Standards and statutes map to the operating system, not the other way around, so each new requirement becomes a delta against the existing control set rather than a new program.
- Validation built in. Testing and independent assurance are part of the system rather than an annual event layered on top of it.
Why ARISE is built as one
The ARISE Framework™ is published by Assessed Intelligence as a Governance Operating System. Version 2.1.0 provides 128 controls and 953 requirements across seven domains: GOVERN, MANAGE, IDENTIFY, PROTECT, DETECT, RESPOND, and VALIDATE. It publishes 40 crosswalks to laws, standards, and assurance criteria, and the full control library and every crosswalk are maintained in a public repository.
The structure is what makes it an operating system rather than a reference. Incident response for AI, cyber, and privacy events is R.IR-01, R.IR-02, and R.IR-03 under one RESPOND domain, owned by one function, rather than three playbooks in three teams. Oversight committees, regulatory compliance, policy families, and audit follow the same pattern. Each of the 953 requirements carries a priority tier (337 foundational, 452 operational, 164 advanced), which gives an organization a defensible sequence for standing the system up.
The common operating picture, drawn
The clearest way to see the value is to draw it. The map below places all 128 ARISE controls in a single spine and traces every published crosswalk to them: ISO and NIST standards and the EU AI Act family on the left; US law, assurance criteria, and international policy on the right. Every line is one mapped requirement. There are 1,803 of them.
Three observations follow from the map. First, the six CEN/CENELEC prEN 18xxx harmonised standards drafted for the EU AI Act each map to all 128 controls, so an organization running on ARISE meets those standards with the evidence it already holds as they are finalized. Second, ISO 9001 (111 controls), ISO/IEC 27001 (98), NIST SP 800-53 (91), and ISO/IEC 42001 (90) overlap heavily in the center; the controls that satisfy one largely satisfy the others, which is the duplicated work that four separate programs never notice. Third, the US state statutes on the right each touch a small number of controls, between five and thirty-one. Under a Governance OS, each of those laws is a delta of a few controls rather than a program of its own.
What changes for leadership
A board that receives a SOC 2 report, an ISO 42001 readiness memo, a privacy program update, and AI committee minutes is being asked to assemble the picture itself. It will not, and it should not have to. Under an operating system the board receives one status view, read the same way by every function that contributes to it, and a regulator or customer that asks a question receives an answer drawn from the same evidence base the board already saw.
For the CISO and the privacy officer, the change is that a fractional or in-house executive inherits a working control set and a common operating picture on day one. Every OPERATE engagement at Assessed Intelligence runs on ARISE for this reason; the executive spends the first ninety days operating governance rather than designing it.
ARISE does not replace NIST or ISO
This point deserves precision. ARISE is not a competitor to the NIST AI RMF, ISO/IEC 42001, or ISO/IEC 27001, and an organization that adopts it does not stop certifying against them. ARISE is the system those standards map to. The organization runs its governance on ARISE and maps outward to the standards its regulators, customers, and auditors recognize. The certification is still earned; the difference is that it is earned once from a shared control set rather than rebuilt per standard.
Adopting the operating system
ARISE is published under the ARISE™ Public Use License (Non-Commercial). Internal governance, education, research, compliance readiness, and nonprofit use are free. Selling ARISE-based consulting, paid audits against it, or paid products built on it require a commercial license. Adoption does not require an engagement with Assessed Intelligence; the framework, its requirements, and all 40 crosswalks are in the repository today.
Organizations that answer to more than one regulator or assessor at once should start by inventorying which frameworks each team currently reports against, then mapping each to the ARISE control set using the published crosswalks. The overlap in that mapping is the duplicated work the organization is paying for now, and the first evidence that a single operating system is the lower-cost path. The ARISE Framework page describes the seven domains and the implementation tiers; speak with an advisor if you want help standing it up.
ARISE Framework™ is the Governance Operating System for AI, cybersecurity, privacy and ethics. Open for adoption under the ARISE™ Public Use License (Non-Commercial). Framework, requirements, and crosswalks: github.com/Assessed-Intelligence/ARISE-Framework.
