Oct 29, 2026
Most organizations do not have a governance capability problem; they have a coordination problem. Security runs a program against ISO 27001 or NIST SP 800-53. Privacy runs one against GDPR or HIPAA. Legal tracks the statutes. Data science is now standing up a fourth program for AI, with a fourth vocabulary and a fourth evidence folder. Each function is competent on its own terms, and the risk sits in the gaps between them.
The regulatory calendar is making those gaps expensive. The EU AI Act, the Colorado AI Act, Texas TRAIGA, California SB 53, NYC Local Law 144, and the HIPAA Security Rule differ in scope and penalty, but they share a skeleton: an inventory of systems, an impact or risk assessment, documented human oversight, and proof that controls operate. An organization that governs that skeleton once can absorb each new statute as a delta. An organization that runs four parallel programs starts a new project every time a legislature adjourns.
This week we released ARISE Framework® v2.1. This post explains why we describe it as a governance operating system rather than another framework, what changed in this release, and what adopting it looks like in practice.
What a governance operating system is
A framework is a list of things an organization should do. An operating system is the layer that lets many programs run on shared resources without colliding. The distinction matters because the industry does not lack frameworks; ISO/IEC 42001, the NIST AI RMF, ISO 27001, and SP 800-53 are each well built for their purpose. What organizations lack is the layer underneath them, where one inventory, one control library, one evidence base, and one oversight structure serve every framework and regulator at once.
The ARISE Framework® (Assurance of Responsible, Innovative & Secure Environments) is built as that layer. It organizes 128 controls and 953 requirements across seven domains: GOVERN, MANAGE, IDENTIFY, PROTECT, DETECT, RESPOND, and VALIDATE. Cybersecurity, privacy, ethics, and AI are governed through one lens rather than four, and the framework maps outward to the external standards and statutes an organization must answer to.
ARISE™ does not replace NIST or ISO, and it is not a government standard. It is owned by Assessed Intelligence and published under a public, non-commercial license. Its job is to unify the teams that answer to those external authorities and to make their evidence reusable.
What changed in v2.1
Version 2.1 is a crosswalk release. The control library itself, meaning the controls, requirements, and 38-node taxonomy, is unchanged from v2.0, and control and requirement IDs remain permanent. An organization that mapped its evidence to v2.0 carries that work forward without re-mapping.
The crosswalks are where the work went. Every published mapping was re-reviewed, and three things are different:
- Complete rationale on every row. Each mapped row now carries the full explanation of why an ARISE™ control satisfies the external clause, which is what an auditor reads when deciding whether to accept evidence.
- Every row resolves to a published control. Rows that referenced retired or internal identifiers were corrected, so nothing in a crosswalk points at a control an adopter cannot find.
- Deeper coverage where it was thin. The ISO 27001 mapping grew from 71 to 98 rows, the EU AI Act from 57 to 73, BSI C5 from 82 to 127, and GDPR from 25 to 35, each row tied to a specific external clause.
The published set now covers more than 44 external frameworks, regulations, and assurance criteria, including the EU AI Act and its six CEN/CENELEC harmonized standards (prEN 18228, 18229-1, 18229-2, 18282, 18284, and 18286), ISO/IEC 42001 and 27001, NIST SP 800-53, the NIST AI RMF, GDPR, the HIPAA Security Rule, PCI DSS v4.0, state AI statutes in Colorado, Texas, California, and Idaho, and the AIUC-1 Certificate. Each of the six prEN crosswalks covers all 128 controls, which positions adopters for EU AI Act conformity as the harmonized standards are finalized.
One function, four domains
The unification is structural, and the control IDs show it. A governance function such as incident response is written once and instantiated for each domain, so the AI, cyber, and privacy variants share an owner, a procedure template, and an evidence standard rather than living in three separate binders.
| Function | AI | Cyber | Privacy | Ethics |
|---|---|---|---|---|
| Incident response | R.IR-01 | R.IR-02 | R.IR-03 | |
| Oversight committee | M.OV-03 | M.OV-02 | M.OV-01 | |
| Regulatory compliance | G.LR-03 | G.LR-04 | G.LR-01 | G.LR-05 |
| Policy family | G.GV.P-04 | G.GV.P-02 | G.GV.P-05 | G.GV.P-06 |
| Audit | V.AD-01 | V.AD-02 |
The VALIDATE domain is the part most frameworks leave to the auditor. ARISE™ makes testing, internal audit, and independent assurance part of the control set, which is the difference between holding a document set and operating a system that catches drift.
What this changes in practice
The next statute becomes a delta. When Colorado, Texas, or the European Commission publishes new obligations, the question is no longer “what program do we stand up” but “which of our 128 controls does this touch, and what does it add.” The crosswalk answers that in an afternoon.
One evidence base serves many assessors. The same access-review record can satisfy an ISO 27001 auditor under A.5.18, a HIPAA risk analysis, and an EU AI Act conformity reviewer looking at human oversight. Organizations should stop producing the same evidence three times in three formats.
AI is governed inside the program, not beside it. IDENTIFY and PROTECT treat AI systems and agents as governed assets with owners, scoped access, and monitoring. Model risk, shadow AI, and agent permissions are handled with the same inventory, tiering, and review discipline the organization already applies to everything else.
Validation is continuous. Point-in-time audits are inadequate for systems that generate risk every day. Building VALIDATE into the control set gives leadership a current view of the risk profile rather than an annual snapshot.
How to adopt it
The full framework is published at ariseframework.com and in the public repository at github.com/Assessed-Intelligence/ARISE-Framework, with controls, requirements, the taxonomy, and every crosswalk as CSV files that load directly into GRC tooling. Internal governance, compliance readiness, education, research, and nonprofit use are free under the ARISE™ Public Use License (Non-Commercial). Consulting, paid audits, and commercial products built on ARISE require a commercial license.
A practical first step is to inventory what the organization already has. Most mature security and privacy programs discover they already operate 60 to 70 percent of the ARISE™ control set under other names; the work is in connecting those controls to one structure and extending it to AI. Assessed Intelligence supports that work through its IMPLEMENT, OPERATE, VALIDATE, and INNOVATE services, including vCISO and vCRAIO engagements, but adoption does not require an engagement with us.
The full announcement is available in the ARISE Framework® v2.1 press release. Unified governance gives you the complete picture, and when you have the complete picture you can see when pieces are missing.
The ARISE name and symbol are registered trademarks of Assessed Intelligence.
