Chapter 3
The seven principles of construction
The rules under which the framework was assembled, each with the source that taught it. They are also the rules under which the catalog changes: a component moves when a source moves, or when a challenge succeeds.
| Principle | What it means in practice | Where it came from |
|---|---|---|
| One spine, many lenses | The ISO 31000 process is the only spine; every other source sharpens one of its six steps. Nobody adopting the framework chooses between standards; an existing program becomes a lens, not a rival. | ISO 31000 [1], the one document general enough to hold the other twenty-six (chapter 10) |
| The most prescriptive version wins | Where two sources describe the same idea, keep the one that names fields, scales, thresholds or prohibitions, because an auditor and a program can test it. | The Orange Book's appetite scale [4], the hierarchy of controls [10], and the Basel habit of a model licensed by its tests [5] |
| Machine-readable where a schema exists | The register and detail record, the incident, the hazard and the software component are adopted as formats, not paraphrased as ideas; a shared schema is a translation already done. | NIST IR 8286 schemas [9]; FSB incident format [27]; UNDRR hazard profiles [24]; CISA bill-of-materials elements [15] |
| Opportunities are native | Positive risks, the three positive responses (realize, share, enhance) and identification from the opportunity side are built in; a register without a word for upside has already chosen a dialect. | IRM technique catalog [6]; NIST IR 8286 responses [9]; CSF 2.0 governance outcome on positive risks [23] |
| Evidence over declaration | A control is as good as its measured effectiveness, a model as good as its last passed test, a score as good as its published reliability; “controls are in place” is not a field. | Basel backtesting and attribution [5]; INFORM reliability index [7]; FMEA re-rating after action [8] |
| Provenance on every component | Each of the forty-seven components cites its source by key, so the framework can be audited, challenged and realigned when a source changes; the translation table is public. | IIA documented reliance [18], applied by the framework to itself |
| Currency is a field | Every external input carries its version and retraction status as data; an analysis can be asked which of its inputs has changed since it was run. | The NGFS retraction of December 2025 [13]; NIST revision numbering [9] |