01 / GOVERNANCE
Systems, duties and decisions
The system register records purpose and ownership. Rules determine provisional risk classifications; people review the determination. Applicable obligations connect to controls, supporting records and work that needs attention. A readiness score does not determine whether a system complies.