Master Roadmap

Maps each supported vendor tool (Qualys, Tenable, ServiceNow, Splunk, CrowdStrike, etc.) to a normalized TIPPSS-aligned output schema. Without this, the pipeline cannot ingest data.

Maps {event_type, field_value} → {SCF_control_id, TIPPSS_dimension, asset_category}. The intellectual core of the pipeline. Converts raw telemetry into SCF control evidence.

Maps {TIPPSS_dimension, SCF_control, evidence_type} → {CMM_level: 1–5}. Translates normalized events into Bronze/Silver/Gold (CMM L1–5) maturity tags for CAM scoring.

Fields to mask/hash/drop per tool type before VCRI storage. CVE IDs, internal IPs, hostnames stripped — only risk signal retained. Technical foundation of the "VCRI never stores specific vulnerabilities" escrow promise.

VCAR = Process Value × Industry Incident Duration. The duration factor requires a maintained dataset of impairment times by incident type and industry sector. Feeds every dollar-at-risk calculation on the platform.

Data categories, legal basis, retention, vendor rights (access/delete/portability), breach notification SLA (72h), sub-processor disclosure, Japan data residency. Listed as available in DataSecurity brief.

Exact data VCRI requires per TIPPSS dimension × asset class. Data type, format, acceptable sources, minimum frequency. Listed as available in DataSecurity brief.

Formal diagram showing 4-layer data flow with encryption points, access controls, and what data exists at each layer. Listed as available in DataSecurity brief.

Redacted/sample audit log report VCRI can produce for a vendor on request — proving the audit rights commitment. Listed as available in DataSecurity brief.

Agency/client-side pricing, vendor participation pricing, founding partner terms. Non-profit framing: pricing covers operations, not profit.

Cost of NOT having continuous monitoring vs. VCRI annual cost. ISMAP compliance cost reduction. Staff hour savings from eliminating questionnaire programs. Anchored in VCAR methodology.

Briefing with NISC to map SCF control identifiers to specific ISMAP assessment criteria. Produces the authoritative crosswalk for VCRI evidence packages. Tom Cornelius leads.

Japan ministries/agencies for Asia-Pacific anchor. US: DoD/DHS/CISA. EU: DORA-adjacent. GCC: SAMA/NESA. Schedule briefings, deploy ISMAP brief and pitch deck. Runs in parallel throughout all phases.

Security Weekly is now owned by CyberRiskAlliance. A dedicated episode requires a paid sponsorship. Options: (1) Sponsored episode — cost TBD, 160K audience; (2) Organic mentions by Paul in vendor risk mgmt segments (no cost); (3) Use Paul's board role for LinkedIn amplification and direct introductions. Decision: worth sponsoring at this stage?

Deploy OnePager + TechnicalOverview content, resource library (ISMAP brief, DataSecurity brief, pricing), blog section, contact/intake form. Index.html exists; needs hosting at valuechainrisk.org.

Joshua personal: thought leadership content strategy. VCRI org page: created and branded. Regular posts on supply chain risk, ISMAP, Kojima/Toyota, milestones.

(1) Decay of Truth; (2) Inside-Out vs. Outside-In; (3) Kojima Toyota — supply chain risk made real; (4) What continuous monitoring actually means; (5) Portable Trust — why vendors benefit from transparency.

Onboard agency + 5-10 of their ICT vendors. Generate first ISMAP-formatted evidence package. This is the anchor deployment promised in the Japan pitch deck.

Formal confirmation from registered ISMAP assessment organizations that VCRI evidence output is accepted as supporting documentation for ISMAP A.15 controls.

Structured templates for clients to price their business processes (the "Process Value" input to VCAR). Four types: commercial revenue-generating, commercial revenue-protecting, government direct mission, government indirect mission.

VCRI remediation lists sync with vendor ticketing systems for real-time resolution tracking. Integration spec: data fields, direction, access model.