Open-source state machines for every regulated industry.

AI Inference Run Lifecycle NIST-AI-RMF-MEASURE · EU-AI-Act-Art-14 · EU-AI-Act-Art-15 · ISO-IEC-42001 · Apache-2.0

Lifecycle of a single (or batched) AI inference run with drift + safety controls. Aligned with NIST AI RMF MEASURE function and EU AI Act Art 14 (human oversight).

1. Queued

   Inference request queued.

   • Capture input provenance + prompt envelope.
2. Executing

   Model execution in progress.

   • Capture model id, version, inputs hash.
3. Quarantined

   Output withheld pending human review.

   • Hand off to human reviewer.
4. Completed

   Output delivered; logged for audit.

   • Persist output + safety classifier result.
5. Drift flagged

   Drift / OOD detected; under review.

   • Record drift signal + window.
6. Replayed

   Replayed on a corrected model / inputs.

   • Link to original run.

EU AI Act High-Risk System Lifecycle EU-AI-Act-Reg-2024-1689 · EU-AI-Act-Art-16 · EU-AI-Act-Art-17 · EU-AI-Act-Art-43 · Apache-2.0

Lifecycle of a High-Risk AI System under the EU AI Act. Covers design, conformity assessment, CE marking, market surveillance, recall and withdrawal. Aligned with Articles 16-29.

1. Design

   System in design / development.

   • Operate Quality Management System per Art 17.
   • Risk management system per Art 9.
   • Data governance + bias controls per Art 10.
2. Conformity assessment

   Conformity assessment in progress (internal or notified body).

   • Compile technical documentation per Annex IV.
   • FRIA where required.
3. Ce marked

   CE marked + EU Declaration of Conformity issued.

   • Maintain DoC per Art 47.
   • Register in EU database per Art 71.
4. In market

   On market; post-market monitoring active.

   • Post-market monitoring per Art 72.
   • Report serious incidents per Art 73.
5. Recall

   Recall in progress.

   • Execute recall + notify authorities + users.
6. Withdrawn

   Withdrawn from market; records retained.

   • Retain technical documentation 10y per Art 18.

AI Model Evaluation Lifecycle NIST-AI-RMF-1.0 · ISO-IEC-42001 · ISO-IEC-23894 · UK-AI-Safety-Institute-Approach · Apache-2.0

Lifecycle of an AI model evaluation against safety + capability benchmarks. Aligned with NIST AI RMF 1.0, ISO/IEC 42001, and emerging UK AISI / US AISI evaluation practice.

1. Proposed

   Evaluation scope drafted.

   • Define benchmarks + threat model + success criteria.
2. Evaluating

   Evaluation runs in progress.

   • Execute capability + safety benchmarks.
   • Run red-team / adversarial evaluation.
3. Passed

   All criteria met; pending approval.

   • Publish evaluation report.
4. Rejected

   Fails criteria; not approved.

   • Document rejection reasons + remediation pointers.
5. Restricted

   Approved with restrictions (guardrails, gated rollout).

   • Document restrictions + monitoring requirements.
6. Approved for use

   Approved for production deployment within stated scope.

Prompt Injection Incident Lifecycle OWASP-LLM01-2025 · MITRE-ATLAS · EU-AI-Act-Art-15 · NIST-AI-100-2 · Apache-2.0

Lifecycle of a confirmed prompt-injection / model-manipulation incident. Aligned with OWASP LLM Top-10 (LLM01), MITRE ATLAS, and EU AI Act Art 15 (cybersecurity).

1. Detected

   Suspicious prompt / output detected.

   • Capture prompt, output, classifier verdict.
2. Analysed

   Root-cause + blast-radius analysis.

   • Document attack vector + affected runs.
   • Replay query of affected sessions / tools called.
3. Remediated

   Mitigations deployed + verified.

   • Document mitigations (filters, allow-lists, retraining).
4. Accepted risk

   Risk accepted with documented compensating controls.

   • Capture risk-acceptance with named owner + review date.

Corporate Credit Facility Lifecycle Basel-III-CRR · EBA-GL-LOM-2020-06 · IFRS-9 · FCA-SYSC-7 · Apache-2.0

Lifecycle for a corporate revolving / term credit facility. Covers proposal, underwriting, activation, drawdown, repayment, and exit paths including default and renegotiation. References Basel III…

1. Proposed

   Facility term sheet drafted with borrower.

   • Capture indicative term sheet + pricing.
2. Underwriting

   Credit committee underwriting in progress.

   • Compile credit memo with IFRS 9 staging.
   • Independent collateral valuation if secured.
3. Active

   Facility live; commitment fee accruing on undrawn portion.

   • Monitor financial covenants quarterly.
4. Drawn

   Facility partially or fully drawn.

   • Accrue interest + monitor LTV.
5. Repaid

   Facility fully repaid + closed.

6. Renegotiated

   Facility amended / restated.

   • Capture amendment + restatement docs.
7. Defaulted

   Covenant breach or payment default; recovery handed off.

   • Issue event-of-default notice + accelerate.

Customer KYC Check Lifecycle (BSA / 5AMLD) BSA-31-USC-5318 · EU-5AMLD-Art-13-18 · JMLSG-Pt-I-5 · FATF-R10 · Apache-2.0

Lifecycle of a per-customer KYC check across CDD and EDD pathways. Aligned with US BSA, EU 5AMLD, and JMLSG guidance. Covers periodic refresh and triggered re-screen.

1. Pending

   KYC initiated; documents requested from subject.

   • Issue document checklist (ID, proof of address, source of funds).
2. In progress

   CDD running: ID verification + sanctions/PEP screen.

   • Capture IDV vendor result + liveness.
   • Screen against UN/OFAC/HMT/EU lists.
3. Passed

   CDD passed; customer onboarded at standard risk.

   • Refresh KYC per risk tier (low: 60mo, med: 36mo, high: 12mo).
4. Enhanced due diligence

   EDD invoked: PEP, high-risk geography, complex ownership.

   • Capture source-of-funds / source-of-wealth narrative + docs.
   • Verify UBO chain to ≥25% threshold.
5. Rejected

   Customer declined; SAR filed where required.

Consumer Loan Application Lifecycle FCA-CONC-5 · FCA-CONC-6 · FCA-CONC-7 · EU-MCD-Art-18 · Apache-2.0

Reference state machine for FCA-regulated consumer loan applications. Covers submission, affordability + creditworthiness assessment, decision, disbursement, and exit conditions including default and…

1. Submitted

   Application received from borrower; identity captured.

   • Initiate KYC + sanctions screen.
   • Issue pre-contract credit information (CONC 4.2 / SECCI).
2. Underwriting

   Affordability + creditworthiness assessment in progress.

   • Document affordability assessment per CONC 5.2A.
   • Record CRA pull + bureau decision.
3. Rejected

   Application declined; adverse reason recorded.

4. Approved

   Loan offer issued, awaiting acceptance / drawdown.

   • Provide binding offer with APR, total repayable, right to withdraw.
5. Disbursed

   Funds released to borrower; repayments scheduled.

   • Maintain repayment schedule + statements.
6. Repaid

   Loan fully repaid; record retained for regulatory minimum.

7. Defaulted

   Loan in default per CONC 7; collections / forbearance handed off.

   • Issue Notice of Default per CCA s.87.
8. Restructured

   Forbearance agreed under CONC 7.3 — terms varied.

   • Capture forbearance plan + borrower consent.

Merchant / Acquirer Onboarding Lifecycle PSD2-Art-19-Agents · EU-5AMLD-KYB · Visa-Core-Rules · MC-CR-3.4 · Apache-2.0

Lifecycle for onboarding a merchant onto an acquirer / payment processor. Covers KYB, MCC classification, underwriting, activation, and offboarding. Aligned with PSD2, scheme rules (Visa/Mastercard)…

1. Applied

   Merchant submitted application.

   • Capture application + beneficial ownership.
2. Kyb in progress

   KYB checks + sanctions screening.

   • Run KYB on corporate entity + UBOs.
   • Classify MCC + flag high-risk verticals.
3. Approved

   Underwriting passed; awaiting activation.

   • Capture executed merchant agreement.
4. Rejected

   Application declined.

5. Activated

   Merchant live; transaction monitoring active.

   • Monitor for laundering / fraud patterns.
6. Offboarded

   Merchant offboarded; reasons recorded.

   • Document offboarding reason + scheme notification.

Card Payment Intent Lifecycle (PSD2-SCA) PSD2-Art-97-SCA · PCI-DSS-4.0-Req-3 · PCI-DSS-4.0-Req-10 · EBA-RTS-SCA · Apache-2.0

Lifecycle for a card / account payment intent under PSD2 Strong Customer Authentication. Covers initiation, SCA challenge, authorisation, settlement, and dispute / chargeback exit paths. PCI-DSS 4.0…

1. Initiated

   Payment intent created by merchant or PISP.

   • Persist idempotency key + initiation envelope.
2. Authorising

   SCA challenge in flight or issuer authorisation pending.

   • Record SCA factors used (knowledge/possession/inherence).
3. Authorised

   Issuer approved; awaiting capture / settlement.

   • Hold funds; expire per scheme rules.
4. Failed

   Authorisation declined or SCA failed.

5. Settled

   Funds captured + cleared to acquirer.

6. Disputed

   Cardholder raised dispute; pre-arbitration window open.

   • Compile dispute evidence pack.
7. Chargebacked

   Chargeback finalised against merchant.

Smart Meter Reading Lifecycle UK-SMETS2 · EU-Clean-Energy-Package-2019 · Elexon-BSC · Ofgem-SLC-21D · Apache-2.0

Lifecycle of a smart meter reading from acquisition through billing settlement. Aligned with UK SMETS2, EU Clean Energy Package, and Elexon BSC.

1. Pending

   Reading captured at meter.

   • Capture reading with timestamp + interval.
2. Validated

   VEE (validation/estimation/editing) passed.

   • Apply industry VEE rules.
3. Disputed

   Consumer disputed reading.

   • Capture dispute + resolution path.
4. Billed

   Reading consumed by billing engine.

   • Link reading to invoice line.
5. Settled

   Dispute / billing settled.

PPA Settlement Lifecycle EU-REMIT-Reg-1227-2011 · Elexon-BSC · EFET-Power-2007 · Ofgem-EBGL · Apache-2.0

Lifecycle of a Power Purchase Agreement settlement period. Aligned with EU REMIT, Elexon BSC, and EFET standard terms.

1. Generated

   Generation data acquired from asset.

   • Capture half-hourly generation.
2. Reconciled

   Reconciled with offtaker imbalance position.

   • Reconcile generation vs nomination.
3. Invoiced

   Invoice issued to offtaker.

   • Issue invoice per EFET terms.
4. Paid

   Settlement paid.

5. Disputed

   Counterparty disputed.

   • Open dispute per EFET §10.

Patient Consent Lifecycle (HIPAA / GDPR Art 9) HIPAA-45-CFR-164.508 · GDPR-Art-9 · GDPR-Art-7 · NHS-IG-Toolkit · Apache-2.0

Lifecycle of a patient consent record for processing of special-category health data. Aligned with HIPAA authorisation requirements and GDPR Art 9(2)(a) explicit consent.

1. Requested

   Consent request issued to patient.

   • Issue consent form with purpose, retention, recipients.
2. Granted

   Patient granted consent.

   • Capture granular scope (purposes, parties, retention).
   • Maintain easy revocation route.
3. Expired

   Consent expired per stated term.

4. Withdrawn

   Patient withdrew consent.

   • Cease processing + propagate revocation.

Prescription Lifecycle HIPAA-45-CFR-164.312 · GDPR-Art-9 · NHS-DCB0129 · NHS-DCB0160 · Apache-2.0

Lifecycle of an electronic prescription from clinician order through administration. Aligned with HIPAA, GDPR Art 9 (special category data), and NHS Digital DCB0129/0160 clinical safety standards.

1. Ordered

   Clinician issued prescription.

   • Capture prescriber identity + electronic signature.
2. Verified by pharmacist

   Pharmacist clinical check (interactions, dose, allergies).

   • Document clinical check (BNF / interactions).
3. Cancelled

   Order cancelled prior to administration.

   • Capture cancellation reason.
4. Dispensed

   Medication dispensed to patient / ward.

   • Capture lot, expiry, dispenser identity.
5. Administered

   Medication administered; closed loop confirmed.

   • Capture administered dose, route, administering clinician.
6. Returned

   Unused medication returned to pharmacy.

   • Capture return + destruction if controlled drug.

Prior Authorisation Lifecycle CMS-0057-F · HIPAA-X12-278 · ACA-Sec-1557 · ERISA-Claims-Procedure-29-CFR-2560 · Apache-2.0

Lifecycle of a payer prior-authorisation request for a treatment / device. Aligned with CMS Interoperability and Prior Authorization rule (CMS-0057-F) and HIPAA X12 278.

1. Requested

   PA request submitted by provider.

   • Persist 278 submission + clinical attachment.
2. Reviewing

   Medical reviewer assessing necessity.

   • Apply InterQual / MCG criteria; document outcome.
3. Denied

   PA denied; appeal rights communicated.

   • Issue denial with reason + appeal route.
4. Approved

   PA approved for stated period / units.

   • Issue approval with authorisation number + expiry.
5. Appealed

   Provider / patient submitted appeal.

   • Persist appeal + reviewer assignment.
6. Expired

   PA expired without use.

Insurance Claim Lifecycle FCA-ICOBS-8 · EIOPA-BoS-21-260 · Solvency-II-Art-44 · GDPR-Art-22 · Apache-2.0

End-to-end insurance claim from FNOL through adjudication and payout. Covers triage, investigation, fraud detection, payment, and litigation pathways. Aligned with FCA ICOBS and EIOPA conduct…

1. Reported

   First Notification of Loss (FNOL) received.

   • Capture FNOL with date, peril, policy ref.
2. Triage

   Coverage + initial fraud screen.

   • Verify coverage in force at loss date.
   • Run anti-fraud scoring.
3. Investigation

   Loss adjuster / SIU investigation.

   • Field adjuster report.
   • Photos, statements, police reports.
4. Denied

   Claim denied; reason + appeal rights communicated.

   • Document denial reason + appeal route.
5. Fraud flagged

   Fraud confirmed; referred to law enforcement / IFB.

6. Adjudicated

   Claim decision recorded.

   • Issue ICOBS-compliant decision letter.
7. Litigation

   Matter in litigation; reserves under Solvency II.

   • Hold IBNR / litigation reserve.
8. Paid

   Indemnity settled to policyholder / third party.

Insurance Policy Lifecycle FCA-ICOBS-2 · IDD-2016-97 · Solvency-II-Art-185 · GDPR-Art-13 · Apache-2.0

Lifecycle of an insurance policy from quote through termination. Covers binding, in-force monitoring, claims, renewal, lapse and cancellation.

1. Quoted

   Quote issued; not yet bound.

   • Persist quote with IPID / KFI.
2. Bound

   Cover bound; awaiting premium / activation.

   • Capture binding date + counter-signature.
3. Cancelled

   Policy cancelled (cooling-off, mid-term, insurer-cancel).

4. Active

   Policy in force.

   • Maintain in-force pack + endorsements.
5. Lapsed

   Policy lapsed for non-payment.

6. Claim in progress

   Active claim against the policy.

   • Link claim record to policy.
7. Expired

   Policy term expired without renewal.

Underwriting Case Lifecycle EIOPA-POG-2017 · Solvency-II-Art-46 · FCA-PROD-4 · GDPR-Art-22 · Apache-2.0

Lifecycle of an insurance underwriting case from submission through decision. Aligned with EIOPA POG (Product Oversight Governance) and Solvency II risk classification.

1. Submitted

   Submission received from broker / direct.

   • Persist submission + scheme classification.
2. Reviewing

   Underwriter assessing risk + pricing.

   • Document risk factors + scoring.
   • Log referrals to senior underwriting if exceeds authority.
3. Approved

   Risk accepted; quote issued.

4. Declined

   Risk declined; reason recorded.

   • Document decline reason (EIOPA POG).
5. Referred

   Referred to senior / reinsurer.

   • Capture reinsurer query + response if required.

Bill of Lading Lifecycle (UCP 600) ICC-UCP-600 · ICC-eUCP-2.1 · UNCITRAL-MLETR · Hague-Visby-Rules · Apache-2.0

Lifecycle of a (potentially electronic) bill of lading from issuance through endorsement and consumption under letters of credit. Aligned with UCP 600, eUCP, and MLETR.

1. Issued

   B/L issued by carrier.

   • Capture carrier signature + shipper details.
2. Presented

   Presented to bank under L/C.

   • Document UCP 600 compliance check.
3. Endorsed

   Endorsed in favour of consignee / holder.

   • Maintain endorsement chain.
4. Consumed

   B/L surrendered against delivery.

   • Capture surrender + cargo release.

Cargo Shipment Lifecycle (IMO / IATA) IMO-SOLAS-Ch-VI · IATA-DGR-65 · WCO-SAFE-Framework · EU-UCC-Reg-952-2013 · Apache-2.0

Lifecycle of a cargo shipment across sea / air. Aligned with IMO SOLAS VGM, IATA DGR, WCO SAFE Framework, and EU UCC.

1. Manifested

   Cargo declared on bill of lading / AWB.

   • Capture manifest with HS code + dangerous-goods class.
2. Loaded

   Loaded onto vessel / aircraft.

   • Verified Gross Mass per SOLAS VI/2.
   • Dangerous Goods declaration per IATA DGR / IMDG.
3. At sea

   In transit; AIS / ATA tracking.

   • Maintain transit tracking.
4. Customs held

   Held by customs for examination.

   • Capture hold reason code.
5. Customs cleared

   Cleared customs at destination.

   • Capture clearance + duties paid.
6. Lost

   Cargo declared lost; claim opened.

7. Quarantined

   Held for phytosanitary / health quarantine.

   • Capture quarantine authority decision.
8. Delivered

   Delivered to consignee; POD captured.

9. Damaged

   Damage recorded at delivery / inspection.

   • Surveyor report.

Customs Declaration Lifecycle (EU UCC) EU-UCC-Reg-952-2013 · EU-ICS2 · WCO-Data-Model-v3 · AEO-Programme · Apache-2.0

Lifecycle of an import / export customs declaration. Aligned with EU UCC, AES/ICS2 messaging, and WCO Data Model.

1. Filed

   Declaration submitted to customs.

   • Persist declaration + supporting docs.
2. Under review

   Customs risk-engine review.

   • Apply WCO risk indicators.
3. Cleared

   Cleared for release; duties settled.

   • Capture duty + VAT paid.
4. Seized

   Goods seized.

   • Issue seizure notice + appeal rights.
5. Amended

   Amendment filed.

   • Document amendment reason.

Chargeback Lifecycle Visa-Core-Rules-Disputes · MC-CR-Ch-7 · Reg-Z-12-CFR-1026.13 · PSD2-Art-74 · Apache-2.0

Lifecycle of a card-scheme chargeback case. Covers issuer notification, evidence collection, representment, and final adjudication.

1. Opened

   Issuer raised chargeback against merchant.

   • Persist chargeback notice + reason code.
2. Evidence required

   Merchant gathering representment evidence.

   • Compile compelling evidence per scheme rules.
3. Accepted

   Merchant accepted; no representment.

4. Defended

   Evidence submitted; scheme adjudicating.

   • Capture submission receipt from scheme.
5. Lost

   Merchant lost; debit final.

6. Won

   Merchant won; funds restored.

Payout / Disbursement Lifecycle PSD2-Art-83 · SEPA-SCT-RB-2023 · Faster-Payments-Scheme-Rules · NACHA-Rules-2024 · Apache-2.0

Lifecycle for an outbound payout to a beneficiary bank account. Covers queueing, execution against rail (SEPA / FPS / ACH / SWIFT), settlement, and return paths.

1. Queued

   Payout instruction queued.

   • Screen beneficiary against sanctions lists.
2. Executing

   Submitted to rail; awaiting acknowledgement.

   • Capture rail submission ID + ack.
3. Failed

   Rail rejected; reason captured.

4. Succeeded

   Funds confirmed credited.

5. Returned

   Funds returned by beneficiary bank.

   • Capture return reason code (e.g. AC04, AC06).

Refund Lifecycle PSD2-Art-76 · UK-CRA-2015-s.20 · Visa-Core-Rules-Refunds · Apache-2.0

Lifecycle of a refund issued against a settled payment. Covers approval, execution, dispute escalation.

1. Requested

   Refund requested by merchant or cardholder.

   • Capture refund reason + linked payment id.
2. Approved

   Refund approved; queued for execution.

   • Capture approver identity + timestamp.
3. Failed

   Refund rejected or rail failed.

4. Executing

   Sent to rail / scheme for processing.

   • Capture rail submission ID.
5. Dispute opened

   Payer escalated to dispute / chargeback.

6. Refunded

   Funds confirmed returned to payer.

Adverse Event Report Lifecycle (ICH E2B) ICH-E2B-R3 · EMA-EudraVigilance · FDA-FAERS · EU-GVP-Module-VI · Apache-2.0

Lifecycle of an Individual Case Safety Report (ICSR) from intake through regulator submission. Aligned with ICH E2B(R3), EMA EudraVigilance, and FDA FAERS.

1. Reported

   Case received from HCP, patient, or literature.

   • Persist intake source + minimum criteria.
2. Triage

   Seriousness + expectedness triage.

   • Assess seriousness criteria.
3. Assessed

   Causality + narrative compiled.

   • Document causality per WHO-UMC scale.
   • Compile case narrative.
4. Submitted to regulator

   E2B(R3) submitted to EudraVigilance / FAERS.

   • Capture submission ACK from receiving authority.

Clinical Trial Subject Lifecycle ICH-E6-R3-GCP · EU-CTR-536-2014 · FDA-21-CFR-312 · ICH-E2A-Safety · Apache-2.0

Lifecycle of a subject enrolled in a clinical trial. Aligned with ICH-GCP E6(R3), EU CTR 536/2014, and 21 CFR 312.

1. Screened

   Subject pre-screened against inclusion / exclusion.

   • Capture screening assessments.
2. Enrolled

   Eligible + consented; awaiting randomisation.

   • Capture signed Informed Consent Form (current version).
   • Document eligibility per protocol.
3. Withdrawn

   Subject / investigator withdrew.

   • Capture withdrawal reason + final assessment.
4. Randomised

   Allocated to arm via IRT/IWRS.

   • Capture IRT allocation ID + blinding context.
5. On treatment

   Receiving IMP / comparator.

   • Track protocol-visit adherence.
   • Account for dispensed/returned IMP.
6. Ae reported

   Adverse event recorded; safety follow-up active.

   • Capture AE per ICH E2A; SAE if serious.
7. Completed

   Completed final visit per protocol.

Drug Manufacturing Batch Lifecycle (GMP) EU-GMP-Annex-11 · FDA-21-CFR-11 · FDA-21-CFR-211 · EU-FMD-2011-62 · Apache-2.0

Lifecycle of a manufactured pharmaceutical batch from production through dispense / recall. Aligned with EU/US GMP, FDA 21 CFR Part 11 electronic records, FMD serialisation.

1. Manufactured

   Batch produced; awaiting QC release.

   • Compile executed batch record per 21 CFR 211.188.
2. Qc passed

   QP / QA certified release.

   • QP signature releasing the batch.
   • Serialise to FMD / DSCSA pack level.
3. Quarantined

   Batch held pending investigation.

   • Document quarantine trigger.
4. Shipped

   In transit through supply chain.

   • Monitor cold-chain excursions.
5. Recalled

   Batch recalled by manufacturer / authority.

   • Execute recall notice + reverse logistics.
6. Disposed

   Batch destroyed per controlled-substance / hazardous-waste rules.

   • Capture destruction certificate.
7. Received

   Received at wholesaler / pharmacy.

   • Verify FMD/DSCSA pack-level scan on receipt.
8. Dispensed

   Dispensed to patient; decommissioned in EMVS / DSCSA.

AML Suspicious Transaction Report Lifecycle EU-5AMLD-Art-33 · EU-6AMLD-Dir-2018-1673 · FATF-R20 · UK-POCA-2002-s.330 · Apache-2.0

Lifecycle of a Suspicious Transaction / Activity Report from internal alert through FIU submission. Aligned with EU 5AMLD/6AMLD and FATF Recommendation 20.

1. Flagged

   Internal alert raised by monitoring / staff.

   • Persist alert with model id + features.
2. Reviewing

   MLRO / financial intelligence team reviewing.

   • Document investigation steps + rationale.
3. Reported to fiu

   STR/SAR filed with FIU; tipping-off rules applied.

   • Capture FIU submission reference.
   • Ensure no tipping-off to subject.
4. Dismissed

   False positive; rationale documented.

   • Document dismissal rationale.

DORA Third-Party ICT Provider Lifecycle EU-DORA-Reg-2022-2554 · DORA-Art-28 · DORA-Art-29 · DORA-Art-30 · Apache-2.0

Lifecycle of an ICT third-party provider under EU DORA. Covers onboarding, criticality assessment, ongoing monitoring, and exit. Aligned with DORA Art 28-30 and the RTS on register of information.

1. Onboarded

   Provider contracted; register entry created.

   • Populate Register of Information per RTS.
2. Assessed

   Risk + concentration assessment in progress.

   • Pre-contract risk assessment per Art 28(4).
3. Tier classified

   Classified as supporting critical / important function (CIF) or not.

   • Document CIF classification.
4. Monitored

   Ongoing monitoring + testing in place.

   • Track service KRIs.
   • Participate in TLPT for CIF providers ≥ threshold.
5. Exited

   Contract exited per exit strategy.

   • Execute documented exit strategy.

GDPR Data Subject Request Lifecycle GDPR-Art-12 · GDPR-Art-15 · GDPR-Art-16 · GDPR-Art-17 · Apache-2.0

Lifecycle of a Data Subject Request (access / erasure / rectification / portability / objection) under GDPR Articles 12-22.

1. Received

   Request received via any channel.

   • Persist request + channel + timestamp.
2. Identity verified

   Subject identity confirmed.

   • Verify identity proportionately to request.
3. Refused

   Request refused per Art 12(5) (manifestly unfounded / excessive).

   • Document refusal reason + complaint right.
4. In progress

   Data discovery + processing of request.

   • Document scope + lawful-basis review.
   • Propagate to processors / sub-processors.
5. Completed

   Response delivered within 1-month statutory window.

   • Deliver response in machine-readable format if portability.
6. Extended

   Complexity extension invoked (max +2 months).

   • Notify subject of extension + reason within 1 month.

NIS2 Significant Incident Lifecycle EU-NIS2-Dir-2022-2555 · NIS2-Art-23 · ENISA-Incident-Reporting-Guidelines · Apache-2.0

Lifecycle of a significant cyber incident under EU NIS2. Covers detection, early warning, intermediate + final report to CSIRT/CA, containment, and post-mortem.

1. Detected

   Incident detected by monitoring / report.

   • Capture detection source + timestamp.
2. Triaged

   Significance + impact triaged.

   • Apply Art 23(3) significance test.
   • Submit early warning to CSIRT/CA within 24h.
3. Reported to csirt

   Notification submitted; intermediate report drafted.

   • Submit intermediate report within 72h.
4. Post mortem

   Post-mortem complete; lessons captured.

   • Publish lessons-learned + remediation plan.
5. Contained

   Containment confirmed; eradication in progress.

   • Document containment actions.
6. Resolved

   Service restored; final report due within 1 month.

   • Submit final report per Art 23(4).