Program

A working GRC program is a chain: risk, controls, evidence, reporting. A finding at one step becomes the work of the next. Every step below is a room in this console — start at the top or jump straight to the step you need.

Policy Tester

Four short lessons. Each one starts broken on purpose. Pick a lesson, press run and watch it fail. Then apply the fix — by hand or with one click — and run it again to watch it pass. You cannot break anything here.

The policy tester is adapted from the open-source GRC Playground by Ashley Pearce (MIT). Scenarios and page by Terafram.

Practice Lab

Pick a scenario. Read the situation and the evidence, then commit to a call. The auditor's conclusion waits behind your answer. You can revisit any scenario — your latest call is the one that counts.

Frameworks

The frameworks are the lenses. The work underneath them is one set of 29 controls. A Full Scan answers those controls once and the result reads against every framework the controls honestly reach — no framework is handed a number its evidence did not earn.

Risk Register

Findings become risks here. A failed policy lesson raises a risk. A scenario the auditor calls Not operating raises a risk. Rate each one, choose a treatment and watch the register clear as the causes get fixed.

Policy Pack

Terafram keeps two sets of policies. Part I is the house set — the fourteen policies Terafram itself runs on, approved on 25 October 2026 and in force today. Part II is the client set — templates for programmes such as HIPAA and PCI DSS, issued to a client organisation for its own adoption, with an auditor guiding the work. This room is the register of both sets.

Trilogy Lab

This room runs on one chain, in this order: Policy → Controls → Risk → Remediation → Report Generation. Policy is the foundation. Controls are tested against it. Findings become risks. Risks get remediated. The report is generated from what actually happened. No step is skipped and none is reordered.

Every station below is real execution. The documents are the approved policies themselves, quoted word for word. The tests run on the live engine. The register and the report are the same ones the rest of this console uses. There are no invented scenarios here and no answer keys written for the occasion — where a station checks your work, the ground truth is a real document or a real manifest — and the reveal quotes it.

The policies quoted in this room are the approved Terafram documents. The engine is the same live engine the Policy Tester uses. What you type into the builders stays in this page — it is never stored and never sent anywhere except the engine calls the tester already makes.

ISO 42001 Board

This board tracks the session's own work against the structure of ISO/IEC 42001 Annex A — the standard's nine objectives and its 38 controls. A row moves only when the work that evidences it actually happens in this console. Conclusions here are the lab's verdicts on session work — they are not a certification claim, for anyone, ever.

The 42001 Academy — learn it by running it

Twelve modules across five phases. Every module's lesson is a real Terafram document, its lab is a real execution in this console, its artefact is a real output and its check is a judgement against a real text. A module completes when its lab event really happens in this session — the same events that move the board above. The session report, sealed, is the academy's final artefact.

One honest note on shared work: a single piece of work can complete two modules where the work is genuinely the same. The plan built at Trilogy Station 4 completes both 2.2 and 4.1 — the plan is where the interested parties get named and where competence gets planned, so one artefact honestly carries both.

Nothing on this board is stored. Leave the page and every row returns to Not tested — the evidence was the session itself.

Evidence & Results

The register for this visit. Every policy run keeps its full engine output as its evidence. Every lab judgement keeps your call beside the auditor's call.

AI Data Readiness

AI Data Readiness — which assets are safe to feed into AI / LLM training, RAG or prompts — plus what must be masked or excluded. Sensitive and regulated data is the risk. This register is a sample: it shows the shape of the review. It does not evaluate any real system.