Register & Machine

The register asks; the control graph answers. Both sides of the seam, in one purchase.

Pillar 06 Companion — The Enterprise Risk Register. Six lanes from the engagement that found a risk to the purchase order that closes it, a coverage matrix with decay-driven confidence, treatment as a budgeted project, and priced solutions ranked on time-weighted efficiency.

Pillar 01 Companion — The Living ISMS. The control graph: five planes, evidence that ages out on its own as a database view, an eleven-prompt agent layer with schemas your code can validate, and an MCP surface other agents can query.

Why the pair. The seam between them is deliberate and load-bearing. The register asserts that a risk is treated by control X; the control graph owns whether X is implemented, tested and evidenced. control_ref carries an id and six facts and never grows, precisely so the two stay separate products rather than collapsing into one bad one. Run the register without a control graph and you type an effectiveness figure that nothing backs; run the control graph without a register and you know your controls are real but not which risks they retire. Together, an asserted effectiveness is a claim something else can answer for.