Annual Risk Assessment — No customer selected

CyRoadmap Risk Model: Risk Score = Likelihood × Impact (1-25). Risks are drawn from real Tracker gaps plus standard industry risks. Set the customer's Website/Industry above for the most accurate company profile.

Governance Meeting Log — No customer selected

Track key governance meetings — e.g. Risk Assessment Review with Executive Leadership, ISO/IEC 27001 Management Review (Clause 9.3), or Internal Audit Results Review. Selecting a meeting type below auto-loads the standard agenda items for that meeting.

Compliance Tasks Not Tracked by the Roadmap

A lightweight to-do list for governance work the GRC tracker doesn't cover on its own — internal audit prep, threat briefings, and similar recurring items.

ISO Nonconformity & Corrective Action Tracker — No customer selected

Log and track nonconformities per ISO/IEC 27001:2022 Clause 10.2 (and the equivalent ISO 9001 Clause 10.2): react to the nonconformity, evaluate the need for corrective action, implement it, review its effectiveness, and update the risk register if needed. Findings from internal/external audits, management review, incidents, or complaints all belong here.

Security Impact Analysis Tracker — No customer selected

Analyze and document the security impact of changes before implementation — hardware, software, configuration, network, or access changes that could affect the confidentiality, integrity, or availability of CUI or the environment. Maps to NIST SP 800-171 / CMMC 3.4.4 (Analyze the security impact of changes prior to implementation) and ISO/IEC 27001:2022 Annex A 8.32 (Change Management — safeguarding information assets when making changes to information processing systems and facilities).

Secure Code — Free Vulnerability Scanning for GitHub

"Secure by design" isn't just a policy statement — it means checking for vulnerabilities in the pipeline itself, before code ships, and testing the running application the way an attacker would. These four free, no-license-required tools cover the places vulnerabilities most commonly hide: the code your team writes, the third-party dependencies it pulls in, secrets that get accidentally committed, and the live application itself. The first three run automatically in GitHub Actions on every push and pull request; the fourth scans your deployed app.

The guide includes copy-paste-ready GitHub Actions workflow files and config for all four tools, plus notes on what each flag does, where the free tier's limits are, and why ZAP needs a deployed environment rather than just the repo.

Project Plan — No customer selected

Pick the compliance framework this customer is working toward, set a start date, and generate a phased project plan you can track to completion right here. Export a copy any time to share with the client.

Export Options

The IT Director Report has moved to the Reporting tab. The Risk Assessment now lives in its own tab.

Tip: Use the ★ column in the Tracker tab to flag tasks for the board deck's detail slides.