The floor
What a Startup still does after inheritance, from its shared and owned Controls to the four signed acts that need a person and what its Customers must do.
A Startup's floor is what inheritance leaves it: the Controls it shares or owns, and the few acts that need a person. The floor is computed, never written, and changes as the Startup does.
How the floor is computed
After every Change, resolution runs from the platform down. The Controls that land shared or owned in the Startup's namespace form its floor. The rest are inherited and ask nothing of it.
The operating model shapes the floor. An Autonomous Startup carries no human-only Controls, because it seats no Human. A Multi-human Startup adds background checks, a signed acceptable-use Agreement per person, and access removal on the day someone leaves.
The people Controls have an agent side too. An agent's competence is a pinned model and instruction Version with a passing eval record, tested by Worker competence.
The human floor
Four acts per report period need a person, because the standard asks for a signature:
- An officer approves the security and privacy policies.
- An officer accepts the risk assessment.
- The board, or the sole director, records its oversight.
- An officer signs the management assertion that the system description is accurate.
Each act is a Decision signed by an officer of the Startup's Company. The assertion is pinned to the hash of the system description it covers, so it cannot drift from what it signed.
Agents prepare every act. They draft the risk assessment from the Startup's records and list what changed since the last one. A person reads and signs.
Who signs
A Startup held by a Studio's holding Company has its acts signed by the officer desk, for every Startup the Studio holds, in one batch. A self-serve founder signs for their own Company. After graduation, the cofounders sign.
Who signs lists every act and its signer.
Customer controls
The same computation runs one level down. A Startup is a customer in the platform's report, and its own Customers are customers in the Startup's report.
What a Customer must do for the Controls to work prints in the Startup's report as customer controls. A contract-tracking app for small agencies, for example, asks each agency to keep its own sign-in secure and remove departed staff from its Tenant.
Two floors
The legal floor lists legal obligations and what wakes them, such as CAN-SPAM at a first commercial email. The Control floor lists Controls.
An obligation can sit on both. Governance is the legal side of the officer's signatures above.
Next
- How proof works: how the floor's Controls are tested.
- Auditors: how a firm samples the human floor.