Resources
Everything Tectori publishes is free to read and free to use. This page points to the right starting place depending on the problem in front of you, and defines the terms the rest of the site uses.
Reading paths
Start with audit-ready IT for how a requirement becomes a control and then evidence. Then compliance and risk management for the work itself. The risk register and board update templates in the free tools are usable today.
Start with AI governance for the accountability model, then agentic AI orchestration for how it is built and documented.
Start with how we work, then fractional CIO and CISO leadership for what the role covers and what it does not. The FAQ answers the questions that usually come next.
Templates and tools
Tectori publishes working tools rather than descriptions of them. Automation for Active Directory, Azure, and Microsoft 365, security program templates, evidence tooling, and reference material are all on GitHub under open licenses.
The list, with what each one does, is on free tools.
Glossary
The state where the records an examiner asks for already exist, because operating the system produced them.
Something you do, or something a system enforces, that reduces a risk. A control has an owner or it is a statement.
The record that proves a control operated. A log, an approval, a review sign off, a test result.
The link between a requirement in a framework, such as FFIEC or HIPAA, and the control that satisfies it.
A check of what is missing, what is partial, and what is already satisfied, measured against a named framework.
A living list of risks with owners, ratings, treatment decisions, and review dates.
A recorded decision to accept a control not being met, with a reason, an owner, and an end date.
The risk carried by vendors and service providers, reviewed before signing and again on a cycle.
The plan for continuing to operate through a failure, tested rather than assumed.
Giving an account only the access its work requires, and removing what it no longer needs.
A periodic check of who has access to what, why, and whether it should continue.
A short written note of what was decided, by whom, on what basis, and how to reverse it.
A written procedure for work that repeats, detailed enough for someone else to follow.
AI that takes actions rather than only producing text. It needs approval gates, monitoring, and a stop path.
