Federal_Resources_Corporation-FRC_Section6_Technical_Requirements.pdf

Section 6: Technical Requirements State of Wisconsin

Department of Administration

Governance, Risk, and Compliance Tools Reference # 28443-SM

Response Date: September 3, 2025, 2PM CT

Submitted To:

Submitted By:

State of Wisconsin Department of Administration State Bureau of Procurement PO Box 7867 Madison, WI 53707-7867

Attn: Susanne Matschull Susanne.matschull@wisconsin.gov 608-266-9796

Federal Resources Corporation (FRC) Small Business 153 E. 13th Street, Ste 1100 Erie, PA 16503 Phone: (814) 636-8020 Fax: (301) 990-1378

DUNS: 102932709

CAGE: 1QBT0

UEI: FZK7KZZJYNQ9

FRC Point of Contact:

Chris Zeiders, VP of Technology 703-795-3257 czeiders@fedresources.com

This response includes data that shall not be disclosed outside the Government and shall not be duplicated, used, or disclosed – in whole or in part – for any purpose other than to evaluate this response. This restriction does not limit the Government’s right to use information contained in this data if it is obtained from another source without restriction. The data subject to this restriction are contained in all sheets.

mailto:Susanne.matschull@wisconsin.gov

Federal Resources Corporation | Reference # 28443-SM Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

PAGE

TABLE OF CONTENTS

Introduction

6.1 Project Approach

1. Automation Engine for Evidence Collection and Supporting Continuous Assessment

2. Workflow Automation for GRC Processes (e.g. Risk Assessments, Control Attestations, Policy Exceptions, Plan of Action & Milestones (POA&M))

3. Custom Framework and Policy Support to Address State and Partner Statutes and Policies

4. Mappings to Controls and Benchmarks like CIS Level 2 Hardening Standards and NIST CSF, and Control

Baselines

5. Executive Dashboards, Agency Organization Dashboards, Operational Reports, and Audit Artifacts

6. FedRAMP Authorization Status Dedicated Resources and Tools

6.1.1 Project Plan

6.1.2 Identification of Risk

6.2 Tools and Methodologies

A. Information Gathering Process B. Draft Implementation Plan C. Development of Required Deliverables D. Testing of the Developed System E. Deployment of the Developed System

6.2.1 Data Migration Strategy

6.2.2 Software Development Life Cycle Methodology

6.3 Role-Based Access Controls

6.4 Implementation

Appendix: Mapping to the Scope of Work Mapping to Section 1.3 – Scope of Work Mapping to Section 1.3.2 – Existing Interfaces Mapping to Section 1.4.1 – Business Objectives Mapping to Section 1.4.2 – Organizational Requirements Mapping to Section 1.4.3 – Functional Requirements

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

INTRODUCTION

Federal Resources Corporation (FRC) is pleased to submit this response detailing our capability to the State of Wisconsin, Department of Administration (DOA) in support of the Governance, Risk, and Compliance (GRC) Tools Requirement (Reference # 28443-SM).

FRC is a small business, headquartered in Erie, PA with employees throughout the United States. Founded in 1998, FRC has a proven track record as a mission-focused aggregator of cybersecurity and privacy products as well as in delivering solutions tailored for US Federal, State, and Local Government mission environments. FRC employs experts in areas such as networking, cloud computing, cybersecurity, mobile solutions, internet of things, industrial control systems, and managed security services. Not your typical technology reseller, we pride ourselves on building productive working relationships with our customers and technology partners. FRC offers the DOA an aggregation of best-of-breed technologies and services required to deliver a best practice for today’s cloud and networking landscape, as well as anticipating ongoing changes in that landscape to ensure the delivered solution has longevity, scalability, and flexibility.

FRC was recently named to the Inc. 5000 Fastest Growing Private Companies list for the fourth year in a row, boasting an 827% 3-year growth. FRC also holds an ISO 9001:2015 certification, has been appraised at CMMI Maturity Level 3, and has a Top-Secret Facility Clearance.

Beyond the best-in-class technology, FRC brings significant value to this effort. As a small business, FRC is flexible and nimble in its business methodologies. FRC specializes in aggregating technologies to streamline procurement for our customers and has extensive experience in working with customers to scale creatively and efficiently across work sites or business units, utilizing bundled SKUs and optional CLINs to simplify procurement for customers.

FRC has partnered with TrustCloud to present its next-generation Security Assurance Platform to the State of Wisconsin. TrustCloud (https://www.trustcloud.ai/) transforms governance, risk, and compliance (GRC) from a legacy, manual, check-the-box activity into a modern, automated, strategic business enabler. It empowers organizations to unify continuous control assurance, real-time risk quantification, third-party assessments, audit readiness, and customer and regulatory facing trust operations into one seamless, AI-and API-powered platform – delivering resilience and assurance to its customers.

We will refer to FRC and TrustCloud as “Team FRC.”

6.1 PROJECT APPROACH

Team FRC’s approach provides more than just a GRC tool; we deliver a strategic platform to transform Wisconsin's risk and compliance management. By leveraging the TrustCloud platform, we will move the State from periodic, manual assessments to a state of continuous, automated audit readiness. Our methodology focuses on deep integration with your existing systems, providing actionable intelligence through executive dashboards, and empowering each state agency with streamlined workflows. This solution will not only enable compliance with state and federal standards but will also reduce administrative overhead, allowing Wisconsin’s agency teams to focus on proactive risk mitigation.

We provide a completed Attachment C: Functional System Compliance Matrix as part of this proposal package. Below, we detail how our platform and service will accomplish the work outlined in the project scope.

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

1. Automation Engine for Evidence Collection and Supporting Continuous Assessment

Team FRC will deliver the TrustCloud platform that achieves the following:

a. Direct System Integration - We will leverage a library of over 100 pre-built, API-based connectors to directly integrate with the State’s existing systems (as described in Table 1 below.). These integrations feed live configuration and telemetry data into TrustCloud’s monitoring engine. These integrations use secure, read-only permissions to automatically gather configuration data, user lists, and other digital evidence without impacting system performance.

b. Continuous Control Testing - We will leverage one of TrustCloud’s core modules, named TrustOps, which is the automation engine that continuously runs tests against the integrated systems to validate that security controls are implemented and operating effectively. Instead of relying on static screenshots or point-in-time evidence, Wisconsin will be able to have real-time, continuous assessment. Tests are run on a schedule defined by the agency (e.g., daily, weekly, monthly) to verify if controls are passing.

c. Automated Evidence Association - We will automatically collect and map evidence to the relevant security controls across frameworks. For example, evidence of a Wisconsin server’s encryption status is collected and automatically applies to relevant requirements in NIST CSF, CIS Benchmarks, and custom State policies/frameworks.

Table 1: Integrations with each of the interfaces in the RFP Interface Key Aspects

ServiceNow (ITSM, CMDB, IRM, SecOps, etc.)

• Retrieve tickets as evidence for controls.

• Push tasks into ServiceNow and bi-directionally track to automate workflows

(e.g., gap remediation, risk treatment, and periodic evidence collection)

• Retrieve asset inventories from ServiceNow CMDB for continuous control and asset monitoring.

SolarWinds Ingest system configuration and health status to continuously monitor and test controls related to infrastructure health and secure configuration.

The National Vulnerability Database (NVD)

Ingest CVE and threat intelligence to trigger activities such as a risk assessment or re-evaluation of controls.

The Unified Compliance Framework (UCF)

Map (harmonize) the UFC mapped controls with the TrustCloud TCCCF, supporting the “test once, comply many” controls approach.

Riskonnect Synchronize operational and enterprise risk registers/risks.

Splunk Ingest security events and alerts from Splunk as evidence for control effectiveness.

Tenable IO Ingest vulnerability scan results and asset data to create findings.

OSCAL Packages Ingest OSCAL-formatted security authorization packages to build system profile, control baseline.

Security Authorization Package Documentation (i.e., SAP, SSP, SAR, POA&M)

Export OSCAL-compliant formatted authorization documentation for interoperability with other systems.

Okta Ingest identity, access, and authentication policy to continuously monitor Identity and Access Management (IAM) controls, including Multi-Factor Authentication, password rules, accounts.

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

Crowdstrike Ingest telemetry for endpoint (and other if applicable) for evidence collection.

Azure DevOps Bidirectional synchronization of remediation tasks.

Jira Use Jira ticket details as evidence and enable automatic Jira ticket creation.

Github Collect source code repository settings and security alerts to validate controls.

O365, SharePoint, PowerBI Ingest collaboration and data security configuration settings. Also used for documentation and data management. Leverage PowerBI for exporting GRC data.

Figure 1 below depicts an example of what Wisconsin will be able to perform with our solution. In this example, a company named “EarnTrust” automates the evidence collection of enforcing Multi-Factor Authentication (MFA) into the users of the company’s GitHub account. The system will automatically collect evidence by integrating with GitHub’s system and automatically conduct tests to validate that the security control for MFA passes. As the bottom shows, 62% of the users failed the MFA control, thereby allowing a remediation plan to occur.

Figure 1: Example Control Testing Report

KEY BENEFIT TO WISCONSIN

This proactive approach fundamentally changes the nature of audits. For Wisconsin, this means no more year-end fire drills, a dramatic reduction in the manual effort required for evidence collection, and the confidence of being prepared for an audit at any time.

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

2. Workflow Automation for GRC Processes (e.g., Risk Assessments, Control Attestations, Policy Exceptions, Plan of Action & Milestones (POA&M))

Team FRC will provide robust, configurable workflows to manage the GRC lifecycle, enabling Wisconsin to convert GRC processes from manual, multi-step procedures into automated, auditable, and accountable actions. This ensures that the right tasks get to the right people at the right time, eliminating bottlenecks and manual follow-up. We will automatically create compliance activities—like control tests, policy approvals, and attestations—into discrete, actionable tasks. When something requires attention, the system will proactively alert the relevant Wisconsin team member(s). These tasks can be integrated into collaboration tools already used (e.g., Microsoft Teams, Slack, JIRA, ServiceNow, BMC Redemy, etc.) for automatic communication. For Wisconsin’s use of ServiceNow, TrustCloud delivers AI-powered Continuous Control Monitoring into the existing ITSM or CMDB - automating GRC workflows.

a. Risk Assessments - Wisconsin will be able to automate risk assessments by continuously evaluating real-time control status and treatment plans. Risks will be assigned to owners based upon defined rules/roles and will automatically prioritize/track actions as tasks. A key strength of this approach is that the system will keep relevant stakeholders engaged without manual nudging or follow-up.

b. Control Attestations - Our solution will enable Wisconsin to conduct both automated testing–running controls at set intervals and fetching evidence via integrations–and manual self-assessments. When a manual control attestation is required, we will generate a task instructing the person responsible to upload or link appropriate evidence. This will keep governance both tracked and auditable for both automated and manual attestations.

c. Policy Exceptions - Wisconsin will be able to exclude specific controls, tests, or resources that are not applicable directly though the TrustCloud UI. Aligned with best practices, an exception will require a documented exclusion justification for audit-friendly visibility.

d. POA&M - Wisconsin will be able to continuously evaluate real-time control status and plans of action to track mitigation actions as tasks. The platform offers dashboards that surface prioritized tasks, control adherence status, risk registers, policy attestation progress, automation health, and more— all in one place.

TrustCloud transforms GRC from a series of manual check-ins into a continuous, coordinated, and accountable workflow. By combining AI, programmatic risk scoring, automated evidence collection, policy management, and task orchestration within the tools your team already uses, TrustCloud ensures that risk, compliance, and audit readiness become seamless parts of your daily operations.

KEY BENEFIT TO WISCONSIN

Ultimately, this automation transforms GRC from a burdensome administrative task into a strategic, data-driven function for the State. It provides Wisconsin with a single, auditable system that ensures operational efficiency, clear accountability, and real-time visibility into its risk and compliance posture.

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

Figure 2 below depicts a UI of a Risk Assessment within the platform’s Risk Register. Wisconsin can anticipate, analyze, and mitigate risks by conducting structured risk assessments, enabling proactive risk management through a system/project’s lifecycle. This includes identifying the risk, documenting the impact and likelihood, and reviewing scheduling. Table 2 below shows the workflow automation features available within each process area.

Figure 2: Example Risk Assessment Registers

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

Table 2: Workflow Automations Process Area Workflow Automation Features

Risk Assessments Continuous scoring, risk prioritization, owner assignments

Control Attestations

Scheduled automated testing and manual self-assessments with task-driven evidence collection

Policy Approvals Auto-generated policies, ownership, structured approvals/tasks with tracked review cycles

Policy Exceptions Exclusions with required business justification and audit-friendly visibility

POA&M

Exceptions

Exclusions with required business justification and audit-friendly visibility

Task Management

Alerts and tasks distributed through TrustOps and synced with tools like Jira/Slack/ServiceNow

Dashboards & Alerts

Unified insights into tasks, risks, compliance status, and exceptions

3. Custom Framework and Policy Support to Address State and Partner Statutes and Policies

Our platform is designed to adapt to the State of Wisconsin’s unique regulatory landscape, allowing Wisconsin to manage both standard and custom compliance frameworks within a single system.

Wisconsin can upload or build custom frameworks to address specific state statutes, agency policies, or partner agreements. Our platform provides a simple template to define the framework's structure, sections, and requirements.

Once a custom framework is created, our AI-powered mapping assistant suggests relevant controls from our common control library, drastically reducing the manual effort required to align policies with the new framework. Creating custom controls is seamless and includes test definitions and standard mappings.

Wisconsin can map both existing controls and custom controls to each subsection. Policies can also be linked to each section or subsection of the framework. This ensures that custom state requirements are fully integrated into your continuous monitoring and reporting activities. Figure 3 describes the process of creating custom frameworks and policies in TrustCloud.

KEY BENEFIT TO WISCONSIN

This capability provides Wisconsin with the critical flexibility to manage its unique state statutes and agency policies within a single, unified system. Our AI-powered tools dramatically reduce the manual effort of this process, ensuring that Wisconsin-specific requirements are monitored with the same automated rigor as standard federal frameworks.

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

4. Mappings to Controls and Benchmarks like CIS Level 2 Hardening Standards and NIST CSF, and Control Baselines

TrustCloud supports a robust portfolio of 20+ out-of-the-box compliance standards, spanning security, privacy, IT governance, and risk management—all accessible through the TrustCloud Common Control Framework (TCCCF). The following list identifies these standards:

● CIS Level 2 ● CMMC Levels 1 & 2 ● CIS 18

● NIST CSF ● SOX ITGC ● ISO 9001

● SOC 2 ● FedRAMP ● StateRAMP

● ISO 27001 ● NIST SP 800-171 ● FISMA

● PCI-DSS ● HIPAA ● ISO 27701

● ISO 42001 ● NIST AI RMF ● HITRUST

TrustCloud supports a broad, continually expanding set of core compliance standards and makes it simple to extend into custom frameworks. All of this is harmonized under the TCCCF, enabling efficient, scalable, and auditable compliance across your organization. Figure 4 shows the controls mapped to the NIST CSF and provides an audit readiness score for the organization.

Figure 3: Pathway to scaling and ensuring custom framework and policy support.

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

Figure 4: Controls mapped to NIST CSF and Audit Readiness

5. Executive Dashboards, Agency Organization Dashboards, Operational Reports, and Audit Artifacts

Team FRC will leverage TrustCloud to provide tailored visibility for different stakeholders, from executive leadership to agency managers, operators, and auditors. Table 3 describes these dashboards, key aspects, and benefits to Wisconsin. Figures 5, 6, and 7 showcase a variety of dashboards for different user profiles.

Table 3: Dashboard Options Available Item Key Aspects Benefits

Executive Dashboards

• High-level dashboards that distill compliance data into business-centric metrics and KPIs.

• Tailored for CISO and Executives.

• View overall risk postures.

• See compliance trends over time.

• Understand how GRC activities support the

State’s strategic objectives.

KEY BENEFIT TO WISCONSIN

This provides Wisconsin with immediate access to a robust library of industry-standard frameworks like NIST and CIS, saving significant setup time. The core benefit is our Common Control Framework, which enables a “test once, comply many” approach that drastically reduces redundant work and simplifies demonstrating compliance across multiple overlapping regulations.

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

Agency Organization Dashboards

• Intuitive UI to structure each agency’s org chart by department, business unit, location, etc.

• Maintains relationships between standards, controls, policies, and systems.

• Monitor agency organization specific compliance tasks, control status, and risk posture.

• Compliance teams can adapt their GRC structure, aligning governance requirements with agency operations.

Operational Reports

• Track control status (passing, failing, untested, planned), evidence availability, and policy approval progress.

• View open remediation tasks and policy exceptions.

• Ensure real-time monitoring, task prioritization, risk tracking, and compliance transparency.

• Surface tasks to stakeholders for action.

Audit Artifacts

• Visualizes audit readiness by standard, highlighting control/evidence/policy status, with the ability to drill down, review details, and initiate self-service audits.

• Bulk export of audit evidence and control mappings, enabling efficient artifact preparation and delivery for auditors.

• Audit artifacts are captured, organized, shared, and reviewed in a streamlined, collaborative, and auditable manner.

• Review artifacts directly, significantly reducing evidence requests and audit back-and-forth.

KEY BENEFIT TO WISCONSIN

This provides tailored, role-based intelligence that translates complex compliance data into actionable insights for every stakeholder, from the CISO down to agency operators. This ensures leadership can make strategic, data-driven decisions while operational teams can prioritize remediation and auditors can prepare for audits with unparalleled efficiency.

Figure 5: Audit readiness dashboard

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

Figure 6: A dashboard for a non-technical user.

Figure 7: A dashboard translating risk insights into Business Impact for Executive and Organization Leaders.

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

6. FedRAMP Authorization Status

TrustCloud is not currently FedRAMP Authorized. However, our platform is designed to securely support state and federal clients by aligning with the foundational security standards that underpin FedRAMP. As evidence is our successful delivery for the State of New Mexico and commercial customers in highly regulated environments.

The TrustCloud platform is specifically designed to meet the rigorous security requirements of state and federal clients. Our security-first design, which focuses on processing compliance metadata rather than sensitive operational data, aligns perfectly with the needs of a GRC system and is supported by our active SOC 2 Type II and ISO 27001 certifications. While TrustCloud is not FedRAMP authorized, our internal security program is built upon the same NIST 800-53 controls that underpin FedRAMP, demonstrating our commitment to best-in-class security.

To ensure the security of Wisconsin’s data, we provide the following assurances:

• Alignment with NIST Standards: Our internal security program is built on NIST SP 800-53 and NIST SP 800-171, the very frameworks that form the basis for FedRAMP.

• Third-Party Attestations: We hold active SOC 2 Type II and ISO 27001 certifications, which are independently audited attestations of our security controls and practices.

• GovCloud Compatibility: Our platform is fully capable of being deployed in a GovCloud environment to meet federal and state data residency and security requirements.

We are prepared to provide all necessary documentation and third-party assessments to demonstrate that our security posture meets the State of Wisconsin’s requirements for handling GRC data.

Dedicated Resources and Tools

To accomplish this work, Team FRC will provide a dedicated implementation team alongside the powerful TrustCloud platform.

Team Members:

• Contract / Project Manager

• Technical / Security Lead

• Solution Architect

• Customer Success Manager / Implementation Lead

• Trainer (optional, as needed)

KEY BENEFIT TO WISCONSIN

This provides Wisconsin with the assurance of a highly secure platform, as our internal security program is built on the same foundational NIST standards that underpin FedRAMP. Our active SOC 2 and ISO 27001 certifications provide independent, third-party validation that the State’s GRC data is protected by an architecture designed for the needs of government clients.

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

Primary Platform: TrustCloud Platform will serve as the GRC solution.

Collaboration Tools: Details on the use of the tools are described in Section 6.2. The tools included will be aligned with the tools used by Wisconsin state agencies:

• Communication: Microsoft Teams, Slack, Email and Telephone

• Virtual Meetings: Microsoft Teams, Google Meet, or Zoom

• Project Tracking: Project Plan, Excel

• Design: Miro, Microsoft Office, or Google Workspace enterprise suite

6.1.1 PROJECT PLAN

Our implementation approach is designed to deliver value quickly while building a scalable GRC solution tailored to Wisconsin’s needs. We will apply our proven methodology—successfully used for government agencies like the State of New Mexico and major enterprises like Schneider Electric and ServiceNow—to ensure the State of Wisconsin becomes compliant and audit-ready efficiently.

We estimate a 10–12 week rollout is typical to progress from kickoff to full enablement. Our approach will accelerate Wisconsin's adoption through:

• Automating evidence collection & control testing early

• Embedding tasks into your existing collaboration platforms (e.g., ServiceNow, JIRA) to minimize user friction

• Providing role-based dashboards for executives, compliance teams, engineers, and auditors

• Welcoming and engaging with Wisconsin personnel throughout the process to ensure knowledge transfer and team enablement.

Figure 8 below describes a notional 10-week project plan for enabling Wisconsin with the TrustCloud GRC Solution.

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

Figure 8: Indicative 10-week Project Plan

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

Table 4 highlights key deliverables in each step of the project plan.

Table 4: Key deliverables and timeline Phase Key Deliverables Estimated Hours

Step 1: Kickoff & Environment Setup

Tenant, SSO, RBAC, org structure 1 week duration | 20-30 hours

Step 2: Integrations & Data Fabric Connected systems, Smart Inventories 3 week duration | 60 - 90 hours

Step 3: Frameworks & Policies Controls mapped, policies generated 3 week duration | 60 - 90 hours

Step 4: Continuous Control Monitoring Setup

Automated testing, task workflows 4 week duration | 80 - 120 hours

Step 5: Risk Management Setup Risk register, risk owners, assessments 4 week duration | 80 - 120 hours

Step 6: Audit Management Enablement

Readiness dashboards, auditor access 4 week duration | 80 - 120 hours

Step 7: Executive Dashboards & Reporting

BI dashboards for execs and org units 3 week duration | 60 - 90 hours

Step 8: Training, Handoff, & Continuous Improvement

Role-based adoption, Assurance AI tuning

1 week duration or longer based on need | 10-20 hours

6.1.2 IDENTIFICATION OF RISK

Based on our experience supporting customers similar to the State of Wisconsin, implementing a GRC Tool is more than configuring software. Rather, it is a strategic “change management” initiative that involves collaboration compliance, IT, security, and business teams. To ensure a successful project for the State of Wisconsin, we use a structured and proactive approach to risk management, drawing from our Agile delivery model and deep implementation experience.

This process ensures transparency, minimizes surprises, and keeps the project on track to deliver value quickly.

Table 5 identifies the methods we will use to identify risks to the project’s success and Table 6 describes strategies we will use to mitigate risks to implementation.

Table 5: Methods to identify risks to implementation success.

Method to Identify Risks

Detailed Activity

Risk Workshops & Stakeholder Interviews

• Conduct facilitated workshops with compliance, IT, security, and executive stakeholders.

• Capture concerns about scope, timelines, integrations, or user adoption.

Implement Risk Register

• A dedicated TrustRegister instance can be used to log, categorize, and score risks specific to the implementation.

• Each risk gets likelihood and impact ratings, with assigned owners.

Agile Sprint Reviews & Retrospectives

• Risks are surfaced incrementally during sprints rather than only at the end.

• Blockers (e.g., an integration delay, missing data) are flagged and treated as risks.

Dependency & Integration Analysis

• Review system dependencies (e.g., AWS, Okta, Jira, ServiceNow).

• Identify risks tied to access issues, API limitations, or conflicting configurations.

Historical Lessons Learned

• Use Team FRC’s experience with similar enterprise deployments to preempt risks (e.g., underestimating policy review cycles, or change resistance).

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

Table 6: Strategies to mitigate implementation risks.

Strategies to Mitigate Risks

Detailed Activity

Scope & Timeline Control

• Implement Agile sprints to divide deliverables into manageable increments.

• Prioritize "quick wins" like a SOC 2 readiness dashboard to show early value.

Clear Ownership & Accountability

• Assign risk owners for each identified risk in TrustRegister.

• Track mitigation actions as tasks routed via Jira/Slack

Parallel Access & Phased Rollouts

• Maintain access to legacy GRC tools during migration to reduce disruption risk.

• Roll out integrations in phases (cloud first, then SaaS apps, then custom/on-prem).

Continuous Monitoring & Feedback

• Use dashboards to track readiness, control health, and risk register status.

• Hold bi-weekly retros to reassess risks and adapt the plan

Change Management & Training

• Provide role-based training (executives, auditors, engineers) to reduce adoption resistance.

• Use TrustCloud’s intuitive UI and Slack/Jira task integrations to minimize learning curve risks.

Below is illustrative example of how these risk methods and mitigations will be applied.

Scenario: A large enterprise is migrating from spreadsheets and a legacy GRC system into TrustCloud.

• Risk Identified: “Integration with ServiceNow for task management may fail or be delayed, causing compliance tasks to go unnoticed.”

• Method Used: Risk Discovery Workshop and Risk logged in TrustRegister during discovery workshop, scored as High Likelihood, High Impact.

• Mitigation Strategy:

o Sprint plan adjusted to pilot ServiceNow integration early with a smaller scope (incident tickets only).

o Backup workflow defined: Compliance tasks also routed to Slack as alerts in case of ServiceNow delays.

o Integration test cases tracked in Jira → failures logged automatically.

• Result: ServiceNow integration stabilized by Sprint 3, but compliance tasks were never missed thanks to Slack fallback.

6.2 TOOLS AND METHODOLOGIES

The TrustCloud Agile implementation process takes the following agile approach, and uses the tools and plans described in each section.

Team’s FRC Implementation uses:

• Methodologies: Agile sprints, ADRs for architecture, iterative cutovers, UAT + continuous testing.

• Development Tools: TrustCloud API/SDK, GitHub/GitLab, Terraform/CloudFormation.

• Communication Tools: Slack, Microsoft Teams, Confluence, Jira.

• Bug Tracking Tools: Jira, ServiceNow (for larger enterprises).

• Testing Tools: TrustCloud’s Continuous Control Monitoring, Postman (API), Jira test plugins.

This approach ensures the deployment is iterative, collaborative, and validated in real time, so enterprises see value early while scaling TrustCloud adoption smoothly.

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

A. Information Gathering Process

Goal: Understand Wisconsin’s GRC needs, existing systems, and target outcomes.

Outcomes: Documented GRC scope, selected frameworks (SOC 2, ISO 27001, CSF, etc.), identified integrations, role mappings, and prioritized implementation backlog.

Methodologies:

• Agile Discovery Workshops: Short sprint-based workshops with stakeholders (compliance, IT, security, legal, audit, engineering).

• Use Case / User Story Mapping: Define user stories for compliance managers, risk owners, engineers, auditors, and executives.

• Architecture Decision Records (ADR): Used to document design choices for integrations, org segmentation, and framework adoption.

Tools:

• Miro: Process mapping and system architecture diagrams.

• Confluence / Google Workspace: Documenting requirements and decisions.

• Jira: Backlog creation for implementation tasks.

• Slack / Teams: Daily communications and quick decisions.

B. Draft Implementation Plan

Goal: To align all stakeholders (both Wisconsin and TrustCloud) with the project scope, timeline, key milestones, and responsibilities.

Outcomes: A comprehensive Implementation Plan document that serves as the project blueprint, outlining the schedule, resource assignments, communication plan, and success criteria.

Methodologies:

• Stakeholder Workshops: Conduct interviews and workshops with key personnel to define project requirements, risks, and success metrics.

• Joint Scoping & Prioritization: Collaboratively define the initial scope and prioritize "quick wins" to ensure early value delivery.

• Iterative Plan Development: Draft the implementation plan in stages, sharing it with the project team for continuous feedback to ensure alignment before final sign-off.

Tools:

• Miro: Process mapping and system architecture diagrams.

• Confluence / Google Workspace: Documenting requirements and decisions.

• Jira: To create and track tasks related to the planning process itself, assign responsibilities, and manage the workflow of drafting the plan.

• Slack / Teams: Daily communications and quick decisions.

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

C. Development of Required Deliverables

Goal: Configure TrustCloud modules (TrustOps, TrustRegister, TrustShare, AuditLens) and develop customer-specific integrations or policies.

Outcomes: Configured environment with policies, mapped frameworks, connected systems, and initial automated control monitoring.

Methodologies:

• Deliverables will be broken down into incremental sprints:

o Focus on environment setup, Single Sign-On (SSO), and role configuration.

o Concentrate on integrations with Okta, Jira, ServiceNow, etc.

o Mapping frameworks and generating policies.

• Continuous Integration: Custom connectors will be developed using TrustCloud’s API/SDK and validated through staging environments.

Tools:

• TrustCloud API & SDK: Utilized for custom data ingestion, particularly for on-premise or bespoke applications.

• GitHub: Employed for version control of integration scripts and Infrastructure as Code (IaC) components.

• Terraform/CloudFormation: Leveraged within the customer's infrastructure as needed for control implementation.

• Google Workspace / Confluence: Used for drafting policies and managing approval workflows.

Architectural Decisions:

• Least Privilege: Integrations adhere to the principle of least privilege, typically using read-only API keys.

• TrustCloud Common Control Framework (TCCCF): Implemented to minimize duplication by enabling mapping across various frameworks.

D. Testing of the Developed System

Goal: Validate integrations, control monitoring, risk scoring, and audit-readiness.

Outcomes: Passing/failing controls identified, tasks routed for remediation, risk dashboards validated, and audit evidence confirmed as complete.

Methodologies:

• Test-Driven Implementation: Each integration/control has defined test cases (“MFA is enabled for all users,” “No S3 buckets are public”).

• Continuous Testing: Once integrations are live, TrustCloud automatically runs control tests (Continuous Control Monitoring).

• UAT (User Acceptance Testing): Stakeholders validate dashboards, risk workflows, and policies meet requirements.

• Regression Testing: Verify updates do not break existing control monitoring or integrations.

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

Tools:

• TrustCloud Continuous Control Monitoring: Automates evidence collection and control validation.

• Postman: Used for API testing, particularly for custom integrations.

• Jira: Facilitates bug tracking, tracking of test cases and defects.

• Teams/Slack Notifications: Generates alerts and Jira tickets automatically upon test failures.

E. Deployment of the Developed System

Goal: Transition from pilot/staging to full production deployment while minimizing disruption.

Outcomes: TrustCloud becomes the single source of truth for controls, risks, policies, and evidence across the enterprise.

Methodologies:

• Incremental Cutover: Start with a limited number of frameworks/systems and gradually expand to the entire enterprise.

• Parallel Access: Maintain access to existing GRC tools throughout the migration until TrustCloud is fully implemented.

• Change Management: Utilize Agile ceremonies (sprint demos, retrospectives) to secure stakeholder approval.

Tools:

• SSO (Okta/Azure AD): Centralizes role-based access for all teams.

• Jira/ServiceNow: Used for tracking deployment tasks and managing change approvals.

• TrustCloud Dashboards: Provides real-time monitoring of control statuses and risk scores.

• AuditLens: Facilitates live audits for auditors using migrated data.

6.2.1 DATA MIGRATION STRATEGY

We will follow a proven, three-step process to ensure all relevant data is identified, mapped, and migrated correctly. We approach data migration with a structured data migration and governance approach that emphasizes quality, continuity, and automation. The numbered list below describes our data migration strategy.

1. Manage, Discover and Scope: We will begin by collaborating with stakeholders to conduct an inventory of existing GRC data sources, such as prior platforms, risk registers, policy repositories, and ticketing systems. We then classify all data types (controls, risks, policies, evidence) and align them with the appropriate modules in the TrustCloud platform.

2. Map Data, Validate, Cleanse and Enrich: We do not just "lift and shift" data. Rather we will assess and appropriately resolve duplicates, archiving outdated information, and enriching your data by mapping it to our Common Control Framework (TCCCF). This critical step ensures that Wisconsin’s existing risks, policies, and controls are structured for powerful automation and reporting within TrustCloud. We will use TrustCloud’s Assurance AI to suggest merging redundant controls or re-mapping risks across frameworks.

3. Staged and Validated Migration: Migration is performed in logical stages, starting with core data like controls and policies, followed by associated evidence and audit histories. We use pilot migrations

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

on smaller data sets to validate all mappings and integrations before executing the full-scale transfer, ensuring predictable and accurate results.

4. Quality Assurance: We will run automated control tests post-migration to verify that integrated evidence feeds are functioning. We will apply continuous control monitoring after migration, so TrustCloud validates data integrity in real time and leverage dashboards to highlight unmapped controls, missing evidence, or unassigned risk owners.

5. Strategies for Maintaining Access During Transition: Agency’s legacy GRC systems can remain accessible during the migration period, enabling minimal disruption to daily compliance and risk management activities. We will strategically migrate frameworks and systems in a phased manner.

This allows agency teams to gradually shift their work into TrustCloud without gaps in compliance coverage. Additionally, historical audit artifacts and evidence are carefully imported and preserved within TrustCloud, ensuring agencies maintain a complete and accessible audit trail for future reference.

6. Post-Migration Monitoring & Optimization: Upon completion of the migration, data is immediately activated to drive a more intelligent and automated GRC program. Real-time dashboards will provide insight into the status of all migrated controls, policies, and risks. This visibility is coupled with action, as automated governance workflows assign policies to owners for review, place risks on scheduled review cycles, and initiate continuous automated testing. Furthermore, our platform's AI begins working immediately to proactively identify gaps—such as a risk lacking a mitigating control—and deliver actionable recommendations to continuously strengthen your compliance and risk posture.

7. Tools Used: The tools we will use in the migration include the TrustCloud API & SDK, bulk uploading via CSV/Excel templates, and integrations with systems like ServiceNow or document repositories.

Figure 9 depicts a screen showing recommended security controls once mapping of controls has been completed.

Figure 9: After mapping controls, receive automated recommendations for additional security controls.

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

6.2.2 SOFTWARE DEVELOPMENT LIFE CYCLE METHODOLOGY

Team FRC’s implementation follows an agile and iterative methodology, emphasizing incremental rollout, continuous feedback, and rapid value delivery rather than a long, linear deployment.

Note: Please see Section 6.1.1 for our project plan for implementation.

Figure 10 describes four key elements our methodology and their benefit to Wisconsin. Each aligns to agile and iterative principles. This implementation methodology helps ensure project success by reducing risk, delivering value faster, and ensuring the final system is well-aligned with business needs. It achieves this by breaking down a large, complex project into manageable, transparent, and collaborative stages.

Further details for ensuring success are described below the graphic.

Figure 10: Key elements of the Team FRC methodology.

This approach and methodology help to ensure success in the following key ways:

1. Iterative, Phased Rollout is key to building and maintaining momentum. Instead of waiting months for a single "go-live" date, the project delivers tangible outcomes at the end of each short phase. For example, having integrations or core policies live within weeks demonstrate progress and a return on

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

investment early. This keeps executives and team members engaged and confident in the project's direction.

2. Cross-functional collaboration is built into the process. By having GRC, IT, and executive teams work in parallel, the methodology breaks down silos and fosters shared ownership. Engineers understand the "why" behind compliance controls, and the GRC team understands the technical limitations. This continuous communication loop ensures the final product is both technically sound and practically useful for all teams, which dramatically increases user adoption.

3. Continuous Feedback & Improvement ensures the system is designed to adapt to new regulations or business changes without requiring a massive annual overhaul. The inclusion of AI-driven suggestions acts like a built-in consultant, helping the system evolve by identifying opportunities for better automation and control mapping. This transforms the project from a one-time setup into a living, improving GRC program.

4. Early & Continuous Testing systematically de-risks the implementation. By using early and continuous testing, problems are found when they are small and easy to fix. A failed automated control test creates a task immediately, preventing a minor issue from becoming a major audit finding later.

Similarly, the phased rollout isolates problems to a specific stage, avoiding the "big bang" failure common in traditional projects where all issues are discovered at the very end.

6.3 ROLE-BASED ACCESS CONTROLS

For a large and diverse organization like the State of Wisconsin, with its agencies and departments, managing access to sensitive GRC data is a critical security and operational challenge. Our Role-Based Access Control (RBAC) is designed specifically to solve this by ensuring every user—from an agency director to an IT operator—sees only the information relevant to their duties.

TrustCloud provides granular role-based permissions across its modules (TrustOps, TrustRegister, TrustShare, AuditLens). Examples of roles are found in Table 7 below.

Table 7: RBAC examples and use cases.

Role Capabilities Use Case

Org Admin / Compliance Admin

Full access to all modules (controls, risks, policies, evidence, dashboards, audit management). Manage user accounts, roles, and integrations.

State CISO, Enterprise GRC Program Managers, Compliance Leaders, Program Contributor

Create/edit controls, upload evidence, draft policies, assign tasks, manage risk assessments.

Compliance Managers, Security Analysts

Read-Only / Viewer

View dashboards, reports, and policies, but cannot modify data or evidence.

Executives, Governor’s Office Staff, Agency Secretaries, Business Stakeholders

Auditor (AuditLens)

Restricted portal access: review controls, evidence, and policies linked to an audit without modifying them.

External Auditors, Assessors

Policy Owner / Approver

Own specific policies, provide approvals, attest to updates, and maintain responsibility for assigned policies.

Agency HR Directors, Legal Counsel, IT Department Heads

Risk Owner Manage assigned risks, update treatment plans, provide assessments, track mitigation actions.

Agency Directors, Program Managers, System Owners

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

Task Assignee Receive tasks through Slack/Jira/ServiceNow for remediation or evidence upload. They can only act on their assigned items.

Agency IT Staff, State Engineers, Operations Teams

There are additional out-of-the-box roles, and custom roles with custom privileges can be created. The following bulleted list highlights the key strengths of our approach:

Secure RBAC-segmentation, scoped access, and auditor-specific portal: Our system allows you to create access boundaries that mirror Wisconsin's organizational structure, minimizing data sprawl and ensuring least privilege access. Executives see high-level dashboards (risk exposure, compliance scores) but may not need the technical evidence details. Engineers can see tasks but not board-level risk reports. AuditLens provides a read-only, secure environment where auditors can access only what is shared with them. By utilizing role-based dashboards, clear visual cues, and guided workflows, we eliminate confusing jargon and present each user with only the information relevant to their specific duties. This approach ensures that every stakeholder, from an executive reviewing risk posture to a compliance analyst managing controls, can quickly understand what is important and act without a steep learning curve.

Simplified User Experience to Drive Adoption: For a successful enterprise-wide rollout, the tool must be simple. Our RBAC ensures that an HR manager at a specific agency sees a clean interface for policy approvals, while a server administrator receives a specific remediation task, such as automatically created in ServiceNow. This targeted experience dramatically reduces training time and encourages adoption across thousands of diverse state employees.

Integration with Enterprise Identity Systems: TrustCloud supports SSO and SAML (Okta, Azure AD, Google Workspace, etc.) for secure authentication. Roles can be mapped from directory groups, ensuring seamless onboarding/offboarding and consistent enforcement of access rights. This allows us to integrate directly with the State of Wisconsin’s existing identity provider (e.g., Azure AD, Okta, etc.), ensuring that user access is automatically governed by an employee's current role and employment status within the state government.

6.4 IMPLEMENTATION

Setting up a TrustCloud environment is a structured process that balances speed-to-value (get compliant and audit-ready quickly) with scalability (support complex org structures, hybrid systems, and multiple frameworks). Please refer to the following sections for details on the “what” (project plan and tools), and the “how” (data migration strategy and SDLC).

• Section 6.1.1 provides a project plan that estimates a 10 week implementation plan, based on Wisconsin’s needs.

• Section 6.2 describes the tools and methodologies used for implementation.

• Section 6.2.1 describes the Data migration strategy and Section 6.2.2 describes the SDLC methodology we will use.

In addition to the sections referenced above, Team FRC’s process for implementation is focused on enabling the State of Wisconsin to be enabled and self-sufficient as rapidly and completely as feasible.

State Implementing, Professional Services, and Enablement Materials

While TrustCloud platform is designed for intuitive use, successful implementation for the State of Wisconsin requires our expert professional services for the initial deployment and configuration. This collaborative approach ensures the solution is tailored to your environment and empowers the State team

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

for long-term, self-sufficient success. Our implementation methodology is a core part of our service and is not proprietary in a way that prevents the State from fully operating the system; rather, it is our proven process for delivering value quickly and effectively.

Team FRC’s professional services team will partner with the…