Governance
In your regulator's language
When a regulator asks about critical operations, evidence expressed in hostnames is not an adequate answer. OpsChain lets you annotate your estate (projects, environments and assets) with metadata in your regulatory vocabulary. A core set of governance themes is provided, you add your own extensions, and every write is audited. Approvals, windows and evidence can then be filtered and read the way your obligations are written.
Governed estate classification
Core themes out of the box
A common set of governance fields (criticality, data classification, regulatory scope and ownership) aligned with the vocabulary used by the APRA prudential standards (CPS 230/234) and the SOCI Act. Your estate can be described the way your obligations are written.
Your own vocabulary as extensions
Organisation-specific fields sit alongside the core themes as x-* extensions, for example your internal tiering, business-service names and review cycles. The namespace keeps your vocabulary permanently distinct from the platform’s own.
Every write audited
Classification is governance data, so changing it is a governed action. Every metadata write is an audited event that records the actor and the before and after values. Writes can be protected by the same policies as any other sensitive operation.
Metadata does not drive execution on its own
Classification describes the estate. It does not determine what runs. When a policy uses classification, for example to scope a control to in-scope systems, that use is explicit and visible in the policy.
A worked example
A core banking system might carry a criticality tier, its regulatory scope and the organisation's own business-service tag:
criticality: critical
data-classification: confidential
regulatory-scope: [cps-230, cps-234]
owner: core-banking-platform
x-lime-service: retail-payments
x-lime-review-cycle: quarterlyThe field names and values above are illustrative. Your risk and compliance team owns the mapping from your obligations to your vocabulary. OpsChain supplies the governed register that holds the mapping. It does not decide your regulatory interpretation, and it does not make you compliant.
One register across three regulatory frameworks
The same mechanism serves each framework's vocabulary. CPS 230 and CPS 234 are APRA prudential standards. SOCI is an Act administered through CISC. Your mapping decides what each field means.
CPS 230 / CPS 234
APRA-regulated banking & financial services
Tag critical operations and material service dependencies in the vocabulary of your CPS 230 program, and information assets in CPS 234 terms. Change evidence can then be filtered to the systems your obligations name.
OpsChain for Banking & Financial Services →SOCI / CIRMP
Critical infrastructure operators
Mark critical infrastructure assets and their hazard classes in SOCI terms, so CIRMP evidence can be scoped to the assets the Act covers.
OpsChain for Utilities & Energy →SOCI / TSSR
Telecommunications carriers
Classify network domains and sensitive systems in TSSR vocabulary, so that security-obligation discussions start from a maintained register.
OpsChain for Telecommunications →A demo in your own vocabulary
In a demo we classify a small estate in your vocabulary, then scope approvals and evidence to it. You see your regulator's language applied on a running system.