Governance frameworks & platform

Standards Say What. Our Frameworks Show How.

Governance and compliance frameworks for Security, Privacy, Data Governance, AI Governance and Data Ethics that show you how to meet the standard—and where you stand on the maturity curve. Available as documents or live inside the APEX Governance Platform.

Explore the frameworks See APEX
12 topic frameworks across 5 domains 76 standards and laws traced 100% Primary-clause coverage
The AI Governance framework in APEX as a tree: twelve principles branching into capabilities and requirements, with requirement 7.2.2 Trustworthiness Characteristics highlighted

7 AI Lifecycle Operation › 7.2 Responsible Development › 7.2.2 Trustworthiness Characteristics

7.2.2.1 Fairness & Bias Management

Detect, measure and mitigate unfair bias in AI systems across the life cycle.

ISO/IEC 42001 Annex B · B.6.1.2

Implementation

  • Define fairness objectives and metrics per use case
  • Assess training data for representativeness and bias
  • Test models for disparate outcomes across groups

Common pitfalls

  • Using a single fairness metric for all contexts
  • Stopping fairness testing after launch

Success metrics

  • Bias testing >95% of high-risk models tested
  • Monitoring fairness reviewed at least every 3 months

Maturity

Current 3 · Target 4

What Traced to the clause How Steps, pitfalls, metrics Where you stand Maturity 0–5
Standard vs Framework

Standards Say What. Frameworks Show How.

Standards tell you what is required. Our frameworks tell you how to do it—and show where you stand: whether you're ready to certify, where you sit on the maturity curve, and what comes next on your roadmap.

The question The standard A DP Framework
What's required? The clauses you must meet Requirements, each cited to the clauses it satisfies
How do we do it? Left to you Controls with implementation steps, common pitfalls and success metrics
Are we ready to certify or comply? Found out at audit A certification threshold on every control, traced back to the clauses
How good are we, really? Not covered Maturity criteria from 0 to 5 on every control
What do we do next? Not covered Roadmap, RACI and operating model (Professional edition and APEX)
How It Works

One Structure, Two Ways to Use It

Every framework is built to the same published standard, so a team can see where it stands and what to do next—whether it runs the framework on paper or in APEX.

One Structure

Every framework follows Principles → Capabilities → Requirements → Controls, anchored on one Primary standard, with maturity criteria and a certification threshold on every control.

Two Ways to Use It

Buy a framework as a document, in the Core or Professional edition, and run it your way, or load it into APEX to assess, track and report in real time.

Built from Practice

Twenty-five years of enterprise governance work across aviation, telecommunications, retail and government in North America, Europe, the Middle East and Asia.

Framework Library

Frameworks for Every Obligation

Twelve topic frameworks across five domains. Each is anchored on one Primary standard with full clause coverage and incorporates Secondary standards where the Primary leaves gaps, and every standard it covers has its own profile.

Security

 

Information security, payment cards and third-party risk.

ISO/IEC 27001NIST CSF 2.0SOC 2PCI DSSISO/IEC 27036
Explore Security →

Privacy

 

Global, Canadian, Gulf and US privacy, and privacy management.

GDPRPIPEDA & Law 25Saudi PDPLCCPA/CPRAISO/IEC 27701
Explore Privacy →

Data Governance

 

Enterprise data management, from stewardship to quality.

DAMA-DMBOKISO/IEC 38505ISO 8000DCAM
Explore Data Governance →

AI Governance

 

Certifiable AI management, in Canada and worldwide, and AI Governance Essentials, free.

ISO/IEC 42001EU AI ActNIST AI RMFTBS Directive on ADM
Explore AI Governance →

Data Ethics

Coming soon

Ethical design and use of data and AI, built from our own practice.

UNESCO AI EthicsOECD AI Principles
Register interest →

Unified Governance Framework

Flagship · coming soon

The five domains as one programme, with certification and compliance profiles for each standard. Included in APEX Enterprise.

ISO/IEC 27001ISO/IEC 27701ISO/IEC 42001GDPRPIPEDA
See what it covers →

Built in Canada

Canadian Privacy · Canadian AI Governance

PIPEDA with Quebec Law 25 as a certification profile, and AI governance mapped to the federal Directive and OSFI.

PIPEDAQuebec Law 25TBS Directive on ADMOSFI
Built in Canada →

The Full Library

12 topic frameworks · 76 standards

Topic frameworks, the profile of every standard they cover, and regional and specialist frameworks on request. Filter by domain, jurisdiction and sector.

Open the Framework Library →
Explore the Framework Library
Framework Anatomy

How Every Framework Is Built

A standard tells you what is required. Every DP Frameworks framework turns it into the same four-level structure that shows you how—whether you buy it as a document or run it in APEX.

  1. Anchored on one Primary standard

    Each framework declares the law or standard it answers to and covers 100% of its certifiable clauses. Secondary standards are incorporated where the Primary leaves gaps, so you can check coverage against the source yourself.

  2. Four levels, from intent to action

    Principles set the governance intent, Capabilities name the abilities to develop, Requirements state what must be in place, and Controls say how it's done and assessed.

  3. Every control is ready to run

    Implementation steps, common pitfalls, measurable success metrics, six-level maturity criteria from 0 to 5, a certification threshold, and the dependencies and source clauses behind it.

  4. Two editions

    Core is the framework, its maturity criteria and certification thresholds, and the clause-coverage mapping. Professional adds the Governance Playbook—roadmap, RACI, operating model and role charters—a Risk Library mapped to the controls, cross-framework mappings, templates and the APEX import file.

Anatomy of a DP Frameworks framework A framework is anchored on one Primary standard, for example ISO/IEC 42001 with full clause coverage, with Secondary standards such as NIST AI RMF and the EU AI Act incorporated where the Primary leaves gaps. It is structured as principles, capabilities, requirements and controls; the AI Governance framework has 12 principles, 30 capabilities, 51 requirements and 124 controls. Every control carries implementation steps, common pitfalls, success metrics, six-level maturity criteria, and its dependencies and source clauses. The Professional edition adds the Governance Playbook and the Risk Library. PRIMARY STANDARD ISO/IEC 42001 · 100% clause coverage SECONDARY NIST AI RMF · EU AI Act 1 Principles Why: governance intent 12 2 Capabilities Abilities to develop 30 3 Requirements What must be in place 51 4 Controls How it's done and assessed 124 EVERY CONTROL CARRIES Implementation steps How to put it in place Common pitfalls What usually goes wrong Success metrics How you know it works Maturity criteria Six levels, from 0 to 5 Dependencies & sources Linked controls and clauses PROFESSIONAL EDITION ADDS Governance Playbook Roadmap, RACI, operating model, charters Risk Library Risks mapped to their mitigating controls
Example: AI Governance, anchored on ISO/IEC 42001.
The Platform

APEX Governance Platform

Building Data, AI, and Privacy governance programmes where traditional GRC tools don't reach. While GRC tools help you prove compliance, APEX helps you build the governance programmes worth proving—and then assesses them against your own evidence.

Aligned · Practical · Enterprise · eXcellence

Any Framework, Same Structure

Load a framework from the library or your own—APEX runs anything built to the four-level structure

Evidence-Based Assessment

Score controls against your own policies and reports, with an analyst approving every rating

Certification & Maturity

Two views of one assessment: clause by clause against each control's certification threshold, and the 0–5 maturity heatmap

Explore APEX
How APEX puts a framework to work A framework from the DP Frameworks library, or your own, is loaded into the APEX Governance Platform, which assesses maturity and conformance control by control. Each control connects to evidence cited from your own documents, gaps and risks tracked through to closure, dependency-aware deliverables such as policies and standards, and insight, Statement of Applicability and audit reports. Maturity moves as gaps close, with the audit trail behind every score. YOUR FRAMEWORK From the DP Frameworks library, or your own APEX Governance Platform Assess maturity and conformance, control by control EVERY CONTROL CONNECTS TO Evidence Cited from your own documents Gaps & Risks Findings tracked through to closure Deliverables Policies, standards, dependency-aware Reports Insight, SoA and audit reports Maturity moves as gaps close—with the audit trail behind every score
Why DP Frameworks

Capabilities, Not Checklists

GRC tools help you track compliance. DP Frameworks gives you the governance structure that makes compliance achievable in the first place.

01

Decades of Experience

Built by practitioners with 25+ years of hands-on governance experience across global enterprises, including major airlines, retailers and telecommunications companies. The frameworks encode what works—and avoid what doesn't.

02

Anchored Frameworks

Every framework declares one Primary standard and covers 100% of its certifiable clauses, with named Secondary standards incorporated where the Primary leaves gaps. No vague "aligned to ISO"—you can check our coverage against the standard itself.

03

A Published Standard

APEX isn't a house style—it's a documented, versioned standard with a changelog and a validator that enforces it. Principles, Capabilities, Requirements, Controls; every control carrying implementation steps, pitfalls, measurable success metrics and six levels of maturity criteria.

04

Ready to Run

Every control carries implementation steps, common pitfalls and success metrics, and the Professional edition adds the playbook—roadmap, RACI, operating model and role charters—so your teams ratify rather than write from scratch.

05

Certifiable, and Beyond

Every control carries a certification threshold and 0–5 maturity criteria, so one assessment tells you whether you can certify and how good you really are.

06

Audit-Ready Output

Statements of Applicability, conformance exports, gap registers, and audit reports that show the evidence behind every score. It drops into your GRC tooling, and it stands up on its own when someone asks how you know.

About

Built from Practice

DP Frameworks publishes governance and compliance frameworks and the APEX Governance Platform. The frameworks come from 25 years of building and running governance programmes for enterprises in aviation, telecommunications, retail and government across North America, Europe, the Middle East and Asia.

That work kept showing the same gap: GRC tools track compliance, but organisations lacked a clear structure for the governance that makes compliance achievable. DP Frameworks exists to close that gap.

The bottom line: Risk and Compliance tell you what's wrong. Governance helps you get it right. We're the "G" that makes GRC work.

DP Frameworks is a trading name of Decoy Privacy Consultants Inc., a Canadian company.

Three Ways to Start

Frameworks: Buy a framework in the Core edition (the framework, maturity criteria and certification thresholds) or the Professional edition (adds the Governance Playbook, Risk Library, templates and the APEX import file).

Platform: Load any framework into APEX—or your own—to assess, track and report in real time.

Advisory: Custom frameworks, assessments and implementation support, built to the same structure by DP Frameworks Advisory.

Start with a Framework

Tell us which regulation or standard you answer to and we'll point you to the right framework and edition—or show you APEX running it.

We use these details only to reply to your enquiry. See our Privacy Notice.