Cybersecurity Mode

Unified Jun 22 2026 — cyber systems now live in the canonical Systems Register alongside AI systems. Filter the registry by Domain (AI / Cyber) to see the cyber slice; rows taggeddomain=bothsurface in both views.

Non-AI cybersecurity initiatives: business objective, owners, data classification, expected benefit, success metrics. AllocatesCUC-{ORG}-YYYY-###.

Systems (AI or Cyber) run the canonical 10-stage approval gate (Intake → Business / Technical / Privacy / Legal / Security / Risk / Final / Deployment / Post-Deploy). Cyber Use Cases run a dedicated 7-stage gate. Every decision writes to the canonical staged-workflow tables, emits an audit row, and appears on the detail page rail with reviewer attribution.

The unified Registry export (RhindonCyber_AI-Registry_*.csv) covers AI + Cyber + Both rows; RhindonCyber_Cyber-UseCases_*.csvremains dedicated. Dates formatted MM/DD/YYYY HH:MM per the platform standard.

Same canonical controls table as the AI side, filtered to domain='cyber'. Inline create dialog, sortable list, branded CSV export. Click Open on any row to manage the control via the canonical control detail page.

Same canonical governance_policies table filtered to domain='cyber'. Title, version, category, description, and lifecycle status — independent of AI policy library entries.

Same canonical risks table filtered to domain='cyber'. Canonical Likelihood × Impact 5×5 scoring with tier banding (Critical ≥ 20, High 12–19, Medium 6–11, Low < 6) and color-coded badges.

Branded posture report inside the Reports module. KPI strip, Critical / High / Medium / Low risk-tier rollup, and a Top-10 open cyber-risk table (sorted by Likelihood × Impact score). Two downloads: RhindonCyber_Cyber-Posture_*.csv(canonical CSV with MM/DD/YYYY HH:MM dates) andRhindonCyber_Cyber-Posture_*.docx(canonical branded snapshot). Aslan Copilot (Enterprise) also gains list_cyber_systems, list_cyber_use_cases, and get_cyber_posture read-only tools.

A nightly cron (08:00 UTC) writes a per-org rollup of cyber systems, use cases, controls, policies, and risk-tier counts tocyber_posture_snapshots. A partial unique index makes the cron idempotent per UTC day. The 12 most recent snapshots feed a trend strip above the KPI grid on/reports/cyber.

OrgAdmin / WorkflowAdmin can capture a manual snapshot from the Cyber Posture page header. Throttled to one manual capture per 60 minutes per org. Emits CYBER_POSTURE_SNAPSHOT_MANUAL.

A second cron (08:15 UTC) buckets the last 24 hours of new Critical / High cyber risks plus overdue cyber controls (next_test_date in the past) and overdue cyber policies (next_review_date in the past). When at least one event exists, every active OrgAdmin gets an in-app notification linking to /reports/cyber — branded emails fan out through the standard bell-notification pipeline. Emits CYBER_RISK_DIGEST_SENT.