The Enterprise TRiSCM Maturity Model and Reference Architecture
By Margareta Petrovic, Chief AI Officer, DigitalXForce.
The Enterprise TRiSCM maturity model describes five levels at which an organization can know whether its controls work: attested, evidenced, monitored, assured and trusted. TRiSCM, or Trust, Risk, Security and Compliance Management, is a category of enterprise software defined by DigitalXForce that converges automated governance, risk and compliance with security posture management into a single real-time system, replacing periodic control validation with continuous control assurance. This article sets out each level, the evidence it produces and the reference architecture that carries an organization from the first level to the fifth.
Why the model starts with the Security Posture Benchmark 2026
The DigitalXForce Security Posture Benchmark 2026 scored the published security control answers of 2,112 companies in the CSA STAR Registry. The median company reports 98.9% of its applicable controls in place, and 26.7% report every one. When the median company reports 98.9% of its controls in place, the useful reading is in the other 1.1%.
The benchmark states its own limit plainly: a yes or no records whether a control is in place, not how mature it is. That limit is where a maturity model begins. Two companies can give the same answer to the same question and stand at very different levels, because one checked the control last year and the other checked it this morning. The page Can a headline security score tell you whether a cloud provider is secure? covers the data behind that point.
The model rests on the chain that runs through all of DigitalXForce’s work. Monitoring detects. Continuous Control Assurance validates. Enterprise TRiSCM connects. Digital Trust translates.
The five levels at a glance
| Level | What the organization relies on | The question it can answer | What moves it up |
|---|---|---|---|
| 1. Attested | Answers in questionnaires and policies, given once a cycle | Did we say the control is in place? | Collecting evidence for each answer |
| 2. Evidenced | Evidence gathered for each control and mapped to frameworks, mostly at audit time | Can we show the control was in place when we looked? | Connecting the systems that hold the evidence |
| 3. Monitored | Signals read from connected systems as they change | Has something changed since we last looked? | Testing each control against what the signals show |
| 4. Assured | Each control tested at its own frequency, with results kept as evidence | Does the control still operate as expected today? | Joining the results across compliance, posture, risk and vendors |
| 5. Trusted | One tested result reaching every framework, register and vendor view, translated for decision-makers | Can the board, a regulator or a customer rely on our controls? | Keeping it running, and extending it to new frameworks, vendors and AI systems |
Level 1, attested
At the attested level, an organization knows its controls through the answers it gives: a questionnaire for a customer, a policy statement, a self-assessment for a framework. The answers are given once a cycle, and nothing between cycles checks them.
The benchmark shows what this level looks like across a population. A median score of 98.9% separates almost no one, so the signal sits in the controls a company reports as not in place. 54.9% of the 2,112 companies report at least one Data Protection and Encryption control not in place, the highest share of the ten DigitalXForce domains with public data.
To move up, an organization reads its own “no” answers first, because they are where it has told the reader something specific, and then attaches evidence to every answer it gives.
Level 2, evidenced
At the evidenced level, every control has evidence behind it, and each control is mapped once to the frameworks it serves through a common control framework. The evidence is real, but most of it is gathered by hand ahead of an audit, so it shows the state of a control on the day it was collected.
An assurance gap is the time, or the set of controls, for which an organization has no current evidence that a control still operates as expected. At level 2, the assurance gap is the time between one evidence collection and the next.
To move up, an organization connects the systems that already hold the evidence, so the evidence arrives without a person fetching it.
Level 3, monitored
Continuous Monitoring observes relevant systems, telemetry, signals and changes. Continuous Control Monitoring (CCM) monitors conditions, evidence and signals associated with controls. At the monitored level, the organization sees a change when it happens rather than at the next review.
Monitoring tells the team that something changed. It does not tell the team whether the control that should cover the change still works, and a monitored organization can drown in alerts that nobody connects to a control. The page on real-time risk monitoring explains where monitoring stops.
To move up, an organization tests each control against what the signals show, at a frequency set by how fast that control’s evidence can change.
Level 4, assured
Continuous Control Assurance (CCA) uses evidence, monitoring and validation to determine whether controls continue to operate as expected. At the assured level, each control has its own test frequency, set by how fast its evidence can change, and every test result is stored with the evidence it read and a timestamp. A failed control opens a finding. The control is tested again when the fix is marked done, and the finding closes only when the retest passes.
The assured level changes what an organization can say about itself. A level 1 organization says a control is in place. A level 4 organization says when the control was last tested, what evidence the test read and how old that evidence is. The guide How to Start a Continuous Control Assurance (CCA) Program covers the first controls, the owners and the phases.
To move up, an organization joins the tested results across compliance, security posture, enterprise risk and third parties, so the same result is not found again by four teams.
Level 5, trusted
Enterprise TRiSCM connects control assurance to Trust, Risk, Security and Compliance across the enterprise. Digital Trust translates connected assurance and risk evidence into an enterprise-level view for decision-makers. At the trusted level, one failed control result reaches the compliance view, the posture view and the risk register at the same time, and a vendor event lands beside the organization’s own failed controls.
At this level the organization can answer the question a board, a regulator or a customer actually asks, which is whether they can rely on its controls. The Digital Trust Score is DigitalXForce’s composite score from 300 to 850, computed continuously from live control evidence across seven sub-postures: security, compliance, audit, resilience, third-party, AI and risk. The Digital Trust Portal shares that view with boards, regulators and customers.
Level 5 is not a finish line. New frameworks, new vendors and new AI systems keep arriving, and each one enters at level 1 until it is connected.
How to place your organization on the model
Read the five statements below in order and stop at the first one that is not true for your organization. The level before that statement is where your organization stands today.
- Every control your organization reports on has evidence attached, mapped to the frameworks it serves.
- The systems that hold that evidence send it without a person collecting it.
- Each control is tested on its own schedule against that evidence, and a finding closes only after a retest passes.
- One failed control reaches your compliance view, your posture view, your risk register and your vendor view at the same time.
- You can show the board, a regulator or a customer the current state of your controls without preparing a report for the occasion.
Most organizations find they are at different levels in different domains, and that is the normal state. The benchmark’s own figures suggest where to look first: Data Protection and Encryption at 54.9% of companies reporting a gap, then Configuration and Asset Management at 42.3%.
The reference architecture
The Enterprise TRiSCM reference architecture has seven layers. Each layer below names what it does and the DigitalXForce module that runs it, so a team can map its own tools against it.
| Layer | What it does | Where DigitalXForce runs it |
|---|---|---|
| 1. Sources | Reads configuration and compliance signals from IAM, SIEM, cloud, OT and IoT, SecOps and enterprise systems, plus vendor evidence and AI assets. Connectors read configuration and compliance signals only, never business records or customer data. | 250+ technology integrations; ESRPM, Attack Surface Manager, External Risk View |
| 2. Controls | Holds one control library, with each control mapped once to every framework it belongs to. | Automated GRC, mapped to 50+ frameworks; framework mapping |
| 3. Assurance | Tests each control at its own frequency, stores every result with its evidence and a timestamp, shows evidence age and retests before a finding closes. | Continuous Control Assurance, with Continuous Control Monitoring as a capability inside it |
| 4. Analysis | Reasons over the evidence, scores and prioritizes risk and writes the narratives, with an analyst reviewing every conclusion before anyone relies on it. | AI JedAI analyzes and XForce GPT writes |
| 5. Operations | Takes failed controls, posture changes and vendor events in as alerts with the evidence attached, ranks them by quantified business impact, escalates them and tracks remediation to closure. Tickets go to ServiceNow or Jira when the client wants that. | X-ROC, the XForce Risk Operations Center |
| 6. Views | Presents the same results as the compliance view, the posture view, the risk register, the vendor view and the indicators. | Policy and Compliance Management, Enterprise Risk Management, Third-Party Risk Management, KPI and KRI Management, AI TRiSCM |
| 7. Trust | Translates the connected evidence into one view for decision-makers and shares it outside the organization. | Digital Trust Score and Digital Trust Portal |
The 15 DigitalXForce modules share one data layer, which is why a result found in layer 3 can appear in every view of layer 6 without being entered twice. The full DigitalXForce platform runs in the client’s own hosting, so the client keeps full control of its data, which is the model DigitalXForce prefers. DigitalXForce Lite is the full DigitalXForce platform hosted in the cloud, with the same functionality, for any organization that prefers cloud hosting.
How the levels map to the layers
Each level of the model switches on one more part of the architecture. Level 1 uses none of it beyond the policy text. Level 2 adds the control layer. Level 3 adds the sources. Level 4 adds the assurance and operations layers. Level 5 adds the shared views and the trust layer, and it is the first level at which analysis runs across the whole enterprise instead of inside one team.
Frequently asked questions
What is the Enterprise TRiSCM maturity model?
The Enterprise TRiSCM maturity model describes five levels at which an organization can know whether its controls work: attested, evidenced, monitored, assured and trusted. Each level adds a kind of evidence, from answers given once a cycle to tested results shared with the board, regulators and customers.
How is a maturity level different from a compliance score?
A compliance score records whether controls are reported as in place. A maturity level records how the organization knows it. The DigitalXForce Security Posture Benchmark 2026 found that the median company reports 98.9% of its applicable controls in place, so a score alone separates almost no one.
What is the difference between the monitored and the assured level?
At the monitored level, an organization sees signals change as they happen. At the assured level, it tests each control against those signals at the control’s own frequency and closes a finding only when a retest passes. Monitoring detects, and Continuous Control Assurance validates.
Which layers does an organization need first?
An organization needs the control layer first, with each control mapped once to every framework, and then the sources that send evidence without a person collecting it. Assurance, operations and the shared views build on those two layers.
Does the model replace an audit?
No. Auditors use the DigitalXForce platform to review the evidence, and DigitalXForce makes clients ready for their audits. The model describes how an organization knows its controls work between audits, not a substitute for an independent audit.
See your own level
To see which level each of your domains sits at, DigitalXForce runs the benchmark’s scoring on your own evidence. The walkthrough takes 30 minutes and uses your data, not sample data. Request a demo.
