M4 — Path
Where to intervene first.
Ranked by RAG, buffer days, stale controls and unowned dependencies. Named dependencies. Named owners. No status-report abstraction.
Off track
3
At risk
0
Controls stale
31
Unowned controls
0
| Status | Regulation | Deadline | Buffer | Controls | Stale | Unowned | Score |
|---|---|---|---|---|---|---|---|
| Off track | MiCA — Whitepaper Filing Regime EUESMA · 14 stale · 2d over | 30 Sep 2026 | -2d | 14 | 14 | — | 164 |
| Off track | APRA CPS 230 — Operational Risk Management AUAPRA · 10 stale · 8d over | 1 Jul 2026 | -8d | 10 | 10 | — | 158 |
| Off track | SEC Cyber Incident Disclosure Rule USSEC · 7 stale · 5d over | 1 Sep 2026 | -5d | 7 | 7 | — | 146 |
Score combines RAG (0–100), buffer penalty, stale controls (×3) and unowned dependencies (×5). Higher scores need attention first.