What is a Process Model

A process model says who does what, in what order, and how success is tested. It is the operating layer between a governance framework and a piece of software. The framework sets the outcomes. The process model turns those outcomes into work. The software runs the work and keeps the record. Without the middle layer, software implements activity with no test of success.

What a process contains

A process in this sense has a control objective, a trigger, an owner, inputs, activities and a work product. The control objective says what has to be true. The trigger says when the work starts. The owner is accountable for the step. The inputs are what the step needs. The work product is the record the step leaves. A measure says how the organisation knows. Assurance is the sample of that work.

Order matters. Intake opens the work. Context, policy and design come before build. Build comes before operation. Operation produces the monitoring and the incidents that review samples. A material finding returns to direction and can open new work. That line is how a regulation written as a system lands without a parallel factory for each article.

Depth is not uniform. Design factors set how much of each process is implemented, and to what depth. A low-risk internal tool does not take the same process as a system that changes a customer outcome. The objectives stay the same. The practices scale. A model that implements every process at the highest intensity for every use is theatre. A model that concentrates depth where risk and value are highest is a system.

DAEIOR

DAEIOR is the IT Governance process model. The name is the six domains: Direct, Act, Establish, Implement, Operate and Review. It is the process library behind Control Objectives for SI Systems (AICOB). AICOB is how the organisation establishes, implements, operates, monitors, reviews, maintains and continually improves its SI ecosystem. DAEIOR is the ordered set of processes that does that work.

Direct is the governing body. It evaluates, directs and monitors, and holds management to account. Act is management intake: a business need, a board direction, an incident, a vendor event, drift, or a change of intended purpose. Establish sets context, policy, objectives, people, vendors, risk, security, data and the design of the system. Implement designs, acquires, builds, tests, changes and deploys. Operate runs the system, handles incidents and continuity, and attaches policy to live systems. Review samples performance, conformance, internal control and assurance, and returns a material finding to Direct.

Governance and management stay apart. Direct does not build the management system. Establish does not set appetite. Review does not write the charter. An agent is never accountable. Residual-risk acceptance stays with the governing body. A notice is not a control.

DAEIOR is IT Governance's intellectual property. It is embedded in the software. It is also the reason IT Governance can consult with confidence. IT Governance has had to design the processes that meet the requirements, and then build the systems that run them. The intimate knowledge of the process is the consulting. The library itself is not published as a catalogue. The public statement is the structure: six domains, named processes, named owners, named work products.

What the model gives

One accountability model. Every material outcome has a governing-body role, to evaluate, direct and monitor, and a management owner who runs the step.

Business language for technology. Goals cascade from enterprise objectives, so a control can be shown to exist for a reason, not only that it exists.

A complete lifecycle, not a control list. Strategy, architecture, build, run, continuity and assurance sit in one model, together with governance, portfolio, people, vendors and change.

Auditability. Practices produce named work products. Internal audit and regulators can sample a process, not a slide deck.

Reuse across obligations. One process-control activity can support more than one instrument when the mapping is explicit. DAEIOR is the spine the platforms are built on. That includes ISO/IEC 42001, the international SI management system standard that can be certified, and ISO/IEC 42005 for SI system impact assessment. It also includes the EU instruments where the organisation is in scope of them: the EU AI Act and EN 18286, NIS2, DORA and the Cyber Resilience Act. Data-protection law, including the GDPR, maps onto the same spine. Organisations outside the Union meet the EU instruments only where they place systems on the Union market or are otherwise in scope. The international standards apply wherever the organisation chooses to use them. A mapping is a claim only when it is explicit: one process named against a named article, clause or control.

The platform

The platforms that run this model are process-based. The product name changes with the topic. The method does not. The ISO/IEC 42001 SI management system, the EN 18286 quality management system, and the systems for NIS2, DORA, the Cyber Resilience Act and data protection all run on DAEIOR. ISO/IEC 42001 is the international standard and travels with the organisation. The EU systems are used where the organisation is in scope of those instruments. The platform holds what is running and whether the work was done. Software may automate inventory, policy, runtime guardrails, monitoring and evidence. It does not replace the governing body's duty to evaluate, direct and monitor.

The platforms are available stand-alone, and on Nextcloud. Nextcloud is an open-source collaboration platform an organisation can host itself or have hosted. It adds file storage, user and group management, and federation, so selected records can be shared with a group company, an authorised representative or a key supplier without consolidating every system into one. The process model is the same in both forms.