Five frameworks, three change-trail verbs, one audit row.
Tallywyrm ships four artifacts on the change trail that travel together on one audit row: timestamped savings events · rightsizing PRs · stop/start actions · weekly verified-savings report. How Tallywyrmmaps each of them per framework — SOC 2 Type II, ISO 27001, FedRAMP Moderate, EU CSRD and SEC climate disclosure. The agent records three verbs on the change trail: config-item changes through IaC PRs, stop/start schedule executions, and savings-report exports — the workload data plane is invisible to every one of them. Read top to bottom, or jump to a framework:
Read-only by contract, auditable end to end, ready for the SOC 2 trust-service criteria.
SOC 2 Type II audits the operating effectiveness of controls over time, not just their design. Tallywyrm satisfies the five trust-service criteria against one artifact: the audit row that backs every verified saving. The three change-trail verbs below (config-item changes through IaC PRs, stop/start schedule executions, savings-report exports) are the ones the SOC 2 assessor maps directly to the bullet they are reading.
acceptedAnswer for this framework verbatim.Tallywyrm ships three controls on top of the change trail: read-only cloud access, IaC PR-gated changes and customer-owned audit logs — same wording you will find on /security and /security-and-compliance.
- Access control
- Change management
- Data residency
- Audit logging
- Segregation of duties
- Access control. Brokered OIDC credentials, scoped per workspace; requireAuth() gates authed routes and requireAdmin() gates admin surfaces — the CC6.1 boundary.
- Change management. Three change-trail verbs (config-item IaC PRs / stop-start schedule / savings-report export) feed /dashboard/audit-trail — backing CC7.2 row-by-row.
- Data residency. Inventory, audit events and weekly reports stay in the AWS region selected at workspace signup; US by default; cross-region replication opt-in per workspace.
- Audit logging. 13 months minimum retention (configurable per workspace); weekly CSV export and JSON compliance bundle signed with bundle_sha256 — the CC7.2 artefact.
- Segregation of duties. Admin vs non-admin via the better-auth admin plugin; 2FA-enforced on every login; roles cannot escalate from inside the agent — CC6.1 / CC6.6.
- Config-item changes through IaC PRs — PR opened / merged with deploy timestamp / post-deploy measurement — one row per recommendation, sealed with the bundle_sha256 of the row.
- Stop / start schedule executions — Schedule fire, prior state, new state, timezone, and the resource classes the schedule covers — fired by your brokered OIDC role, attributed in the same audit row.
- Savings-report exports — weekly_csv + bundle_sha256 + per-row credit applied — the export finance and your auditor reconcile against, signed with a sha256 over the row bundle.
- Workload traffic, content, or any payload inside the resources you operate (logs, files, databases, model weights).
- Cross-account sts:AssumeRole into any account you have not already federated through your OIDC trust.
- Any control-plane service (billing writes, IAM writes, identity writes) — none are reachable from the agent.
Reading row — TSC CC7.2 Change Management, mapped against config-item change and the schedule execution; CC8.1 Change Management, mapped against the savings-report export.
- Methodology pillar — the upright forensic walk of the framework's audit row lives at /methodology#audit-trail.
- Pillar post —the editorial walk of the framework's evidence clause lives at /blog/finops-compliance (Compliance).
The audit-trail deep-link at the foot of this panel only resolves once you're signed in — see /login.
Sign in to your workspace; the audit-trail table opens on page 1, pre-filtered to SOC 2 Type II frames (soc2). Unauthenticated visitors are redirected to /login — that is the expected behaviour.
Annex A controls, a statement of applicability, and a supplier-relationship boundary that holds.
ISO 27001 audits the information security management system, not the product that runs on top of it. The three change-trail verbs below support Annex A.12 (operations security) and A.15 (supplier relationships) without claiming any control the agent cannot demonstrate today. The supplier-relationship boundary — credentials are issued by you, brokered through your OIDC trust — is the one an ISO 27001 assessor spends the most time on.
acceptedAnswer for this framework verbatim.Tallywyrm ships three controls on top of the change trail: read-only cloud access, IaC PR-gated changes and customer-owned audit logs — same wording you will find on /security and /security-and-compliance.
- Access control
- Change management
- Data residency
- Audit logging
- Segregation of duties
- Access control. Brokered OIDC credentials, scoped per workspace; A.15 supplier-relationship boundary holds because credentials are issued by you and brokered through your OIDC trust.
- Change management. Three change-trail verbs (config-item IaC PRs / stop-start schedule / savings-report export) feed /dashboard/audit-trail — backing A.12.1.2.
- Data residency. Inventory, audit events and weekly reports stay in the AWS region selected at workspace signup; US by default, EU on request; cross-region replication opt-in.
- Audit logging. 13 months minimum retention (configurable per workspace); weekly CSV export and JSON compliance bundle signed with bundle_sha256 — the A.12.4 artefact.
- Segregation of duties. Admin vs non-admin via the better-auth admin plugin; 2FA-enforced on every login; A.12.1.2 segregation holds end-to-end.
- Config-item changes through IaC PRs — PR opened / merged with deploy timestamp / post-deploy measurement — one row per recommendation, sealed with the bundle_sha256 of the row.
- Stop / start schedule executions — Schedule fire, prior state, new state, timezone, and the resource classes the schedule covers — fired by your brokered OIDC role, attributed in the same audit row.
- Savings-report exports — weekly_csv + bundle_sha256 + per-row credit applied — the export finance and your auditor reconcile against, signed with a sha256 over the row bundle.
- Workload traffic, content, or any payload inside the resources you operate (logs, files, databases, model weights).
- Cross-account sts:AssumeRole into any account you have not already federated through your OIDC trust.
- Any control-plane service (billing writes, IAM writes, identity writes) — none are reachable from the agent.
Reading row — A.12.1.2 segregation of duties, mapped against the change trail sealed with bundle_sha256; A.12.4 logging and monitoring, mapped against the savings-report export and the audit retention window.
- Methodology pillar — the upright forensic walk of the framework's audit row lives at /methodology#audit-trail.
- Pillar post —the editorial walk of the framework's evidence clause lives at /blog/finops-compliance (Compliance).
The audit-trail deep-link at the foot of this panel only resolves once you're signed in — see /login.
Sign in to your workspace; the audit-trail table opens on page 1, pre-filtered to ISO 27001 frames (iso27001). Unauthenticated visitors are redirected to /login — that is the expected behaviour.
Moderate baseline, continuous monitoring, US-region data residency by default.
FedRAMP Moderate maps to NIST 800-53 control families the SOC 2 + ISO 27001 posture already covers — continuous monitoring (CA-7), configuration management (CM-5), access control (AC-2), identification and authentication (IA-2), audit and accountability (AU-2 / AU-6). The agent does not produce a FedRAMP certificate today; the three change-trail verbs below map to the Moderate baseline a federal agency reviewer audits against, with US-region data residency as the default.
acceptedAnswer for this framework verbatim.Tallywyrm ships three controls on top of the change trail: read-only cloud access, IaC PR-gated changes and customer-owned audit logs — same wording you will find on /security and /security-and-compliance.
- Access control
- Change management
- Data residency
- Audit logging
- Segregation of duties
- Access control. Brokered OIDC credentials, scoped per workspace, US-region federation default; AC-2 boundary preserved end-to-end, admin surfaces require requireAdmin() and 2FA.
- Change management. Three change-trail verbs (config-item IaC PRs / stop-start schedule / savings-report export) feed /dashboard/audit-trail — backing CM-5, AU-2 and CA-7.
- Data residency. US-region data residency by default; inventory, audit events and weekly reports stay in the region selected at signup; cross-region replication opt-in.
- Audit logging. 13 months minimum retention (configurable per workspace); weekly cadence (CA-7 continuous monitoring); CSV export and JSON compliance bundle signed with bundle_sha256.
- Segregation of duties. Admin vs non-admin via the better-auth admin plugin; 2FA-enforced on every login; the brokered-credential boundary keeps AU-2 accountability intact.
- Config-item changes through IaC PRs — PR opened / merged with deploy timestamp / post-deploy measurement — one row per recommendation, sealed with the bundle_sha256 of the row.
- Stop / start schedule executions — Schedule fire, prior state, new state, timezone, and the resource classes the schedule covers — fired by your brokered OIDC role, attributed in the same audit row.
- Savings-report exports — weekly_csv + bundle_sha256 + per-row credit applied — the export finance and your auditor reconcile against, signed with a sha256 over the row bundle.
- Workload traffic, content, or any payload inside the resources you operate (logs, files, databases, model weights).
- Cross-account sts:AssumeRole into any account you have not already federated through your OIDC trust.
- Any control-plane service (billing writes, IAM writes, identity writes) — none are reachable from the agent.
Reading row — CM-5 access restrictions for change management, mapped against config-item change; AU-2 / AU-6 audit and accountability, mapped against the savings-report export; CA-7 continuous monitoring, satisfied by the weekly cadence.
- Methodology pillar — the upright forensic walk of the framework's audit row lives at /methodology#policy-gates.
- Pillar post —the editorial walk of the framework's evidence clause lives at /blog/finops-compliance (Compliance).
The audit-trail deep-link at the foot of this panel only resolves once you're signed in — see /login.
Sign in to your workspace; the audit-trail table opens on page 1, pre-filtered to FedRAMP Moderate frames (fedramp). Unauthenticated visitors are redirected to /login — that is the expected behaviour.
ESRS E1 climate inputs, double-materiality assessment data, value-chain transparency.
EU CSRD audits double-materiality (impact × financial), ESRS E1 climate disclosure, and the value-chain mapping exercise. The three change-trail verbs below keep the climate-disclosure inputs and the value-chain mapping on the same artifact finance already reconciles against for invoicing, so ESRS E1, the double-materiality assessment and the value-chain disclosure do not fork.
acceptedAnswer for this framework verbatim.Tallywyrm ships three controls on top of the change trail: read-only cloud access, IaC PR-gated changes and customer-owned audit logs — same wording you will find on /security and /security-and-compliance.
- Access control
- Change management
- Data residency
- Audit logging
- Segregation of duties
- Access control. Brokered OIDC credentials, scoped per workspace; EU-region federation on request for CSRD/GDPR buyers — the A.5 organisational-control boundary.
- Change management. Three change-trail verbs (config-item IaC PRs / stop-start schedule / savings-report export) feed /dashboard/audit-trail — the audit diff behind each ESRS E1 §62–§66 mitigation claim.
- Data residency. EU-region data residency on request for CSRD/GDPR buyers; inventory, audit events and weekly reports stay in the region selected at signup.
- Audit logging. 13 months minimum retention (configurable per workspace); the same audit row finance reconciles against is the row the ESRS reviewer reads.
- Segregation of duties. Admin vs non-admin via the better-auth admin plugin; 2FA-enforced on every login; the brokered-credential boundary prevents double-preparation drift.
- Config-item changes through IaC PRs — PR opened / merged with deploy timestamp / post-deploy measurement — one row per recommendation, sealed with the bundle_sha256 of the row.
- Stop / start schedule executions — Schedule fire, prior state, new state, timezone, and the resource classes the schedule covers — fired by your brokered OIDC role, attributed in the same audit row.
- Savings-report exports — weekly_csv + bundle_sha256 + per-row credit applied — the export finance and your auditor reconcile against, signed with a sha256 over the row bundle.
- Workload traffic, content, or any payload inside the resources you operate (logs, files, databases, model weights).
- Cross-account sts:AssumeRole into any account you have not already federated through your OIDC trust.
- Any control-plane service (billing writes, IAM writes, identity writes) — none are reachable from the agent.
Reading row — ESRS E1 §62–§66 climate disclosure, mapped against the kgCO₂e and dollar column on the savings-report export; double-materiality per AR 16, mapped against the audit diff that justifies each saving claim.
- Methodology pillar — the upright forensic walk of the framework's audit row lives at /methodology#carbon-measurement.
- Pillar post —the editorial walk of the framework's evidence clause lives at /blog/cloud-sustainability (Sustainability).
The audit-trail deep-link at the foot of this panel only resolves once you're signed in — see /login.
Sign in to your workspace; the audit-trail table opens on page 1, pre-filtered to EU CSRD frames (eu_csrd). Unauthenticated visitors are redirected to /login — that is the expected behaviour.
Scope 3 category 1 disclosure inputs from the same audit row the dollar travels on.
SEC climate disclosure (the final rule on climate-related disclosures) records Scope 1 / 2 / 3 GHG emissions, climate-related risks and governance over those risks. Cloud workloads fall under Scope 3 category 1 (purchased cloud services). The three change-trail verbs below map to the disclosure inputs a registrant must produce — the audit trail finance already reconciles against is the audit trail the SEC disclosure reads.
acceptedAnswer for this framework verbatim.Tallywyrm ships three controls on top of the change trail: read-only cloud access, IaC PR-gated changes and customer-owned audit logs — same wording you will find on /security and /security-and-compliance.
- Access control
- Change management
- Data residency
- Audit logging
- Segregation of duties
- Access control. Brokered OIDC credentials, scoped per workspace; admin surfaces require requireAdmin() and 2FA — the boundary a Reg S-K Item 106 disclosure reviewer tests against.
- Change management. Three change-trail verbs (config-item IaC PRs / stop-start schedule / savings-report export) feed /dashboard/audit-trail — the Scope 3 category 1 spend baseline.
- Data residency. US-region data residency by default; inventory, audit events and weekly reports stay in the region selected at signup; cross-region replication opt-in.
- Audit logging. 13 months minimum retention (configurable per workspace); the same audit row finance reconciles against is the row the SEC reviewer reads.
- Segregation of duties. Admin vs non-admin via the better-auth admin plugin; 2FA-enforced on every login; the brokered-credential boundary prevents Scope 3 attribution drift.
- Config-item changes through IaC PRs — PR opened / merged with deploy timestamp / post-deploy measurement — one row per recommendation, sealed with the bundle_sha256 of the row.
- Stop / start schedule executions — Schedule fire, prior state, new state, timezone, and the resource classes the schedule covers — fired by your brokered OIDC role, attributed in the same audit row.
- Savings-report exports — weekly_csv + bundle_sha256 + per-row credit applied — the export finance and your auditor reconcile against, signed with a sha256 over the row bundle.
- Workload traffic, content, or any payload inside the resources you operate (logs, files, databases, model weights).
- Cross-account sts:AssumeRole into any account you have not already federated through your OIDC trust.
- Any control-plane service (billing writes, IAM writes, identity writes) — none are reachable from the agent.
Reading row — Reg S-K Item 106, mapped against the metric-and-target disclosure per row on the savings-report export; Scope 3 category 1 (purchased cloud services), mapped against the spend baseline rolled up from the audit trail.
- Methodology pillar — the upright forensic walk of the framework's audit row lives at /methodology#carbon-measurement.
- Pillar post —the editorial walk of the framework's evidence clause lives at /blog/cloud-sustainability (Sustainability).
The audit-trail deep-link at the foot of this panel only resolves once you're signed in — see /login.
Sign in to your workspace; the audit-trail table opens on page 1, pre-filtered to SEC climate disclosure frames (sec_climate). Unauthenticated visitors are redirected to /login — that is the expected behaviour.
Control ID, cloud-bill artefact, producing feature — one row each.
A procurement evaluator should not need to leave this page to map an RFP question to a Tallywyrm artefact. The tables below name the named clause / specific control ID each framework reads against, the cloud-bill artefact the agent produces to evidence it, and the Tallywyrm feature that ships the artefact — so each row is a drop-in answer for a controls checklist.
| Control | Artifact | Produced by |
|---|---|---|
TSC CC6.1 Logical and physical access controls | PR audit trail row | IaC PR recommendations pipeline (PR open → merge → deploy) Each recommended saving opens a PR scoped to the brokered OIDC identity; the audit row carries the credential scope the SOC 2 assessor reconciles against. |
TSC CC6.6 Boundary protection | OIDC-trust credential contract | OIDC trust broker (no long-lived static keys; cross-account assume-role denied) Credentials are brokered through the customer-owned OIDC trust — no static keys, no cross-account assume-role into unfederated accounts. |
TSC CC7.2 Change management | Schedule execution row | Schedule executor (start / stop firings logged with prior/new state, timezone, resource classes) Every schedule fire is logged with prior and new state, timezone and the resource classes the schedule covers, attributed to the brokered OIDC role. |
TSC CC7.3 Detection of security events and anomalies | Who/what/when/IP audit row | /dashboard/audit-trail (per-user + per-workspace scope) Each audit event is a who/what/when/IP tuple visible in the dashboard audit trail, scoped per user and per workspace. |
TSC CC8.1 Change management (deploy evidence) | Verified-savings weekly report | Verified-savings weekly report (PR diff, deploy timestamp, post-deploy measurement, credit applied) Each emission-reduction row carries the PR diff, deploy timestamp, post-deploy measurement and per-row credit applied, sealed with bundle_sha256. |
The table above is generated from the same evidenceMappings constant that backs the acceptedAnswer.text on the FAQPage JSON-LD at the foot of this page. Each row is a drop-in for an RFP — the procurement reviewer walks the column they need, picks the row that matches, and hand-cites the artefact name into their evidence pack.
| Control | Artifact | Produced by |
|---|---|---|
A.5 Organisational controls | Compliance pack PDF | Compliance-pack-island (PDF export) The download compliance pack bundles the framing evidence — change-trail verbs, retention windows, framework xref — under one signed artifact. |
A.9 Access control | Authed route touchpoint | better-auth requireAuth() + requireAdmin() (per-user + admin gating) Every authenticated route runs through requireAuth(); admin surfaces additionally run through requireAdmin() — the role source of truth is the better-auth admin plugin. |
A.10 Cryptography | At-rest row (DB + object store) | AES-256 platform-managed encryption at rest The database and the report-artifact object store are AES-256 encrypted at rest by the platform — the same defaults every Polsia app inherits. |
A.12.1.2 Segregation of duties | PR-only delivery channel | IaC PR recommendations pipeline (no terraform apply / no control-plane write surface) The agent emits IaC snippets only; your CI/CD applies them. There is no terraform apply execution surface and no control-plane write capability exposed to the agent. |
A.12.4 Logging and monitoring | Weekly CSV / JSON bundle | Audit pack (signed with bundle_sha256) Weekly CSV and JSON exports ship signed with a sha256 over the row bundle so the ISO 27001 assessor can re-hash and reconcile against the same source. |
A.15 Supplier relationships | OIDC-trust credential contract | OIDC trust broker (credentials issued by you; brokered through your trust boundary) Credentials are issued by your tenant and brokered through your OIDC trust — the agent never holds a long-lived static key for any account. |
The table above is generated from the same evidenceMappings constant that backs the acceptedAnswer.text on the FAQPage JSON-LD at the foot of this page. Each row is a drop-in for an RFP — the procurement reviewer walks the column they need, picks the row that matches, and hand-cites the artefact name into their evidence pack.
| Control | Artifact | Produced by |
|---|---|---|
AC-2 Account management | Authed route touchpoint | better-auth per-user scoping (requireAuth()) + requireAdmin() for admin surfaces Every authed route is per-user scoped via requireAuth(); admin surfaces additionally require requireAdmin() so the account-management boundary is enforced end-to-end. |
AC-6 Least privilege | OIDC-trust credential contract | OIDC trust broker (no admin / dev / break-glass static keys) Each brokered credential is the weakest one that does its job — no always-on admin role, no dev/break-glass static key, no shared account credential. |
IA-2 Multi-factor authentication | Login event row | auth-2fa module (TOTP enforced on every login) A TOTP-enrolled user cannot reach an authed route without passing the /2fa-verify challenge — enforced by the auth-2fa module on every login. |
AU-2 / AU-6 Audit events / audit review | Audit-trail row + weekly CSV export | /dashboard/audit-trail + weekly CSV export (audit pack, bundle_sha256) Each audit event is a who/what/when/IP tuple visible in the dashboard audit trail; the weekly CSV export ships signed with bundle_sha256 for the assessor to reconcile. |
CM-5 Access restrictions for change management | PR-only delivery channel | IaC PR recommendations pipeline (brokered credential cannot expand its scope) The brokered OIDC credential cannot write to any control-plane service — the PR is the only delivery channel, so the change-management boundary holds at the credential layer. |
CA-7 Continuous monitoring | Inventory snapshot + weekly report cadence | Inventory-snapshot collector (hourly reads + weekly audit pass) + verified-savings weekly report cadence Inventory snapshots run on an hourly cadence and a weekly audit pass on top; the verified-savings weekly report cadence is the same cadence a Continuous Monitoring assessor expects. |
The table above is generated from the same evidenceMappings constant that backs the acceptedAnswer.text on the FAQPage JSON-LD at the foot of this page. Each row is a drop-in for an RFP — the procurement reviewer walks the column they need, picks the row that matches, and hand-cites the artefact name into their evidence pack.
| Control | Artifact | Produced by |
|---|---|---|
ESRS E1-1 Transition plan | Verified-savings weekly report row | Verified-savings weekly report (each reduction carries a PR, deploy timestamp, post-deploy measurement) Each supported emission reduction is the unit of evidence for the transition plan: PR diff, deploy timestamp and post-deploy measurement travel in one row. |
ESRS E1-4 Targets | Verified-savings weekly report row | Verified-savings weekly report (target line attached to every mitigation row) Every mitigation row carries a target line so the targets disclosure is composed from the same set of rows as the financial reconciliation. |
ESRS E1-5 Energy & resource use | Inventory snapshot (cloud-bill rows grouped by resource class) | Inventory-snapshot collector Cloud-bill rows are grouped by resource class and rolled up to the energy-and-resource-use disclosure baseline — sourced from the same audit row finance reconciles against. |
ESRS E1-6 Emissions (kgCO₂e) | Verified-savings weekly report row | Verified-savings weekly report (kgCO₂e + dollar columns per offender) kgCO₂e and dollar columns travel together on the savings-report export so the E1-6 datapoint is reproducible from the same row the carbon reviewer reads. |
ESRS E1-7 Climate-related risks | Weekly audit pass / risk register row | Weekly audit pass (escalation lanes on the verified-savings rollback column) Escalation lanes on the verified-savings rollback column are the agreed-upon channel for raising climate-related risks during the weekly audit pass. |
AR 16 Double materiality | Audit row (financial + impact + governance axes) | Weekly CSV / JSON bundle (bundle_sha256 per row) Each row carries financial, impact and governance tags so the double-materiality assessment reads from one source — sealed with the same bundle_sha256. |
The table above is generated from the same evidenceMappings constant that backs the acceptedAnswer.text on the FAQPage JSON-LD at the foot of this page. Each row is a drop-in for an RFP — the procurement reviewer walks the column they need, picks the row that matches, and hand-cites the artefact name into their evidence pack.
| Control | Artifact | Produced by |
|---|---|---|
Reg S-K Item 106 — Materiality Material climate-risk disclosure | Weekly CSV / JSON bundle row (132-row materiality tagging on every saving) | Weekly CSV / JSON bundle (bundle_sha256 per row) Every saving carries a materiality tag (financial / impact / governance) so the Reg S-K Item 106 materiality threshold is computed from the same source the dollar lives on. |
Reg S-K Item 106 — Metrics & targets Metrics and targets disclosure | Verified-savings weekly report row | Verified-savings weekly report (per-row metric + target diff, kgCO₂e and dollar columns) Metrics and target diffs ship on the same audit row as the financial savings, sealed with the same bundle_sha256, ready for the metric-and-target disclosure. |
Scope 3 cat. 1 Purchased cloud services | Inventory snapshot (spend baseline rolled up from the audit row) | Inventory-snapshot collector The Scope 3 cat. 1 spend baseline rolls up from the inventory snapshot — the same row finance reconciles against; nothing forks between the dollar disclosure and the carbon disclosure. |
Scope 3 cat. 1 — Attestation Scope 3 cat. 1 attestation evidence | Compliance pack PDF | Compliance-pack-island (PDF export) The downloaded compliance pack carries the Scope 3 cat. 1 attestation evidence bundled with the SOC 2 / ISO 27001 / FedRAMP / CSRD framing. |
Reg S-K Item 408 Internal-control attestation | Admin boundary + weekly audit pass cadence | better-auth requireAdmin() boundary + weekly audit pass cadence Admin surfaces require requireAdmin() and the weekly audit pass is the cadence the internal-control attestation is built on — same boundary as a SOC 2 / ISO 27001 assessor reads. |
The table above is generated from the same evidenceMappings constant that backs the acceptedAnswer.text on the FAQPage JSON-LD at the foot of this page. Each row is a drop-in for an RFP — the procurement reviewer walks the column they need, picks the row that matches, and hand-cites the artefact name into their evidence pack.
The same audit row that closes the SOC 2 / ISO 27001 / FedRAMP / CSRD / SEC disclosures is the same one finance reconciles against.
The same audit row that backs every verified saving is the one finance reconciles against. View the per-event verified savings ledger at /dashboard/savings (sign-in required).
Nothing on this page is a new attestation. It is a public mapping from the four change-trail artifacts the agent ships (timestamped savings events, rightsizing PRs, stop/start actions, weekly verified-savings report) and the three change-trail verbs underneath them (config-item changes through IaC PRs, stop/start schedule executions, savings-report exports), the retention windows /privacy publishes, and the named control IDs each framework reads against, to the audit row your buyer hands to their assessor.