Most organizations have governance, but few actually govern.
Policies exist. Frameworks are documented. Audits are completed. But the system on paper and the system in practice are rarely the same, and that gap is where risk lives, where accountability dissolves, and where good intentions quietly fail.
David Nichols and Rick Lemieux of the DVMS Institute argue that real governance is not a compliance exercise: it is the ongoing work of aligning organizational capabilities with strategic intent and verifying that the alignment holds under pressure.
For organizations tired of finding that their controls looked better on the last audit than they performed during the last incident, this book and its associated certification training programs are the place to start.
The DVMS Institute’s training programs teach organizations how to build a NIST Cybersecurity Framework Governance by Assurance™ Overlay System that provides leadership with continuous, audit-ready evidence that the business is achieving its objectives for sustaining and advancing digital value, stakeholder trust, operational resilience, and transparent accountability.
DVMS Awareness Training
The DVMS Cyber Resilience Awareness non-certification course and its accompanying body of knowledge publication introduce all employees to the fundamentals of digital business, its risks, and their roles in building a NIST Cybersecurity Framework Governance by Assurance™ Overlay System that provides leadership with continuous, audit-ready evidence that the business is achieving its objectives for sustaining and advancing digital value, stakeholder trust, operational resilience, and transparent accountability.
DVMS Foundation Certification Training
The DVMS NISTCSF Cyber Resilience Foundation certification training course and its accompanying body of knowledge publications provide IT, Cybersecurity, Risk, and Audit, Professionals with a detailed understanding of how to build a NIST Cybersecurity Framework Governance by Assurance™ Overlay System that provides leadership with continuous, audit-ready evidence that the business is achieving its objectives for sustaining and advancing digital value, stakeholder trust, operational resilience, and transparent accountability.
DVMS Practitioner Certification Training
The DVMS Cyber Resilience Practitioner certification training course and its accompanying body of knowledge publications teach IT, Cybersecurity, Risk, and Audit Practitioners how to design, implement, and operationalize a NIST Cybersecurity Framework Governance by Assurance™ Overlay System that provides leadership with continuous, audit-ready evidence that the business is achieving its objectives for sustaining and advancing digital value, stakeholder trust, operational resilience, and transparent accountability.
Guidehouse Security, Dr. Joseph Baugh shares his story on how his DVMS certification training enabled him to help a large energy company become compliant with TSA’s new Directive for Pipeline Security
Rick Lemieux, the DVMS Institute’s Chief Product Officer, shares his insights on how a NIST Cybersecurity Framework Governance by Assurance overlay system sustains and advances digital value, stakeholder trust, operational resilience, and transparent accountability across complex digital ecosystems.
DVMS Institute Chief Content Architect David Moskowitz, shares his insights on how the DVMS seamlessly aligns organizational strategy, governance, operations, and culture into an integrated overlay system that ensures digital value outcomes.
The whitepapers below present a clear progression from compliance-driven thinking to a modern system of Governance, Resilience, Assurance, and Accountability (GRAA). Together, they define an evidence-based approach to building and governing resilient digital enterprises.
The Assurance Mandate Paper explains why traditional compliance artifacts offer reassurance, not proof, and challenges boards to demand evidence that value can be created, protected, and delivered under stress.
The Assurance in Action Paper shows how DVMS turns intent into execution by translating outcomes into Minimum Viable Capabilities, aligning frameworks through the Create–Protect–Deliver model, and producing measurable assurance evidence of real performance.
The Governing by Assurance Paper extends this model to policy and regulation, positioning DVMS as a learning overlay that links governance intent, operational capability, and auditable evidence—enabling outcome-based governance and proof of resilience through measurable performance data.
DVMS® Assurance-Now™ is a NIST Cybersecurity Framework Governance by Assurance™ Overlay System that provides leadership with continuous, audit-ready evidence that the business is achieving its objectives for sustaining and advancing digital value, stakeholder trust, operational resilience, and organizational accountability.
For the CEO, the DVMS provides a clear line of sight between digital operations, business performance, and strategic outcomes, turning digital operations into an enabler of growth and innovation rather than a cost center.
For the Board of Directors, the DVMS provides real-time audit-ready assurance that the organization’s digital assets, operations, and ecosystem are governed, protected, and resilient, supported by evidence-based assurance that links operational integrity to value, trust, and accountability.
For the CIO, CRO, CISO, and Auditors, the DVMS establishes a common source of verifiable truth. It also enables executives, risk leaders, and assurance professionals to make better decisions, strengthen accountability, and sustain confidence in organizational performance across complex digital ecosystems.
The DVMS continuously sustains and advances digital value through three integrated capabilities that connect governance, behavior, and learning into a unified system of execution and adaptation.
A Governance Overlay that replaces fragmentation with unity. The DVMS provides organizations with a structured way to connect strategy with day-to-day execution. Leaders gain a consistent mechanism to direct, measure, and validate performance across every system responsible for digital value.
A Behavioral Engine that drives high-trust, high-velocity decision-making. The DVMS embeds decision models and behavioral patterns that help teams think clearly and act confidently, even in uncertain situations. It is engineered to reduce friction, prevent blame-based cultures, and strengthen organizational reliability.
A Learning System that makes culture measurable, adaptable, and scalable. Culture becomes a managed asset rather than an abstract concept. DVMS provides a repeatable way to observe behavior, collect evidence, learn from outcomes, and evolve faster than threats, disruptions, or market shifts.
In today’s complex digital enterprises, the relationship between implementers and auditors is often characterized by friction, inefficiency, and rework.
Implementers build systems, controls, and processes with the intent of meeting regulatory and organizational requirements, yet audits frequently uncover gaps leading to remediation cycles, delays, and increased costs. This dynamic reflects a fundamental disconnect between how systems are implemented and how assurance is evaluated.
The Digital Value Management System® (DVMS) addresses this disconnect by embedding evidence-driven assurance and accountability directly into the design and operation of digital systems.
By doing so, DVMS enables implementers to meet auditor requirements on the first try, transforming audits from reactive inspections into predictable validations of performance and control effectiveness.
In today’s complex digital environments, auditors are expected to do far more than verify compliance. They are increasingly responsible for validating whether organizations are delivering real digital value while meeting regulatory obligations.
This dual expectation creates significant challenges, particularly in environments characterized by fragmented systems, inconsistent data, and unclear accountability.
The Digital Value Management System® (DVMS) addresses these challenges by providing auditors with a structured, integrated overlay system that transforms how evidence is generated, validated, and interpreted.
Rather than relying on static documentation and retrospective analysis, auditors gain visibility into how the living digital system governs and assures performance, resilience, and accountability across digital value chains.
For more than two decades, Governance, Risk, and Compliance (GRC) has served as the dominant framework for organizations seeking to manage risk, maintain compliance, and demonstrate operational control.
While GRC has proven effective in organizing and managing governance-related information, the rapid growth of digital business has exposed an important limitation. Managing governance data does not necessarily mean that an organization is achieving its intended business outcomes.
In an increasingly digital and interconnected world, organizations require more than compliance and documentation. They require continuous confidence that they are achieving their performance, trust, resilience, accountability, and audit-readiness objectives.
DVMS Governance, Resilience, Assurance, Accountability (GRAA) provides this capability by transforming governance from a data-management exercise into a value-management and evidence-based assurance discipline.
Customers expect seamless experiences, regulators demand greater accountability, cyber threats continue to evolve, and competitive pressures require organizations to innovate at unprecedented speed. In this environment, success depends on an organization’s ability to balance agility, operational stability, cybersecurity, and governance.
Historically, organizations address these challenges through separate disciplines. ITIL provided structured service management practices to ensure operational reliability. DevOps emerged to accelerate software delivery and foster collaboration between development and operations teams. The NIST Cybersecurity Framework (CSF) established a common language for managing cybersecurity risk and improving organizational resilience. While each framework addresses a critical aspect of digital operations, organizations often struggle when these disciplines operate independently.
The Digital Value Management System® (DVMS®) addresses this challenge by providing an evidence-driven governance system that integrates and governs these complementary frameworks. Rather than treating service management, cybersecurity, delivery, and governance as separate functions, DVMS creates a unified operating model that aligns activities, accountability, and outcomes across the enterprise.
The DVMS FastTrack is a phased, iterative approach that helps organizations mature their DVMS programs over time, rather than trying to do everything at once. This approach breaks the DVMS journey into manageable phases of success.
It all starts with selecting the first digital service you want to operate with the new DVMS capabilities. That service will then serve as the blueprint for operationalizing DVMS across the remaining services.
The DVMS Institutes programs have been adopted by governments and businesses across the globe
100+ Years of Experience
