The DVMS Overlay – An Adaptive, Governance, Resilience, and Assurance (GRA) Management System
David Moskowitz – Founder Member and Chief Content Architect, at the DVMS Institute
Digital threats, regulatory demands, and business pressures constantly evolve; organizations can no longer afford to treat governance, resilience, and assurance as isolated concerns. Achieving sustainable excellence requires a holistic approach integrating these disciplines into daily operations and culture. The Digital Value Management System® (DVMS) overlay provides a practical, scalable way to unify governance, resilience, and assurance, enabling organizations to proactively manage digital business risk, adapt to change, and turn compliance into a natural outcome of doing the right things.
Why Governance, Resilience, and Assurance Matter
Traditional Governance, Risk, and Compliance (GRC) frameworks focus on protection, compliance, and risk avoidance. This approach avoids adverse outcomes and penalties, aiming for institutional stability. It often treats cybersecurity and resilience as technical or after-the-fact concerns. This approach leaves organizations vulnerable to cultural blind spots, human error, and process failures that can’t be fixed by following a checklist.
By shifting to Governance, Resilience, and Assurance (GRA), leaders integrate culture, leadership, and systems thinking to create organizations that survive disruption and thrive on it. GRA leads to an adaptive and flexible capacity that crafts verification mechanisms that build stakeholder trust while building responsive leadership that establishes feedback loops for continual improvement.
- Governance sets strategic intent and accountability, aligning policies with stakeholder value. Governance is similar in both GRA and GRC.
- Resilience enables organizations to adapt and recover from threats, embedding continual learning and flexibility into daily operations. It’s a forward-looking capacity to withstand disruptions and recover from adversity.
- Assurance validates that systems are fit for purpose and fit for use, closing the gap between strategy and execution while providing confidence and verification that systems function as intended, building trust through confirmation.
The DVMS weaves these elements together, ensuring that value creation and protection happen simultaneously, not sequentially. Organizations that adopt GRA turn chaos into opportunity and make resilience a core business capability, not a bolt-on.
From GRC to GRA: Compliance as a Byproduct
Compliance remains essential, but GRA reframes it as an outcome, not the goal. When leaders focus on assurance and practical resilience, compliance emerges naturally:
- Compliance → Assurance: By measuring and validating that policies and processes are executed effectively (as in the DVMS Assure capability), organizations achieve compliance as a natural byproduct of operational excellence.
- Risk Management → Resilience: Adaptive organizations fix the apparent minor, visible lapses in process or controls, before they escalate. This reduces risk and builds a culture of trust and accountability.
The DVMS Overlay: Turning GRA Into a System
The DVMS is not another framework; it’s an adaptive overlay that integrates with what organizations already do, regardless of size or sector. Leaders use the DVMS to:
- Map existing practices to seven core capabilities: Govern, Assure, Plan, Design, Change, Execute, and Innovate, collectively called the minimum viable capabilities[i] (MVC).
- Identify performance gaps and interdependencies.
- Foster continual learning and adaptation.
- Align culture, leadership, and strategy with risk management.
How the DVMS Overlay Enables Resilience
- Systems Thinking: The DVMS encourages leaders to see the organization as a complex adaptive system. Minor issues, can have nonlinear, far-reaching effects. The overlay exposes these gaps so teams can address them before they escalate.
- Feedback Loops: Feedback mechanisms (Governance-Execution and Strategy-Governance loops) ensure that even minor performance gaps are detected and acted upon quickly. This mirrors the “fix philosophy, reinforcing a culture of vigilance and continual improvement.
- Cultural Alignment: Addressing minor lapses builds a culture of accountability and trust. The overlay embeds this mindset, making it everyone’s job to spot and fix issues early.
Result: Sustainable compliance, reduced risk, and increased stakeholder trust, all as byproducts of a well-oiled combination of the DVMS and GRA.
Visualizing the DVMS and GRA: The Venn Diagram of Sustainable Excellence
The DVMS: A Scalable Overlay Enabling Governance, Resilience, and Assurance for Sustainable Excellence
- Responsible Leadership (Governance + Assurance): Leaders align actions with strategy and policies to build a culture of learning and trust.
- Adaptive Resilience (Governance + Resilience): Systems thinking anticipates disruption and fosters learning.
- Responsive Systems (Resilience + Assurance): Real-time feedback loops validate and adapt processes.
- Sustainable Organizational Excellence (All Three): Where culture, strategy, and execution converge to deliver enduring value.
Surrounding and enabling Governance, Resilience, and Assurance, the DVMS scalable overlay helps organizations of any size or sector identify and close performance gaps, align culture and strategy, and achieve sustainable organizational excellence, regardless of existing frameworks, methods, or maturity level.
The Role of Questions and QO-QM
The DVMS operationalizes assurance by embedding a questioning culture. Two pivotal questions drive this process:
- How do you know?
- How can you be sure?
Leaders use the Question Outcome–Question Metric[ii] (QO–QM) methodology to link strategy to execution, ensuring that every metric and assurance activity ties directly to strategic intent and operational reality. This structured inquiry uncovers hidden risks, challenges assumptions, and ensures that assurance is a dynamic, ongoing practice, not just a periodic review.
Practical Steps for Leaders
- Adopt systems thinking: Map interdependencies, break down silos, and address root causes, not just symptoms.
- Align culture with strategy-risk: Involve teams in defining risk tolerance and co-creating solutions.
- Foster continual learning: Use feedback loops, after-action reviews, and mentorship to drive improvement.
- Integrate frameworks into the DVMS overlay: Use the DVMS to enhance existing frameworks, not replace them.
- Measure what matters: Focus on outcomes, resilience, trust, value delivery, not just compliance checklists.
What is “strategy-risk”?
In the DVMS, “strategy-risk” emphasizes the interconnectedness of strategy and risk, rather than treating them as separate concepts (i.e., strategy here, risk there). Every strategic decision— e.g., launching a new product, entering a new market, or adopting new technology—carries both opportunities and risks. By viewing strategy and risk as a unified element, organizations recognize that each decision impacts value creation and protection.
Organizations must manage these aspects together rather than in isolation. This holistic approach enables leaders to balance innovation and risk management, positioning strategy-risk as an integral component of GRA. This perspective transforms strategy-risk into a catalyst for learning, adaptation, and sustainable excellence rather than merely a compliance requirement.
The Bottom Line
Organizations that adopt the DVMS overlay and focus on GRA:
- Turn compliance into a byproduct of assurance.
- Embed resilience into daily operations.
- Align governance with stakeholder value, not bureaucracy.
- Fix things before they become crises, building a culture of trust and continual improvement.
Resilience is a journey of continual learning and adaptation. By treating cybersecurity and compliance as outcomes of doing the right things, you can thrive on the edge of chaos and turn risk into a competitive advantage.
About the Author
David Moskowitz – Founding Member and Chief Content Architect, at the DVMS Institute
David is a Founding Member and Executive Director of the DVMS Institute LLC. He is the lead author of the “Digital Value Management System®” publication series which include the *Fundamentals of Adopting the NIST Cybersecurity Framework* and *A Practitioner’s Guide to Adapting the NIST Cybersecurity Framework*, and Thriving on the Edge of Chaos published by TSO.
In today’s digitally driven economy, cyber disruptions are no longer an “if” but a “when.”
The DVMS Institute’s Certified Training Programs teach organizations the skills to build and operate a Holistic, Adaptive, and Culturally Aligned Overlay Management System capable of coordinating cyber resilience actions across an enterprise’s Complex Digital Supply Chain.
True cyber resilience requires the seamless integration of Strategy, Governance, and Operational (SGO) across the enterprise supply chain—rooted in a culture committed to creating, protecting, and sustaining resilient digital value.
The DVMS training programs position cyber resilience not as a technical function but as a strategic, supply-chain-wide capability. This systems-based approach, powered by the DVMS CPD, Z-X, 3D Knowledge, and Culture models, mandates engagement from Leadership, Employees, and Supply Chain partners, each fulfilling distinct responsibilities to enable cyber resilience.
This adaptive, forward-looking approach to Governance, Resilience, and Assurance (GRA) positions your business to:
- Maintain Operational Stability Amidst Constant Digital Disruption
- Drive Agility and Trust Across Your Digital Ecosystem
- Satisfy Critical Regulatory and Certification Requirements (SEC, NIS2, DORA, etc.)
- Leverage Cyber Resilience as a Competitive Advantage
-
DVMS Module Explainer Videos
- DVMS Architecture Video: David Moskowitz explains the DVMS System
- DVMS Case Study Video: Dr. Joseph Baugh Shares His DVMS Story.
- Overlay Model – Using existing systems to power operational resilience
- ZX Model – The business capabilities that power operational resilience
- CPD Model – Adaptable governance & assurance across the enterprise
- 3D Knowledge Model – Enabling holistic organizational learning
- FastTrack Model – A phased approach to adapting a NIST-CSF-DVMS
Digital Value Management System® is a registered trademark of the DVMS Institute LLC.
® DVMS Institute 2025 All Rights Reserved
