The Illusion of Frameworks: Why Checklists Can’t Deliver Confidence – The Assurance Mandate Series – Part 2
David Nichols – Co-Founder and Executive Director of the DVMS Institute
The Comfort of Frameworks
Executives love frameworks because they promise order in a chaotic digital world. ISO 27001, NIST CSF, ITIL, and COBIT all come with explicit language, control categories, and credibility. Adopt the framework, check the boxes, pass the audit — then reassure your board, regulators, and customers that everything is under control.
Except it isn’t.
Frameworks create the illusion of progress, but not the reality of resilience. They measure whether you’ve aligned to someone else’s model of good practice — not whether your organization can withstand disruption, recover quickly, and keep delivering value under pressure.
Frameworks Are Maps, Not the Territory
Every framework is like a map. It shows you the terrain, highlights essential features, and gives you a sense of direction. But a map is not the journey. Owning a map doesn’t mean you’ve actually walked the ground.
The same principle applies to digital governance. Adopting NIST CSF, ISO 27001, or ITIL doesn’t automatically make your organization resilient. It means you’ve put a framework in place that could help you build resilience — but only if you actively incorporate it into a living system.
Too often, organizations wave the map and believe they have finished the journey. Compliance is the map. Assurance is the road beneath your feet.
The Checklist Trap
Frameworks seduce leaders because they provide concrete proof: certifications, maturity scores, and audit reports. These artifacts can be included in board packets, shown to regulators, and displayed to customers.
But here’s the problem:
- A certification tells you that controls exist, not that they work.
- A maturity score tells you how many boxes you’ve checked, not how you’ll perform under stress.
- An audit report tells you how well you matched a template last year, not how ready you are for tomorrow.
This is the checklist trap — mistaking activity for assurance.
Snowflake: Certified, but Not Resilient
Consider Snowflake. In 2024, this cloud data warehousing leader was widely trusted, broadly adopted by enterprises, and integrated into major analytical and data ecosystems. Its compliance posture and reputation indicated maturity, credibility, and alignment with best practices.
And yet, in a major incident, attackers exploited misconfigurations and credential-based access across customer environments. Over 160 customer instances were impacted, including major brands like AT&T, Ticketmaster, and Santander.
Snowflake had the certifications, endorsements, and the trust of many stakeholders. However, when resilience was tested, those credentials proved little protection for affected customers. The compliance and tooling that provided comfort could not replace the adaptive capacity needed during a real attack.
The lesson is clear: certification does not equal resilience. An organization can follow all prescribed standards and still be dangerously vulnerable when disruption occurs.
Why Frameworks Fall Short
The failure is not in the frameworks themselves. ISO, NIST, and ITIL are valuable contributions. The failure lies in how organizations use them: as static end-states instead of dynamic inputs into a system.
Frameworks fall short because:
- They’re retrospective. They measure alignment, not adaptability.
- They’re isolated. Each handles only a part of the challenge (cybersecurity, IT service, governance). True resilience demands integration.
- They’re passive. Frameworks don’t drive behavior; people do. Without a system that embeds culture and accountability, frameworks gather dust.
DVMS: The Operating System for Frameworks
This is where the Digital Value Management System® (DVMS) comes in.
DVMS doesn’t compete with frameworks. It operationalizes them. It leverages the valuable guidance of ISO, NIST, and ITIL, integrating them into a living governance system that continuously connects intent, performance, and assurance.
Think of DVMS as the operating system. Frameworks are the apps. On their own, apps are useful. But without an operating system, they can’t work together. DVMS ensures that they are not just adopted, but also aligned; not just documented, but lived.
The Executive Question
So, the real question for leaders is not: Which framework have we adopted?
It is:
- Can we prove our systems will work under stress?
- Do our frameworks actually improve decision-making and resilience, or just give us certificates?
- Are we managing compliance artifacts — or governing business outcomes?
Closing the Gap
Frameworks provide comfort. Systems provide confidence.
The illusion of frameworks is that they can deliver assurance on their own. The reality is that only a system — one that integrates governance, resilience, and assurance — is the Digital Value Management System (DVMS).
You don’t succeed because you passed the audit. You succeed because when disruption strikes, your organization continues to create, protect, and deliver digital business value.
Frameworks are like applications — useful, but limited in their own right. DVMS is the operating system that runs them, connects them, and ensures they deliver resilience in practice, not just on paper.
That is not the illusion of a map. That is the reality of the journey.
👉 Next in the series: Bridging the Silos — how DVMS connects the languages of governance, cyber, and business.
About the Author
Dave is the Executive Director of the DVMS Institute.
Dave spent his “formative years” on US Navy submarines. There, he learned complex systems, functioning in high-performance teams, and what it takes to be an exceptional leader. He took those skills into civilian life and built a successful career leading high-performance teams in software development and information service delivery.
DVMS Cyber Resilience Professional Accredited Certification Training
Governing, Assuring, and Accounting for Resilient Digital Value Outcomes In Complex, Fragmented Systems
Explainer Video – Paper vs. Living System Governed by Assurance
Despite abundant frameworks and dashboards, leaders still struggle to see how their digital value streams perform under real-world stress.
Intent, structure, and day-to-day behavior are examined in isolation, creating flat views that hide how decisions and human responses interact in a living digital system.
The result is governance that looks strong on paper but falters in practice, leaving leaders to juggle disconnected controls instead of actively strengthening the resilience of their digital value.
What’s needed is a framework-agnostic overlay system capable of governing, assuring, and accounting for digital value resilience across complex, fragmented systems.
Digital Value Management System® (DVMS)
An Overlay Management System to Govern, Assure, and Account for Resilient Digital Value Outcomes in Complex, Fragmented Systems
Explainer Video – What is a Digital Value Management System (DVMS)
The Digital Value Management System® (DVMS) training programs teach leadership, practitioners, and employees how to integrate fragmented frameworks and systems such as NISTCSF, GRC, ITSM, and AI into a unified, culture-driven governance and assurance system that accounts for the resilience of digital value within a living digital system.
At its core, the DVMS is a simple but powerful integration of:
- Governance Intent – shared expectations and accountabilities
- Operational Capabilities – how the digital business actually performs
- Assurance Evidence – proof that outcomes are achieved and accountable
- Cultural Learning – to continually fine-tune governance intent and operational capabilities
Underpinning this integration are three distinctive DVMS models
Create, Protect, and Deliver (CPD) – The CPD Model™ is a systems-based model within the DVMS that links strategy-risk and governance to execution in order to create, protect, and deliver digital business value as an integrated, continuously adaptive organizational capability.
3D Knowledge (3DK) – The 3DK Model™ is a systems-thinking framework that maps team knowledge over time (past, present, future), cross-team collaboration, and alignment to strategic intent to ensure that organizational behavior, learning, and execution remain integrated and adaptive in delivering digital business value.
Minimum Viable Capabilities (MVC) – The MVC™ model supports the seven essential, system-level organizational capabilities—Govern, Assure, Plan, Design, Change, Execute, and Innovate—required to reliably create, protect, and deliver digital business value in alignment with strategy-risk intent.
The integration of these models then enables three distinctive digital value management organizational capabilities:
A Governance Overlay that replaces fragmentation with unity. The DVMS provides organizations with a structured way to connect strategy with day-to-day execution. Leaders gain a consistent mechanism to direct, measure, and validate performance—across every system responsible for digital value.
A Behavioral Engine that drives high-trust, high-velocity decision-making. The DVMS embeds decision models and behavioral patterns that help teams think clearly and act confidently, even in uncertain situations. It is engineered to reduce friction, prevent blame-based cultures, and strengthen organizational reliability.
A Learning System that makes culture measurable, adaptable, and scalable. Culture becomes a managed asset—not an abstract concept. The DVMS provides a repeatable way to observe behavior, collect evidence, learn from outcomes, and evolve faster than threats, disruptions, or market shifts.
In summary, A DVMS enables organizations of any size, scale or complexity to:
- Govern through risk-informed decision-making
- Sustain digital value Resilience through a proactive and adaptive culture
- Measure Performance Assurance through evidence-based outcomes
- Ensure Accountability by making intent, execution, and evidence inseparable
The People and Culture That Power a DVMS
Explainer Video – The Human Engine of DVMS
Delivering the outcomes of a DVMS requires coordinated action across an enterprise’s strategy, governance, and operational layers.
Each of these business layers contains unique roles that, when aligned, enable organizations to ensure the resilience of their digital value across their complex and fragmented digital systems.
Together, these roles create an adaptive, risk-informed, and resilient culture capable of thriving in a complex and chaotic digital business environment.
Scaling A DVMS Program – Where Do You Start?
Explainer Video – Scaling a DVMS Program
The DVMS FastTrack Model is a phased, iterative approach that helps organizations mature their Digital Value Management System over time, rather than trying to do everything simultaneously.
This approach breaks the DVMS journey into manageable phases of success. It all starts with selecting the first digital service you want to make resilient. Once that service has integrated DVMS at its boundaries, it becomes the blueprint to operationalize DVMS in the remaining digital services
The DVMS training provides an example of how to operationalize the NIST Cybersecurity Framework and ensure its digital value resilience across complex, fragmented systems.
DVMS Program Benefits
Explainer Video – DVMS Organization and Leadership Benefits
DVMS Organizational Benefits
Instead of replacing existing operational frameworks and their management systems, the DVMS elevates them—connecting and contextualizing their data into actionable intelligence that validates performance and exposes the reasons behind unmet outcomes.
By adopting a DVMS, organizations are positioned to:
- Maintain Operational Stability Amidst Constant Digital Disruption
- Deliver Digital Value and Trust Across A Digital Ecosystem
- Satisfy Critical Regulatory and Certification Requirements
- Leverage Cyber Resilience as a Competitive Advantage
DVMS Leadership Benefits
The Digital Value Management System (DVMS) provides leaders with a unified, evidence-based approach to governing and enhancing their digital enterprise, aligning with regulatory requirements and stakeholder expectations.
For the CEO, the DVMS provides a clear line of sight between digital operations, business performance, and strategic outcomes—turning governance and resilience into enablers of growth and innovation rather than cost centers.
For the Board of Directors, the DVMS provides ongoing assurance that the organization’s digital assets, operations, and ecosystem are governed, protected, and resilient—supported by evidence-based reporting that directly links operational integrity to enterprise value and stakeholder trust.
For the CIO, CRO, CISO, and Auditors: an integrated, adaptive, and culture-driven governance and assurance management system that enhances digital business performance, resilience, trust, and accountability.
The DVMS Certified Training Programs
Explainer Video – The DVMS Training Pathway to Operational Cyber Resilience
The DVMS Institute’s certification training programs and body-of-knowledge publications equip leaders, practitioners, and employees with the skills to govern operational cyber-resilience through an evidence-based system that assures and accounts for digital value outcomes.
Grounded in real-world governance challenges and aligned with NIST CSF 2.0, the DVMS Institute’s training programs teach organizations how to build measurable capability, transparent accountability, and defensible confidence in decision-making.
Through structured learning, applied certification, and authoritative publications, the Institute advances a disciplined, outcome-driven approach to managing digital risk, performance, and resilience as an integrated system.
DVMS Cyber Resilience Awareness Training
The DVMS Cyber Resilience Awareness course and its accompanying body of knowledge publication educate all employees on the fundamentals of digital business, its associated risks, the NIST Cybersecurity Framework, and their role within a shared model of governance, resilience, assurance, and accountability for creating, protecting, and delivering digital value.
This investment fosters a culture that is prepared to operate within a system capable of transforming systemic cyber risks into operational resilience.
DVMS NISTCSF Cyber Resilience Foundation Certification Training
The DVMS NISTCSF Cyber Resilience Foundation certification training course and its accompanying body of knowledge publications provide ITSM, GRC, Cybersecurity, and Business professionals with a detailed understanding of the NIST Cybersecurity Framework and its role in a shared model of governance, resilience, assurance, and accountability for creating, protecting, and delivering digital value.
This investment fosters IT, GRC, Cybersecurity, and Business professionals with the skills to operate within a system that transforms systemic cyber risks into operational resilience.
DVMS Cyber Resilience Practitioner Certification Training
The DVMS Practitioner certification training course and its accompanying body of knowledge publications teach ITSM, GRC, Cybersecurity, and Business practitioners how to elevate investments in ITSM, GRC, Cybersecurity, and AI business systems by integrating them into a unified governance, resilience, assurance, and accountability system designed to proactively identify and mitigate the cyber risks that could disrupt operations, erode resilience, or diminish client trust.
This investment fosters IT, GRC, Cybersecurity, and Business practitioners with the skills to assess, design, implement, operationalize, and continually innovate a Digital Value Management System® program that operationalizes a shared model of governance, resilience, assurance, and accountability for creating, protecting, and delivering digital value.
The Assurance Mandate White Paper Series
Explainer Video – Why GRAA is the Next Evolution of GRC
The whitepapers below present a clear progression from compliance-driven thinking to a modern system of Governance, Resilience, Assurance, and Accountability (GRAA). Together, they define an evidence-based approach to building and governing resilient digital enterprises.
The Assurance Mandate Paper explains why traditional GRC artifacts offer reassurance, not proof, and challenges boards to demand evidence that value can be created, protected, and delivered under stress.
The Assurance in Action Paper shows how DVMS turns intent into execution by translating outcomes into Minimum Viable Capabilities, aligning frameworks through the Create–Protect–Deliver model, and producing measurable assurance evidence of real performance.
The Governing by Assurance Paper extends this model to policy and regulation, positioning DVMS as a learning overlay that links governance intent, operational capability, and auditable evidence—enabling outcome-based governance and proof of resilience through measurable performance data.
Company Brochures and Presentation
Explainer Videos
- DVMS Architecture Video: David Moskowitz explains the DVMS System
- DVMS Case Study Video: Dr. Joseph Baugh Shares His DVMS Story.
- DVMS Overlay Model – What is an Overlay Model
- DVMS MVC ZX Model – Powers the CPD
- DVMS CPD Model – Powers DVMS Operations
- DVMS 3D Knowledge Model – Powers the DVMS Culture
- DVMS FastTrack Model – Enables A Phased DVMS Adoption
Digital Value Management System® is a registered trademark of the DVMS Institute LLC.
® DVMS Institute 2025 All Rights Reserved
