The Global Centre for Risk and Innovation (GCRI)
NSF is the trust and assurance system: policy, rights and assurance decisions that every other system checks before acting, so that authentication never stands in for authorization.
Fig.The Nexus cycle, from question to renewal. Design, not a record of a run.
Nexus Sovereignty Framework is the Nexus Foundry system for identity, mandates, policy gates and proof receipts shared by every system. It serves 14 platforms, among them Nexus Registry as well as Artificial Intelligence and Autonomous Systems, and its stated limit is that a receipt records an action; it is not external acceptance. Access is through an authorized project with an accountable owner, data terms and a review plan.
Urban demand centres and the hubs that anchor digital and data infrastructure, shown for South Africa as an example geography for this subject.
When every application implements its own permissions, the same person can be allowed in one place and refused in another, and nobody can answer who may do what. A shared decision point with explicit grants, deny-by-default rules and an audit trail is the control.
| Reference | Relevance |
|---|---|
| NIST CSF 2.0 (govern function) | Cybersecurity governance |
| ISO/IEC 27001 | Access control and information security management |
| ISO/IEC 42001 | Controls for AI use |
Access requires an authorized project with an accountable owner, data terms and a review plan. Enquiries go to contact@therisk.global.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Zero trust | A security model that grants access based on continuous verification, not network location. |
| Least privilege | Granting each user or process only the access needed for its current task. |
| Tamper-evident log | An append-only record, often hash-chained, in which any alteration of past entries can be detected. |
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.