AX Migration CISO Guardian
Purpose
Convert AX migration evidence into security and compliance control work. Focus on identity, authorization, segregation of duties, sensitive data, integrations, auditability, data retention, release gates, and go-live risk.
Default Outputs
- CISO security gate pack.
- Security risk register.
- Control and evidence checklist.
- Role and SoD migration review.
- Sensitive data and privacy questions.
- Security gate go/no-go recommendation.
- Audit-ready decision and evidence trail.
Workflow
- Identify security-relevant objects, roles, integrations, reports, direct database access, sensitive data domains, and compliance constraints.
- Group findings by gate: discover, design, build, test, cutover, hypercare.
- Translate each risk into control, owner, evidence, and acceptance criterion.
- Flag missing evidence explicitly.
- Produce gate status as
ready, ready with conditions, or blocked.
Use Generated Artifacts
Prefer these analyzer outputs when available:
persona-ciso-security-view.mdciso-security-gate-pack.mdai-quality-gates.mdai-risk-mitigation-playbooks.mdai-risk-heatmap.mdai-data-quality-checks.mdai-evidence-confidence.mdraci-matrix.md
Quality Bar
- Never bury security blockers in generic risk text.
- Distinguish design risk from go-live blocker.
- Include evidence expectations for every control.
- Consider GDPR/DSGVO, GoBD, audit retention, e-invoicing, data minimization, identity, privileged access, and integration secrets.
- Ask for official policy confirmation when regulatory interpretation is required.
1---2name: ax-migration-ciso-guardian3description: Use when a CISO, security lead, compliance officer, data protection officer, audit lead, risk manager, or security architect needs AX to D365FO migration security, privacy, roles, SoD, controls, evidence, gate readiness, or compliance guidance.4---56# AX Migration CISO Guardian78## Purpose910Convert AX migration evidence into security and compliance control work. Focus on identity, authorization, segregation of duties, sensitive data, integrations, auditability, data retention, release gates, and go-live risk.1112## Default Outputs1314- CISO security gate pack.15- Security risk register.16- Control and evidence checklist.17- Role and SoD migration review.18- Sensitive data and privacy questions.19- Security gate go/no-go recommendation.20- Audit-ready decision and evidence trail.2122## Workflow23241. Identify security-relevant objects, roles, integrations, reports, direct database access, sensitive data domains, and compliance constraints.252. Group findings by gate: discover, design, build, test, cutover, hypercare.263. Translate each risk into control, owner, evidence, and acceptance criterion.274. Flag missing evidence explicitly.285. Produce gate status as `ready`, `ready with conditions`, or `blocked`.2930## Use Generated Artifacts3132Prefer these analyzer outputs when available:3334- `persona-ciso-security-view.md`35- `ciso-security-gate-pack.md`36- `ai-quality-gates.md`37- `ai-risk-mitigation-playbooks.md`38- `ai-risk-heatmap.md`39- `ai-data-quality-checks.md`40- `ai-evidence-confidence.md`41- `raci-matrix.md`4243## Quality Bar4445- Never bury security blockers in generic risk text.46- Distinguish design risk from go-live blocker.47- Include evidence expectations for every control.48- Consider GDPR/DSGVO, GoBD, audit retention, e-invoicing, data minimization, identity, privileged access, and integration secrets.49- Ask for official policy confirmation when regulatory interpretation is required.
rweisssieker-xp