Deck template · eight slides

Current-state assessment · August 2026

AI that survives an audit

Ridgeway Transit Authority · Engagement G8V-2026-014

GENER8V01

Contents

  • 01Where the evidence is today
  • 02What the control set actually covers
  • 03The four gaps, and which one matters
  • 04What we recommend, and what it costs
G8V-2026-01402

Section 01

Where the evidence is today

G8V-2026-01403

01 / Coverage

Three of five sources are evidenced

Access logs, key rotation and the runbook are captured and replayable. The incident record and the vendor attestation are not — both are asserted in prose with no artifact behind them.

Auditability91%
Control coverage62%
Evidence attached24%
G8V-2026-01404

01 / Findings

Four gaps, one of them blocking

ControlGapStatusEffort
AU-6Service accounts excluded from reviewBlocking2 wk
IR-4Incident record is prose, not artifactOpen1 wk
SC-13Rotation evidenced, cadence unprovenOpen3 d
AC-2Vendor attestation missingNoted1 d
G8V-2026-01405

Section 02

What we recommend

G8V-2026-01406

In the client's words

“The audit trail was the thing we could never produce on demand. Now it produces itself.”

Director of Information Security

G8V-2026-01407

Fix AU-6 first. The rest follow from it.

Two weeks, fixed fee. Nothing else changes until the review procedure does.

GENER8V · info@gener8v.com08