Security controls — slider for % of on-prem Palo Alto/Cisco firewall rules translated to cloud NSGs/Security Groups, NSG count, and a WAF toggle. The CISO blocks unless 100% translated, ≥1 NSG and WAF on.
Schedule controls — month (1–18) and servers migrated so far. The backend compares actual to the linear plan and draws the burn-down (Chart.js). More than 10% behind → CIO escalates.
Spend controls — $M spent vs budget. If burn % exceeds progress % + 15, the CFO puts a hold on new commitments.
🎤 Convene SteerCo — POST api/steerco; the avatars light up green/red/amber with their verdicts, the overall outcome and escalation path are shown.
Risk acceptance — if the CISO blocks, the CIO can formally accept residual risk, turning BLOCKED into CONDITIONAL GO (logged in the risk register).
🛡️
CISO
“Show me the firewall rules in the cloud before you show me anything else.”
🧭
CIO
“Eighteen months. Are we on track? Show me the burn-down.”
💼
CFO
“I approved a budget, not a blank cheque. Where are we on spend vs progress?”
Decisions appear here.
Approval gates & escalation
Architectpresents
➜
CISO gatesecurity parity
➜
PM burn-downschedule
➜
CFO controlsspend
➜
Decisiongo / conditional / blocked
Click a node to learn what it does.
Deep dive
How
Translate each firewall zone pair (DMZ→App, App→DB) into subnet + NSG/Security Group rules; export rules from Panorama, import as Terraform.
Put a WAF (AWS WAF / Azure Front Door WAF) in front of anything public.
Track burn-down weekly; report monthly to SteerCo.
Why
Executives need decisions framed in their language: risk, time, money.
A SteerCo that only hears good news cannot help you.
When
Monthly, plus an extraordinary SteerCo before each major wave.
Pitfalls
Presenting a “green” status with a red reality.
Letting the CISO see the design for the first time at T-0.
No named risk owner when risk is accepted.
Key ideas
Risk acceptance is legitimate — if it is explicit
An executive may accept residual risk, but it must be written, time-bound and owned. The playground logs it as CONDITIONAL GO rather than GO.
Escalation path
Workstream lead → PMO → SteerCo → Executive Board. Skipping levels burns credibility; never escalating burns schedule.