tools / record
ReadySafe
▶ Live demo — readysafe.eponymic.org
ReadySafe is a vendor-risk assessment tool for small professional- and financial-services firms that fall under the FTC Safeguards Rule (16 CFR Part 314) but have no compliance department to meet it. It translates enterprise third-party risk management into a plain-language, capacity-adjusted instrument: a firm answers a structured set of questions about a service provider and gets back a defensible, classified record of that vendor’s risk — without needing to speak the language of a framework.
The problem it targets
The Safeguards Rule puts small firms on the hook for overseeing their service providers — §314.4(f): select capable providers, require safeguards by contract, and periodically reassess them. A large firm has a team and a TPRM platform for this. A ten-person accounting or advisory firm has neither, and the tools on the market are either enterprise-scale or vague reassurance. ReadySafe is built for that firm: it meets the regulation where a small operator actually lives.
What I built
An assessment engine with a few deliberate design stances, each of which is a small argument about how compliance tooling should behave:
- Categorical logic, not scores. Vendor risk is classified by named rules (“modifiers”), and no modifier can move a vendor more than one tier. There is no weighted composite number anywhere in it. A risk score manufactures false precision and hides its reasoning; a categorical record shows why a vendor landed where it did, which is what a defensible register actually needs.
- Loud, never silent. An unanswered branch renders
unresolved; incoherent inputs render afault; a record past its review interval rendersstale. The engine never quietly defaults to the safe-looking answer — because in compliance, a silent default is how a gap gets recorded as handled. - Provenance preserved. Every record keeps the boundary between what the firm asserted and what the tool derived, and carries its declared blind spot: the record reflects the firm’s stated knowledge, not an audit of the vendor.
- Earned rules. A new classification rule is admitted only when a real vendor lands wrong without it — a demand-driven gate, not anticipated complexity.
The part that matters most — scoping it honestly
The core artifact isn’t the engine; it’s the §314.4(f) coverage map — the document that lays ReadySafe’s output against the regulation line by line and marks, for each clause, whether the tool supports the duty or only draws a boundary:
- (f)(1) — records that selection diligence occurred; it does not verify the vendor’s actual safeguards.
- (f)(2) — flags a missing contract, or a contract without security terms, as an apparent deficiency; it does not enforce the contract for the firm.
- (f)(3) — classifies the risk a vendor presents and drives a periodic-review cadence; the “continued adequacy” of a vendor’s safeguards rests on the firm’s re-asserted inputs, not a vendor audit.
Every register the tool produces carries a required disclaimer in plain words: ReadySafe records the firm’s good-faith assessment. It does not verify a provider’s actual safeguards or compliance with the Rule. It supports the §314.4(f) oversight process and does not itself satisfy the firm’s obligations. And the map states, just as plainly, what sits beyond (f) and what belongs to the firm’s own program (§314.4(a)–(e), (g)–(j)) and was never the tool’s to claim.
This is the whole point of the project. The failure mode a compliance tool most has to avoid is looking like compliance — letting a firm believe it’s covered because it has a record, when the record only reflects what the firm already knew. That’s a half-finished fix that looks like a solved problem. ReadySafe is engineered against exactly that: it draws the line between recorded and compliant explicitly, and refuses to close that line by pretending the tool audits vendors it can’t see.
What this demonstrates
Regulatory literacy — reading a federal rule and mapping a specific clause to a working instrument, clause by clause. GRC-engineering judgment — categorical over scored, capacity-adjusted for the firm that actually has the obligation. And most importantly of the three: the discipline to scope honestly and refuse to overclaim, which is precisely what makes a vendor-risk record defensible to an examiner instead of a liability in front of one. It’s the same instinct as the rest of my work, pointed at regulation — map the gap between what a system claims and what it can actually vouch for, and never let the gap hide. Here the gap is between “we have a record” and “we’re compliant,” and the entire tool is built to keep it visible.
See it live: readysafe.eponymic.org