Abstract: A computer-implemented method and system provides a collaborative framework to assess and manage an enterprise's technology risk and controls for mitigating such risk. The framework is configured to collect risk assessments associated with technology assets from various lines of business within an enterprise, map such risks to appropriate controls and identify and manage control gaps were controls are not in place. The system may comprise a database and a framework application providing access to the database. The framework application is enabled with workflow, such as via rules, to assign tasks to collaborative users and track task completion. Various risk data, control data and workflow-related task data may be stored to the database. Various data views and reports may be generated for identifying tasks for completion, assessing performance and compliance. The rules may be configurable to alter the workflow.