GCSB Converged Security Framework
The Converged Security Framework
The complete CSF suite in one place: the published standards that set the mandatory rules, the procedures that implement them step by step, and the playbook guidelines that advise on applying them. Issued by the Global Converged Security Board on 13 October 2026.
Framework structure
How the suite fits together
GCSB Converged Security Framework
Issued by the Global Converged Security Board
10 Standards
Mandatory rules, subject to audit
10 Procedures
One mandatory step-by-step procedure per standard
10 Playbooks
One advisory guideline per procedure
Every standard card below links directly to its matching procedure and playbook.
Standards
CSF Standards - the mandatory rules
Strict, objective and subject to audit. Authored by Prof. Dr. Vladimir Bunic and owned by Prof. Dr. Vladimir Bunic and GCSB.
Converged Security Framework: Strategic Standards for Unified Risk Management and Organisational Resilience
Strategic Framework
Incident Response and Business Continuity Framework
Incident Response Standard
Converged Security Risk Management and Assessment Standard
Risk Management Standard
Procedures
Implementation Procedures - the step-by-step instructions
Repeatable, task-oriented and mandatory to follow. Each procedure is derived solely from its published parent standard.
Strategic Implementation Procedure for the Converged Security Framework
Step-by-step adoption, scoping, gap assessment, roadmap, evidence, metrics and completion for the Strategic Standard.
Implements GCSB-CSF-STRAT
DOI 10.5281/zenodo.23469400Main Implementation Procedure for the Converged Security Framework
The twelve-step implementation of the Main Standard across governance, risk, technology, identity, response, training, vendors and data protection.
Implements GCSB-ST-CSF-001
DOI 10.5281/zenodo.23469402Governance Implementation Procedure
Board oversight, CCSO appointment, committee and champions, KPIs, compliance registers and the 18-month governance track.
Implements GCSB-ST-CSF-GLA-001
DOI 10.5281/zenodo.23469406Risk Management and Assessment Procedure
Unified risk register, annual assessments, quarterly threat analysis, treatment plans, monitoring and escalation.
Implements GCSB-ST-CSF-RMA-001
DOI 10.5281/zenodo.23469408Technology Integration and Architecture Procedure
Architecture records, SIEM/PSIM monitoring, interoperability, zero trust, analytics assurance and the 18-month technology track.
Implements GCSB-ST-CSF-TIA-001
DOI 10.5281/zenodo.23469412Identity and Access Management Procedure
Identity architecture, lifecycle control, MFA, privileged access, federation, monitoring and the month-by-month 12-month milestones.
Implements GCSB-ST-CSF-IAM-001
DOI 10.5281/zenodo.23469416Data Protection and Privacy Procedure
Inventories, lawful bases, impact assessments, retention, individual rights, transfers and breach notification steps.
Implements GCSB-ST-CSF-DPP-001
DOI 10.5281/zenodo.23469438Incident Response and Business Continuity Procedure
Unified response protocols, escalation, continuity planning with RTO/RPO tiers, exercises and post-incident learning.
Implements GCSB-ST-CSF-IRBC-001
DOI 10.5281/zenodo.23469446Training and Awareness Procedure
Cross-functional training, awareness programmes, competency assessment, exercises and the 18-month training track.
Implements GCSB-ST-CSF-TRA-001
DOI 10.5281/zenodo.23469448CCSO Office Establishment Procedure
Establishing and operating the adopter's CCSO office: appointment, authority, governance, risk register, audit and change control.
Implements GCSB-POL-CSF-CCSO-001
DOI 10.5281/zenodo.23469450Guidelines
Playbook Guidelines - advisory best practice
Extensive playbooks with worked examples, checklists, records to keep and common pitfalls. Advisory, not mandatory - adapt them to your organisation.
Strategic Implementation Playbook for the Converged Security Framework
Advisory plays for adopting the Strategic Standard: scoping workshops, gap assessment techniques, roadmap design, evidence habits and metrics.
Playbook for GCSB-PRC-STRAT-001
DOI 10.5281/zenodo.23469452Main Implementation Playbook for the Converged Security Framework
Practical plays for the twelve-step Main Standard implementation across governance, risk, technology, identity, response, training, vendors and data protection.
Playbook for GCSB-PRC-CSF-001
DOI 10.5281/zenodo.23469454Governance Implementation Playbook
Board reporting templates, committee rhythms, champion networks, KPI design and compliance register habits for the governance standard.
Playbook for GCSB-PRC-GLA-001
DOI 10.5281/zenodo.23469456Risk Management and Assessment Playbook
Risk register design, assessment facilitation, treatment planning, monitoring cadences and escalation practice for unified risk management.
Playbook for GCSB-PRC-RMA-001
DOI 10.5281/zenodo.23469458Technology Integration and Architecture Playbook
Architecture record keeping, SIEM/PSIM monitoring practice, interoperability, zero trust adoption and analytics assurance.
Playbook for GCSB-PRC-TIA-001
DOI 10.5281/zenodo.23469460Identity and Access Management Playbook
Identity lifecycle practice, MFA rollout, privileged access control, federation and monitoring for the identity standard.
Playbook for GCSB-PRC-IAM-001
DOI 10.5281/zenodo.23469464Data Protection and Privacy Playbook
Data inventories, lawful bases, impact assessments, retention, individual rights handling, transfers and breach notification practice.
Playbook for GCSB-PRC-DPP-001
DOI 10.5281/zenodo.23469466Incident Response and Business Continuity Playbook
Response protocols, escalation drills, continuity planning with RTO/RPO tiers, exercises and post-incident learning.
Playbook for GCSB-PRC-IRBC-001
DOI 10.5281/zenodo.23469468Training and Awareness Playbook
Cross-functional training design, awareness campaigns, competency assessment and exercise planning for the training standard.
Playbook for GCSB-PRC-TRA-001
DOI 10.5281/zenodo.23469470CCSO Office Establishment Playbook
Establishing and running the adopter's CCSO office: appointment, authority, governance, risk register, audit and change control.
Playbook for GCSB-PRC-CCSO-001
DOI 10.5281/zenodo.23469472Looking for GCSB policies and announcements instead? Visit the Standards page or News & Announcements.