GCSB-GDL-CCSO-001 CCSO Office Establishment Playbook

Document type: Guideline (advisory playbook) Parent procedure: GCSB-PRC-CCSO-001 CCSO Office Establishment Procedure Parent standard: GCSB-POL-CSF-CCSO-001 Chief Converged Security Officer (CCSO) Policy, Version 2.0 Version: 1.0 Status: Issued Approved by: GCSB Governing Council, 19 October 2026 Effective: 19 October 2026 Next review: 19 October 2027 Prepared by: Global Converged Security Board (GCSB)

This playbook is advisory. It explains how to apply GCSB-PRC-CCSO-001 in practice. Where this playbook and the parent policy or procedure differ, the policy and procedure prevail.

1. Purpose

The CCSO Policy establishes the Chief Converged Security Officer as the single accountable leader for converged security, and defines the office's mandate, authority, independence and reporting. The parent procedure fixes how the office is established, resourced and reviewed. This playbook shows how to stand up a CCSO office that has real authority and real effect - whether the CCSO is a full-time executive in a large organisation or a part-time role in a small one - with step-by-step guidance, worked examples, checklists and the records to keep.

The worked examples use the fictional Meridian Logistics Ltd (120 staff, head office, two warehouses, fleet operation), where the IT manager becomes the part-time CCSO.

2. Guiding principles

• One accountable head. Convergence fails when physical, cyber, personnel and information security answer to different chiefs. The CCSO role exists to end that.
• Authority in writing. The CCSO's power to stop, require and escalate must be documented and approved by the governing body, or it evaporates under pressure.
• Independence with access. The CCSO must be able to reach the governing body directly, including over the head of management when necessary.
• Proportionate office. The role scales: a small organisation may combine it with other duties, but the mandate, authority and reporting line stay intact.

4. Scope and roles

This playbook applies to every organisation adopting the GCSB CCSO Policy through GCSB-PRC-CCSO-001. It is advisory throughout: where it differs from the parent standard or procedure, the standard and procedure prevail.

5. Traceability

Play 1 - Define and approve the mandate (Procedure Steps 1-2)

Objective

Put the CCSO mandate in writing and have the governing body adopt it.

Step by step

1. Draft the mandate from the policy's requirements: scope (cybersecurity, physical security and operational technology), authority (approve exceptions up to the policy's limits, require information, stop non-compliant activity, escalate to the governing body), accountabilities (strategy, programme, reporting, assurance).
2. Put the mandate to the governing body for adoption by resolution, together with the appointment - a mandate that arrives after the appointment is negotiated downward.
3. Publish the mandate internally so staff know what the CCSO may require of them.
4. Set the mandate review date (annual recommended).

Worked example - Meridian Logistics

Meridian's mandate (two pages) gives the CCSO: authority over cybersecurity, physical security and operational technology security; the right to require any record or access any site, exercised for lawful security purposes and subject to privacy and safety limits; the right to stop any activity breaching an approved control, with same-day escalation to the sponsor; exception approval up to 12 months; a direct reporting line to the board. Adopted by resolution on 12 March, the same meeting that makes the appointment. The mandate is emailed to all staff and posted on the noticeboards; review date set for the following March.

Checklist

• Mandate drafted from the policy (scope, authority, accountabilities)
• Adopted by governing-body resolution, dated, with the appointment
• Published internally
• Annual review date set

Records to keep

• The mandate document, version-controlled
• The adopting resolution
• The publication evidence (email/notice, dated)

Common pitfalls

• Title without mandate. Appointing a "CCSO" whose real authority is unchanged from the old security manager role is relabelling, not convergence.
• Scope carve-outs. Excluding a domain (usually physical security "because facilities owns it") breaks the model at birth.

Measures of success

The mandate is written, adopted, published - and staff can describe what the CCSO does.

Play 2 - Appoint and resource the office (Procedure Steps 3-5)

Objective

Appoint the CCSO and give the office the people, budget and tools to execute the mandate.

Step by step

1. Appoint against the policy's competence requirements; record the decision and its basis.
2. Approve a resourcing line with the appointment: time commitment, budget, any external support. A mandate without resources is a liability transfer, not a security improvement.
3. In small organisations, combine roles transparently: record which other duties the CCSO holds and the conflict-resolution rule (security wins, or the conflict escalates).
4. Name a deputy or continuity arrangement; the office must survive the CCSO's absence.
5. If resources are constrained, reduce scope consciously through the governing body - never by silent neglect.

Worked example - Meridian Logistics

The CCSO appointment records the basis: 9 years' IT experience, security training completed, external mentor retained for the first year (6 days, GBP 4,800). Resourcing: 40% time commitment, a contractor backfills 1 day/week of IT work, annual security budget GBP 14,000 approved with the appointment. Combined-role note: the CCSO remains IT manager; the conflict rule is "where IT delivery and security assurance conflict, the sponsor arbitrates". Deputy: the office manager, briefed and named in the mandate.

Checklist

• Appointment recorded with competence basis
• Time, budget and external support approved with the appointment
• Combined-role conflicts documented with a resolution rule
• Deputy/continuity arrangement in place
• Any scope reduction decided formally by the governing body

Records to keep

• The appointment record and competence basis
• The resourcing approval
• The combined-role conflict note
• The deputy arrangement

Common pitfalls

• Part-time everything. A CCSO with 10% time and no budget cannot run the CSF clocks.
• No deputy. The first incident during the CCSO's holiday exposes the gap.

Measures of success

The office's resourcing matches the mandate's demands, and continuity is covered.

Play 3 - Establish reporting and independence (Procedure Steps 4 and 11)

Objective

Set up the reporting lines and safeguards the policy requires.

Step by step

1. Fix the reporting rhythm: the CCSO reports to the CEO and the Board Risk Committee, quarterly at minimum, aligned with the CSF suite's reporting clocks.
2. Record the direct-access right: the CCSO may raise matters directly with the governing body without management pre-approval. Put it in the mandate and the governing body's standing orders.
3. Define escalation triggers in advance: severe incidents, refused resources, overridden exceptions.
4. Deliver the first annual cycle of reports; the governing body receives the CCSO's report as written.

Worked example - Meridian Logistics

Meridian's standing orders add: "The CCSO's quarterly report is circulated to the board as submitted by the CCSO. The CCSO may request an item on any board agenda directly through the chair." Escalation triggers agreed: any S1 incident; any exception the sponsor declines; any quarter where the security budget is redirected without board approval. In the first year the direct line is used once: a proposed delay to the leaver-process control is escalated, discussed, and the delay refused - recorded in the October minutes.

Checklist

• Reporting rhythm fixed and diarised
• Direct-access right in the mandate and standing orders
• Escalation triggers defined
• Reports delivered unedited on the rhythm
• Any use of the direct line minuted

Records to keep

• The standing-orders amendment
• The escalation trigger list
• Quarterly reports as submitted
• Minutes of any direct-access use

Common pitfalls

• Filtered reporting. If reports pass through an executive who edits them, independence is fictional.
• Access never used. A direct-access right never exercised in years may mean it is informally blocked. The governing body should ask, not assume.

Measures of success

Reports arrive on the rhythm, unfiltered; the governing body can cite the escalation triggers.

Play 4 - Operate the office day to day (Procedure Steps 9-10)

Objective

Run the CCSO office as the operating centre of the converged security programme.

Step by step

1. Run the CSF rhythm from the office: committee secretariat, quarterly reviews, exceptions register, risk reporting, training oversight, incident coordination.
2. Maintain a one-page programme dashboard: the state of every CSF clock and register, showable to the governing body at any time.
3. Write delegation rules with limits so not every decision waits for one person.
4. Keep the office's own records as exemplars: decisions, exception approvals and reports are the artefacts auditors sample first.

Worked example - Meridian Logistics

The CCSO's dashboard (one page, updated monthly) shows: committee meetings held 12/12; quarterly reviews on schedule; 2 open exceptions with expiry dates; risk register last reviewed in the current quarter; training completion 100%; 3 incidents this quarter, all closed with reviews. Delegation rules: site supervisors may approve low-risk access changes up to 30 days; the deputy may chair the committee; everything else waits for the CCSO or escalates. The external assurance reviewer's spring visit samples the office's records first - and finds them complete.

Checklist

• CSF rhythm operated by the office
• One-page dashboard maintained and current
• Delegation rules written with limits
• Office records exemplar-quality

Records to keep

• Monthly dashboard versions
• The delegation rules
• Committee secretariat records
• The office's decision and exception records

Common pitfalls

• Bottleneck CCSO. If every decision waits for one person, write delegation rules with limits.
• Dashboard theatre. Metrics the CCSO cannot defend undermine everything else. Few and true beats many and approximate.

Measures of success

The CSF clocks run unbroken; the governing body trusts the dashboard.

Play 5 - Review the office and the role (Procedure Steps 11-14)

Objective

Review the office's performance and the role's resourcing periodically, as the procedure requires.

Step by step

1. Review annually: mandate currency, resourcing adequacy, reporting quality, exceptions handled, programme progress. The review goes to the governing body.
2. Include a frank independence assessment: were any reports blocked, softened or delayed? Record the answer.
3. Where the review finds under-resourcing, the governing body decides in writing: resource it, narrow the mandate formally, or accept the risk.
4. Every few years, have the office's effectiveness reviewed independently - internal audit or an external peer.

Worked example - Meridian Logistics

The first annual review (February) records: mandate current; resourcing adequate except during the CCSO's two-week leave (deputy covered, but the committee meeting slipped a week - action: deputy empowered to hold it on schedule); independence assessment: no reports blocked or edited; the one direct-line use handled properly. The board's written decision: continue current resourcing; review again in twelve months. An independent effectiveness review is diarised for year three.

Checklist

• Annual office review completed and presented to the governing body
• Independence assessment recorded honestly
• Resourcing gaps decided in writing (resource, narrow, or accept)
• Independent effectiveness review scheduled periodically

Records to keep

• The annual review report
• The independence assessment
• The governing body's written resourcing decisions
• Independent review reports

Common pitfalls

• Self-review only. Periodic independent review keeps the office honest.

Measures of success

The annual review produces real decisions; the office's authority and resourcing stay matched to the mandate.

4. Quick reference

5. Related documents

• GCSB CCSO Policy - Chief Converged Security Officer, v2.0 (parent policy, sole normative source)
• GCSB-PRC-CCSO-001 CCSO Office Establishment Procedure (parent procedure)
• GCSB-ST-CSF-GLA-001 Governance Standard (governing body duties)

Version 1.0 - issued 19 October 2026. Copyright Global Converged Security Board.