GCSB-GDL-GLA-001 Governance Implementation Playbook

Document type: Guideline (advisory playbook) Parent procedure: GCSB-PRC-GLA-001 Governance Implementation Procedure Parent standard: GCSB-ST-CSF-GLA-001 Governance Standard, Version 2.0 Version: 1.0 Status: Issued Approved by: GCSB Governing Council, 19 October 2026 Effective: 19 October 2026 Next review: 19 October 2027 Prepared by: Global Converged Security Board (GCSB)

This playbook is advisory. It explains how to apply GCSB-PRC-GLA-001 in practice. Where this playbook and the parent standard or procedure differ, the standard and procedure prevail.

1. Purpose

The Governance standard establishes how security is directed, overseen and held accountable: the governing body's duties, the committee structure, delegation, policy hierarchy and assurance. The parent procedure fixes the sequence and clocks - including the 18-month extended implementation track available for governance restructuring. This playbook shows how to build a governance system that actually governs rather than decorates, with step-by-step guidance, worked examples, checklists and the records to keep.

The worked examples use the fictional Meridian Logistics Ltd (120 staff, head office, two warehouses, fleet operation), whose board adopted the CSF in March and whose IT manager is the part-time CCSO.

2. Guiding principles

• Accountability is personal. Every governance duty lands on a named person, never on a department.
• Papers before meetings. Governance that operates on verbal reports cannot evidence itself.
• Independence of challenge. Whoever assures the security programme must be able to report bad news without career consequences.
• Proportionate formality. A small organisation needs the same clarity as a large one, with shorter documents and fewer layers.

4. Scope and roles

This playbook applies to every organisation adopting GCSB-ST-CSF-GLA-001 through GCSB-PRC-GLA-001. It is advisory throughout: where it differs from the parent standard or procedure, the standard and procedure prevail.

5. Traceability

Play 1 - Map the current governance reality (Procedure Steps 1-2)

Objective

Document how security decisions are actually made today - not how the org chart says they are made.

Step by step

1. List the security decision types that occur: budget approvals, risk acceptances, incident responses, policy changes, supplier onboarding, access grants for sensitive areas.
2. Interview the people who actually make each type: ask each "What was the last security decision you made, and where is it recorded?"
3. Collect every existing committee charter, or note its absence.
4. Map informal governance explicitly (verbal approvals, chat messages, the founder's habits) so it can be formalised or consciously retained.
5. Compare the map against the standard's required structure; list overlaps and gaps.
6. Present the map - including its uncomfortable parts - to the governing body.

Worked example - Meridian Logistics

Interviews reveal: security spending is approved by the finance manager with no security input; the warehouse supervisor accepted a broken fence for five months without telling anyone formally; incident decisions are made by whoever is on shift; there are no charters for any committee. The gap list: no governing-body security responsibilities, no delegation rules, no risk-acceptance authority, no incident decision route. The map is presented at the April board meeting; the director comments "that's worse than I thought, and accurate."

Checklist

• Security decision types listed
• Actual decision-makers interviewed per type
• Existing charters collected or absence noted
• Informal governance mapped
• Gaps against the standard listed
• Map presented to the governing body

Records to keep

• Interview notes per decision-maker
• The current-state map document
• Collected charters (or the note of absence)
• The gap list and the presentation minute

Common pitfalls

• Mapping the fiction. Documenting the official structure while real decisions happen elsewhere guarantees a governance design nobody uses.

Measures of success

The governing body recognises the map as accurate, including its uncomfortable parts.

Play 2 - Design the target governance structure (Procedure Steps 3-4)

Objective

Design the structure the standard requires: governing body responsibilities, security committee(s), the CCSO role, delegation rules and escalation paths.

Step by step

1. Write the governing body's security responsibilities as a short schedule: approve policy, accept risk above defined thresholds, receive quarterly reporting, appoint the CCSO. Adopt by resolution.
2. Charter each committee (purpose, membership, cadence, quorum, authority, minutes). Keep charters to two pages. Consolidate rather than multiply committees.
3. Write the delegation matrix: who may approve what - risk acceptance by level, exceptions, spending - and what must escalate to the governing body.
4. Define escalation paths, including out-of-hours and serious-incident routes.
5. If using the 18-month extended track, phase the design: minimum viable structure first (governing body schedule, one committee, CCSO mandate, delegation matrix), refinement second.
6. Approve the whole design by resolution; publish internally.

Worked example - Meridian Logistics

Meridian adopts a one-page schedule of board security responsibilities and a delegation matrix: risk acceptances up to "medium" by the CCSO, "high" by the sponsor, "very high" only by the board; exceptions up to 12 months by the CCSO, longer only by the Board Risk Committee on the recommendation of the Enterprise Risk Management Committee; security spending up to GBP 5,000 by the CCSO, above by the sponsor. One committee (the converged security committee) covers everything. Escalation: serious incident -> CCSO -> sponsor -> board chair, with a phone tree for out-of-hours. All adopted by resolution on 9 May.

Checklist

• Governing body responsibilities adopted by resolution
• Committee charters approved (two pages each, consolidated)
• Delegation matrix approved and published internally
• Escalation paths defined, including out-of-hours
• Phasing plan approved if using the extended track
• Structure published internally

Records to keep

• The resolution adopting the responsibilities schedule
• Committee charters
• The delegation matrix, version-controlled
• Escalation path document and phone tree

Common pitfalls

• Over-engineering. Three committees for a 40-person company guarantees abandoned meetings. Consolidate.
• Delegation by default. Without a written matrix, every decision silently defaults to whoever shouts loudest.

Measures of success

Every security decision type has a named forum or person, and the structure fits on one page.

Play 3 - Establish the policy hierarchy (Procedure Steps 7-8)

Objective

Put the standard's document hierarchy in place: policy at the top, standards beneath, procedures and guidelines below, each with an owner and a review date.

Step by step

1. Adopt a one-page document hierarchy rule: what each layer is, who approves it, how often it is reviewed.
2. Inventory every existing security-related document; slot each into the hierarchy.
3. Retire or merge duplicates and contradictions - most organisations find several.
4. Give every surviving document an owner, a version number and a review date.
5. Set up a review trigger: documents past their review date flag automatically (a simple spreadsheet with a date column works).
6. Publish the hierarchy where staff can find the current version of any document in under a minute.

Worked example - Meridian Logistics

The inventory finds 23 documents, including two contradictory "IT policies" (2019 and 2023) and an unsigned "warehouse rules" notice of unknown origin. After merging and retiring, nine documents remain: one security policy (board-approved, annual review), four standards-level documents (CCSO-approved), four procedures (owner-approved). Each has an owner and review date in a register spreadsheet. The register flags the 2019 IT policy's successor for review in March next year.

Checklist

• Hierarchy rule adopted
• Document inventory completed; duplicates and contradictions retired
• Every live document has owner, version and review date
• Review-date trigger mechanism working
• Staff can find the current version of any policy in under a minute

Records to keep

• The hierarchy rule
• The document register with owners, versions, review dates
• Retirement/merge decisions
• Approval evidence per top-layer document

Common pitfalls

• Policy sprawl. Forty policies nobody reads are weaker than eight that are read. Merge ruthlessly.
• Zombie documents. Documents past their review date should trigger review automatically, not sit silently.

Measures of success

A clean hierarchy exists; every document is owned and current.

Play 4 - Operate oversight and assurance (Procedure Steps 5-6 and 9)

Objective

Run the standard's oversight machinery: reporting to the governing body, independent assurance, and management of conflicts of interest.

Step by step

1. Fix the reporting rhythm: the committee meets monthly (binding), and the quarterly reporting pack to the governing body covers posture, incidents, risks, exceptions and programme progress - same structure every quarter so trends are visible.
2. Arrange independent assurance proportionate to size: internal audit, external reviewer, or a non-executive/peer review in small organisations.
3. Guarantee the reviewer's findings reach the governing body unedited; record this right.
4. Open a conflicts-of-interest register for everyone with security decision rights; refresh at appointment and annually.
5. Track assurance findings to closure at the committee; report status quarterly.

Worked example - Meridian Logistics

Meridian engages an external reviewer for two days per year (GBP 2,400). The engagement letter states findings go to the board as written. The first review finds: committee minutes lack recorded decisions (fixed by a decision log), and the CCSO both operates and verifies the leaver process (fixed by having the HR manager verify). The conflicts register opens with five entries, including one real one: the finance manager's spouse works for the cleaning contractor - recorded, with the mitigation that the finance manager does not assess that supplier.

Checklist

• Quarterly reporting pack agreed and running
• Independent assurance arranged with unedited access to the governing body
• Conflicts register live; refreshed at appointment and annually
• Assurance findings tracked to closure
• Finding status in the quarterly pack

Records to keep

• Quarterly reporting packs
• Assurance engagement terms and reports (unedited)
• Conflicts register entries and mitigations
• Finding-closure evidence

Common pitfalls

• Filtered assurance. If the CCSO edits the assurance report before the board sees it, assurance has failed. Protect the direct line.
• Conflict theatre. A register everyone fills with "none" while obvious conflicts exist is worse than none; leadership must model honesty.

Measures of success

The governing body receives unfiltered information; assurance findings close; conflicts are declared and managed.

Play 5 - Review, improve and evidence (Procedure Steps 10-11)

Objective

Keep the governance system itself under review and maintain the evidence that it operates.

Step by step

1. Run an annual governance self-review: did meetings happen, does the delegation matrix reflect practice, do papers arrive on time, did escalation routes work?
2. Track governance health metrics: meetings held versus scheduled, documents past review date, overdue actions, time-to-decision on escalations.
3. Record improvements as actions with owners and dates; track to closure.
4. Keep the evidence trail complete: resolutions, charters, minutes, registers, reports.
5. Report governance health within the quarterly pack.

Worked example - Meridian Logistics

The first annual review finds: 12 of 12 committee meetings held (good), but average paper circulation was 1.5 days before meetings against a 3-day norm (action: secretary sends papers Fridays); two documents passed review date (both reviewed within a fortnight of the finding); one out-of-hours escalation worked but the phone tree had a wrong number (fixed). Three actions are assigned and closed within a quarter.

Checklist

• Annual governance self-review completed and minuted
• Governance health metrics defined and reported
• Improvement actions assigned and tracked to closure
• Evidence trail complete and retrievable
• Governance health in the quarterly pack

Records to keep

• Annual self-review report and minutes
• Health metrics history
• Improvement action log
• The full governance evidence trail

Common pitfalls

• Governance about governance. Keep the self-review to one meeting and one page of actions.
• Evidence gaps. The most common audit finding is the missing minute. Minute everything, briefly.

Measures of success

The governance system demonstrably operates: meetings happen, papers exist, actions close, and the annual review improves it.

4. Quick reference

5. Related documents

• GCSB-ST-CSF-GLA-001 Governance Standard, v2.0 (parent standard, sole normative source)
• GCSB-PRC-GLA-001 Governance Implementation Procedure (parent procedure)
• GCSB-CSF-STRAT and its procedure and playbook (programme context)

Version 1.0 - issued 19 October 2026. Copyright Global Converged Security Board.