CSL and CCSO Assessment Rules
Reference: GCSB-POL-017 Version: 1.0 Issuing authority: Global Converged Security Board Issued: 11 November 2026
Purpose and authority
These rules set how GCSB independently assesses and awards the Chartered Converged Security Leader (CSL) and Chief Converged Security Officer (CCSO) qualifications through the standard route and Recognition of Prior Learning (RPL). They apply the assessment, recognition, moderation, decision and appeal arrangements of the PGDCSL Programme and Governance Manual (GCSB-MAN-PGDCSL-001, Version 2.0) to each component. They are read with the CSL and CCSO Assessment Candidate Terms (GCSB-POL-016) and GCSB-STD-004. GCSB does not provide training; CSI or another provider may offer learning separately, and study, payment or attendance do not confer an award.
Learning outcomes and assessment criteria
Each qualification has two learning outcomes and four assessment criteria. Every criterion must be evidenced.
| Qualification | Criterion | Requirement |
|---|---|---|
| CSL | AC 1.1 | Synthesise ISO 31000 and ISO/IEC 27001 principles into a holistic organisational risk appetite statement. |
| CSL | AC 1.2 | Defend converged security budgets to executive board members using quantitative risk metrics, including ALE and ROI. |
| CSL | AC 2.1 | Critically analyse overlaps between global data privacy regulations, including GDPR, and physical critical infrastructure mandates. |
| CSL | AC 2.2 | Design cross-border security compliance audit frameworks for multinational supply chains. |
| CCSO | AC 1.1 | Formulate business impact analyses accounting for concurrent losses of facility access and IT infrastructure. |
| CCSO | AC 1.2 | Synthesise executive communication strategies preserving market reputation during high-visibility security failures. |
| CCSO | AC 2.1 | Critique traditional executive reporting lines and propose optimised models for Chief Security Officers. |
| CCSO | AC 2.2 | Design continuous maturity-assessment models evaluating long-term organisational security postures. |
Entry requirements
Standard route: CSL candidates hold a verified CSP; CCSO candidates hold a verified CSL. Existing certificates are verified without changing their recorded issuer.
RPL route: CSL candidates show at least 15 years of relevant professional experience, including at least five years of leadership responsibility. CCSO candidates show at least 15 years of relevant experience, executive accountability and board or senior executive engagement. Job titles alone are not evidence.
Assessment format
Standard route: a written applied assessment portfolio of 2,500-4,000 words, excluding appendices, responding to a case brief issued with the written offer and addressing all four criteria. The context may be real, simulated or proposed and must be identified. Third-party and personal information must be protected.
RPL route: a current CV, employment history, a professional evidence portfolio of 1,500-3,000 words mapped to each criterion, supporting records and two verifiable professional references. Gaps against any criterion require further evidence or a targeted assessment task stated in writing.
Both routes: the assessor may hold a recorded professional discussion of 30-45 minutes by video where authenticity or understanding needs confirmation, with reasonable adjustments under GCSB-POL-013.
Permitted resources and integrity
Assessment is open-resource. Candidates may use published standards, the GCSB CSF Version 2.0 suite, their own notes and properly cited sources. Submitted work must be the candidate's own. Use of AI tools must be declared and must not replace the candidate's own analysis. Help from another person in producing the work is not permitted. Suspected malpractice follows GCSB-POL-012.
Submission dates
The written offer states the submission date, normally eight weeks from the start of the evidence stage. A justified extension of up to four weeks may be agreed in writing before the deadline. GCSB aims to communicate a decision within six weeks of submission; this is a target, not a guarantee.
Marking rubric and pass mark
Each criterion is marked out of 25, giving a total out of 100. The assessor records criterion-level marks and reasons.
| Band | Marks per criterion | Descriptor |
|---|---|---|
| Excellent | 23-25 | Evidence-based, critically integrated and executive-ready, with defensible choices and measurable delivery. |
| Good | 18-22 | Coherent analysis, appropriate evidence and a feasible integrated approach. |
| Satisfactory | 13-17 | Meets the criterion with sufficient application and justification. |
| Unsatisfactory | 0-12 | Unsupported, materially incomplete, domain-isolated or primarily descriptive. |
A pass requires a total of at least 70 and at least 13 on every criterion. A high total cannot compensate for an unmet criterion. Classification: Distinction 90 or above; Merit 80 to below 90; Pass 70 to below 80. The unrounded mark is retained and never rounded into a higher classification. RPL submissions use the same criteria and thresholds.
Outcomes and resits
Outcomes are Pass, Revisions Required or Fail, each with written reasons. A candidate may make up to three attempts, including the original attempt. A resubmission after Revisions Required or Fail counts as an attempt and must be made within 12 months of the notified outcome. Each reassessment needs a separate written offer accepted before payment of the reassessment fee: CSL £75 and CCSO £95. Eligibility ends after the third attempt or when the 12-month period expires; a new standard or RPL application is then required.
Independent decision route
Each case has a named lead assessor, a separate independent moderator and an independent final reviewer, all with verified accounts and recorded conflict declarations before acting. No person assesses, moderates or decides their own work, a case in which they hold another role, or a case where they have a material connection with the candidate.
- The assessor marks every criterion and recommends an outcome.
- The moderator checks marking, evidence and arithmetic, and reviews every distinction, borderline and reassessment case.
- The final reviewer, acting for the Academic Board, confirms, defers or returns the recommendation with reasons. Lack of independent capacity means deferral, never an override.
A successful decision leads to separate credential issue. Recognition toward PGDCSL is a separate decision; the PGDCSL portfolio remains mandatory.
Appeals and records
Appeals follow GCSB-STD-005 within 30 calendar days of notification, heard by people independent of the original decision; Academic Board review may be requested within 14 calendar days of the appeal outcome. Disagreement with academic judgement alone is not a ground. Candidate evidence stays private. Assessment and appeal decision records are kept for seven years.