Implementation Procedures
Step-by-step procedures for the CSF suite.
10 procedures approved by the Governing Council, effective 19/10/2026. Each procedure implements its parent standard without changing it.
GCSB-PRC-STRAT-001 · v1.0
DOI 10.5281/zenodo.23469400Strategic Implementation Procedure for the Converged Security Framework
Step-by-step adoption, scoping, gap assessment, roadmap, evidence, metrics and completion for the Strategic Standard.
Parent: GCSB-CSF-STRAT
Read procedure →
GCSB-PRC-CSF-001 · v1.0
DOI 10.5281/zenodo.23469402Main Implementation Procedure for the Converged Security Framework
The twelve-step implementation of the Main Standard across governance, risk, technology, identity, response, training, vendors and data protection.
Parent: GCSB-ST-CSF-001
Read procedure →
GCSB-PRC-GLA-001 · v1.0
DOI 10.5281/zenodo.23469406Governance Implementation Procedure
Board oversight, CCSO appointment, committee and champions, KPIs, compliance registers and the 18-month governance track.
Parent: GCSB-ST-CSF-GLA-001
Read procedure →
GCSB-PRC-RMA-001 · v1.0
DOI 10.5281/zenodo.23469408Risk Management and Assessment Procedure
Unified risk register, annual assessments, quarterly threat analysis, treatment plans, monitoring and escalation.
Parent: GCSB-ST-CSF-RMA-001
Read procedure →
GCSB-PRC-TIA-001 · v1.0
DOI 10.5281/zenodo.23469412Technology Integration and Architecture Procedure
Architecture records, SIEM/PSIM monitoring, interoperability, zero trust, analytics assurance and the 18-month technology track.
Parent: GCSB-ST-CSF-TIA-001
Read procedure →
GCSB-PRC-IAM-001 · v1.0
DOI 10.5281/zenodo.23469416Identity and Access Management Procedure
Identity architecture, lifecycle control, MFA, privileged access, federation, monitoring and the month-by-month 12-month milestones.
Parent: GCSB-ST-CSF-IAM-001
Read procedure →
GCSB-PRC-DPP-001 · v1.0
DOI 10.5281/zenodo.23469438Data Protection and Privacy Procedure
Inventories, lawful bases, impact assessments, retention, individual rights, transfers and breach notification steps.
Parent: GCSB-ST-CSF-DPP-001
Read procedure →
GCSB-PRC-IRBC-001 · v1.0
DOI 10.5281/zenodo.23469446Incident Response and Business Continuity Procedure
Unified response protocols, escalation, continuity planning with RTO/RPO tiers, exercises and post-incident learning.
Parent: GCSB-ST-CSF-IRBC-001
Read procedure →
GCSB-PRC-TRA-001 · v1.0
DOI 10.5281/zenodo.23469448Training and Awareness Procedure
Cross-functional training, awareness programmes, competency assessment, exercises and the 18-month training track.
Parent: GCSB-ST-CSF-TRA-001
Read procedure →
GCSB-PRC-CCSO-001 · v1.0
DOI 10.5281/zenodo.23469450CCSO Office Establishment Procedure
Establishing and operating the adopter's CCSO office: appointment, authority, governance, risk register, audit and change control.
Parent: GCSB-POL-CSF-CCSO-001
Read procedure →