GCSB-PRC-CSF-001 Main Implementation Procedure for the Converged Security Framework

Document control

1. Purpose

This procedure tells an adopting organisation exactly who does what, when and how to implement GCSB-ST-CSF-001. It converts the standard's requirements (clauses 6.1 to 6.12) into repeatable, auditable steps. It does not change, relax or extend any requirement of the standard; where this procedure and the standard differ, the standard prevails.

2. Scope and applicability

This procedure applies to every organisation adopting GCSB-ST-CSF-001, across the systems and interfaces listed in clause 2.3 of the standard. The binding periods are the suite baseline: existing systems assessed within 6 months and full implementation within 12 months of the documented adoption date. The 18-month extended track applies only to requirements of the Governance, Technology and Training standards and does not extend any obligation of the Main Standard.

3. Roles

4. Procedure

Step 1 - Record the adoption (Week 1)

1. The governing body passes a written adoption decision naming the standard, edition (v2.0) and adoption date.
2. The CCSO records the adoption date in the implementation register. This date starts every clock in this procedure.
3. The organisation documents its scope, interfaces and applicable legal duties (clause 2.2), identifying the jurisdictions, sectors and activities to which each duty applies.

Record: adoption decision; implementation register entry; scope and legal-duties document.

Step 2 - Establish governance (Month 1)

1. The governing body designates board-level accountability for unified risk management (clause 6.1.1).
2. The governing body appoints the CCSO or equivalent executive with authority over cybersecurity, physical security and OT security (clauses 6.1.2, 6.8.2), with direct reporting lines to executive management and board oversight.
3. The CCSO establishes the cross-functional governance committee (clauses 6.1.3, 6.8.3) and designates a convergence champion in each business unit (clause 6.1.4).
4. The committee adopts a monthly meeting calendar with mandatory participation (clause 6.8.3).
5. The CCSO centralises security budget allocation (clause 6.8.6) and establishes standardised cross-domain communication protocols with centralised incident reporting (clause 6.8.5).
6. The CCSO aligns all security policies across domains so that no conflicting requirements remain between cybersecurity, physical security and OT policies (clause 6.8.4), and establishes dedicated project management and change control for converged security initiatives (clause 6.8.7).

Record: appointment instruments; committee charter and calendar; budget and communication protocol documents.

Step 3 - Baseline assessment of existing systems (by Month 6, binding)

1. Domain leads assess existing systems against every requirement of clauses 6.1 to 6.12.
2. The CCSO consolidates findings into a gap register: gap, affected clause, risk rating, interim control, owner, target date.
3. The CCSO records the baseline assessment, phased implementation plan, responsible owners, evidence and dependencies (clause 7.2).
4. The CCSO presents the gap register to the governance committee no later than 6 months after the adoption date.

Record: gap register; baseline assessment; phased implementation plan.

Step 4 - Unified risk management (Months 1-3, then recurring)

1. The CCSO establishes the unified risk register covering cyber, physical and OT risks, with interdependencies and cascade effects identified (clause 6.2.1).
2. Domain leads complete the first unified risk assessment using a methodology aligned with ISO 31000:2018, addressing hybrid, systemic and cascading risks (clause 6.2.2); repeat at least annually.
3. The CCSO schedules quarterly threat landscape analysis across all three domains (clause 6.2.3).
4. Business impact analyses address multi-domain scenarios with attention to IT/OT convergence risks (clause 6.2.4).
5. Risk treatment plans follow defence in depth with coordinated controls (clause 6.2.5); hybrid-threat identification and response procedures are documented (clause 6.2.6).
6. The CCSO maintains cascade effect maps, with critical interdependencies tested at least annually (clause 6.2.7), scenario-based cascade modelling with documented containment strategies (clause 6.2.8), and IT/OT convergence risk assessments (clause 6.2.9).
7. Predictive analytics and threat intelligence capabilities are implemented proportionate to scope (clause 6.2.10).

Record: unified risk register; assessment reports; threat analyses; cascade maps; treatment plans.

Step 5 - Standards integration and compliance mapping (Months 2-4)

1. The CCSO maps the integrated management system to ISO 31000:2018, ISO/IEC 27001:2022 and ISO 22301:2019 (clause 6.3.1), recording each reference's exact edition and binding role.
2. Compliance frameworks are mapped to organisational needs, including sector duties such as NIS2, DORA, PCI DSS and GDPR where applicable (clause 6.3.2).
3. The internal audit programme is established (clause 6.3.3).

Record: control mapping register; compliance mapping; audit programme.

Step 6 - Technology, identity and data controls (Months 3-9)

1. Domain leads deploy unified SIEM/PSIM monitoring (clause 6.4.1), apply zero-trust principles across IT and OT (clause 6.4.2) and implement AI/ML predictive threat analysis as scoped and made proportionate under GCSB-ST-CSF-TIA-001 (clause 6.4.3).
2. Unified IAM is implemented through a single identity provider across physical, IT and OT access (clause 6.5.1); MFA for all privileged access (6.5.2); RBAC with segregation of duties (6.5.3); HR-integrated identity lifecycle with immediate revocation (6.5.4); unified privileged access management (6.5.5); risk-based authentication (6.5.6).
3. Data controls are unified: classification (6.10.1), cross-domain privacy impact assessments (6.10.2), consistent retention and secure deletion (6.10.3), uniform encryption with centralised key management (6.10.4), cross-domain data loss prevention (6.10.5) and cross-domain data governance (6.10.6). Data-subject rights follow the applicable UK or EU statutory timescales.

Record: architecture and interface records; IAM configuration evidence; data governance records.

Step 7 - Incident response and business continuity (Months 4-9)

1. The CCSO establishes unified incident response protocols with coordinated response teams (clause 6.6.1) and escalation procedures with automatic notification and clear decision authorities (6.6.2).
2. Business continuity plans address multi-domain scenarios with RTOs and RPOs for each critical process; indicative clocks are confirmed in the organisation's own procedures unless law sets a different value (6.6.3).
3. Recovery time testing covers simultaneous compromise of multiple domains (clause 6.11.5).

Record: response protocols; escalation matrix; continuity plans; recovery test results.

Step 8 - Training and awareness (Months 6-12, then recurring)

1. Cross-functional security training is delivered to all personnel (clause 6.7.1), with specialised converged-threat training for security personnel (6.7.2).
2. Tabletop exercises and simulation drills test multi-domain response; lessons learned are documented and incorporated (6.7.3).
3. Competency requirements are defined for all security-related roles, with certification and continuous education monitored (6.7.4); awareness modules cover recognising and reporting hybrid threats (6.7.5).

Record: training records; exercise reports; competency register.

Step 9 - Vendor and third-party management (Months 3-9, then annual)

1. Security vendors demonstrate converged capability (clause 6.9.1); third-party risk assessments evaluate cyber, physical and OT practices simultaneously (6.9.2).
2. Vendor contracts include converged security support, incident response coordination, compliance with the standard and right-to-audit provisions (6.9.3, 6.9.5).
3. Supply chain risk assessments for critical security vendors run annually (6.9.4).

Record: vendor assessments; contract clauses; annual supply chain reports.

Step 10 - Reporting, metrics and improvement (from Month 3, recurring)

1. The CCSO maintains comprehensive documentation: architectures, process flows, control mappings (clause 6.11.1), and audit trails with centralised logging (6.11.3).
2. Quarterly compliance reports go to the Enterprise Risk Management Committee (6.11.2); quarterly resilience metrics go to executive management (6.11.4).
3. Semi-annual gap analysis reports compare capabilities against threat intelligence, with remediation tracked to completion (6.11.7); annual resilience benchmarking (6.11.6) and annual business value assessment (6.11.10) are conducted; sector-specific reporting follows applicable regulation (6.11.11).
4. KPI dashboards provide visibility with automated alerting (6.11.12); unified KPIs are monitored across all domains (6.1.5).
5. Continuous monitoring and adaptive adjustment of controls follow changing threats and business requirements (6.11.8, 6.11.9).

Record: compliance reports; metric records; gap analyses; benchmarking reports.

Step 11 - Exceptions (as needed)

1. Every deviation is formally documented with business justification and approved by the CCSO (clause 6.12.1).
2. Temporary exceptions carry remediation timelines: CCSO approval up to 12 months; longer only by the Board Risk Committee on the recommendation of the Enterprise Risk Management Committee (6.12.2).
3. All exceptions are reviewed quarterly with progress reports to executive management (6.12.3).
4. No exception waives applicable law, compromises an independent award or appeal decision, or acts as automatic certification; a longer exception requires a recorded risk decision, compensating controls, a defined expiry and review.

Record: exception register with approvals, compensating controls and quarterly review dates.

Step 12 - Completion declaration (by Month 12, binding)

1. The CCSO verifies every requirement of clauses 6.1 to 6.12 is implemented or covered by an approved exception, and every binding period met.
2. The CCSO signs the implementation completion declaration and presents it to the governing body.
3. The organisation continues the recurring cycles in Steps 4, 9 and 10.

Record: signed completion declaration; governing-body minute.

5. Records and retention

All records named in this procedure are retained for the period set by the adopter's records policy and the Main Standard's audit and reporting duties, whichever is longer. This procedure creates no alternative retention period.

6. Related documents

• GCSB-ST-CSF-001 v2.0 (parent standard)
• GCSB-CSF-STRAT and GCSB-PRC-STRAT-001 (strategic standard and its procedure)
• Companion standards: GLA, RMA, TIA, IAM, DPP, IRBC, TRA and the CCSO Policy
• GCSB certification procedure (assessment and decision clocks)

Revision history