GCSB-PRC-GLA-001 Governance Implementation Procedure

Document control

1. Purpose

This procedure tells an adopting organisation exactly who does what, when and how to implement GCSB-ST-CSF-GLA-001. It converts the standard's governance requirements (clauses 6.1 to 6.11) into repeatable, auditable steps. It does not change, relax or extend any requirement of the standard; where this procedure and the standard differ, the standard prevails.

2. Scope and applicability

This procedure applies to every organisation adopting the Governance and Leadership Framework. The standard sits on the documented extended track: gap assessment within 6 months and full implementation within 18 months of certification commencement, with Phase 1 governance establishment (including CCSO appointment) within 6 months and Phase 2 operational integration within 9 months. Personal certification deadlines in clause 6.6.3 of the standard run from each individual's role start and are not shortened or extended by this organisational timetable.

3. Roles

4. Procedure

Step 1 - Record the adoption and scope (Week 1)

1. The governing body passes a written adoption decision naming the standard, edition (v2.0) and adoption date.
2. The CCSO records the adoption date in the implementation register. This date starts every clock in this procedure.
3. The adopter documents entities, business units, services, assets, data, personnel and external interfaces in scope, with justification for exclusions (clause 2.2). An absent OT estate is explained, not invented.
4. The adopter opens a legal applicability register distinguishing legislation, implementing measures, regulator guidance and voluntary standards by jurisdiction, entity, sector and activity (clause 3.2).

Record: adoption decision; scope record; legal applicability register.

Step 2 - Establish board-level oversight (Month 1)

1. The governing body appoints at least one board member or authorised committee with specific converged security oversight responsibility (clause 6.1.1).
2. The oversight body adopts a quarterly meeting calendar and a monthly written reporting channel covering the scoped domains (clause 6.1.2).
3. Annual converged security training for oversight members is scheduled, and escalation routes for material cross-domain incidents are documented (clause 6.1.3).

Record: oversight appointment; meeting calendar; reporting template; escalation route.

Step 3 - Appoint the CCSO (by Month 6, Phase 1)

1. The governing body approves the role specification with verified qualification and experience requirements (clause 6.2.3).
2. The governing body appoints the CCSO with demonstrable cross-domain authority, reporting to the CEO or equivalent, with regular direct communication to board-level oversight (clause 6.2.1).
3. The delegation instrument records policy, personnel, budget, assessment, remediation, incident and emergency decision powers and reserved decisions (clause 6.2.1).
4. The CCSO succession plan is opened: planned succession begins at least 90 days before anticipated departure, with documented interim and emergency appointment arrangements (clauses 6.2.4, 6.9.1, 6.9.2).
5. The CCSO's annual board-level performance review is scheduled (clause 6.2.2).

Record: role specification; appointment instrument; delegation record; succession plan.

Step 4 - Establish the committee and champions (Months 1-3)

1. The CCSO establishes the Converged Security Governance Committee with senior representatives holding decision authority from scoped IT security, physical security, OT, enterprise risk, compliance and business operations; any absent domain is justified by scope (clause 6.3.1).
2. Terms of reference define delegated decisions, board-reserved matters, quorum, voting, remote participation, conflicts, recusals, escalation and decision tracking (clause 6.3.2).
3. The committee adopts a monthly meeting calendar with written minutes, decisions, owners and action records (clause 6.3.2).
4. The CCSO designates at least one convergence champion per scoped business unit with documented role, authority and competence; champions complete the CCSO-specified training within 90 days of designation (clause 6.4.1).
5. The CCSO schedules monthly champion network meetings, quarterly champion performance assessments and annual strategic planning; champions report monthly to business-unit leadership (clause 6.4.2).

Record: committee terms of reference; minutes; champion designations and training records.

Step 5 - Gap assessment (by Month 6, binding)

1. Domain leads assess existing governance arrangements against every requirement of clauses 6.1 to 6.11.
2. The CCSO consolidates findings into a gap register: gap, affected clause, risk rating, interim control, owner, target date.
3. A remediation plan is produced within 90 days of assessment completion (clause 7.1).
4. The CCSO presents the gap register and remediation plan to the governance committee and board-level oversight.

Record: gap register; remediation plan; committee minute.

Step 6 - KPI framework (within 90 days of commencement)

1. The CCSO develops the unified KPI framework with the committee and approves it (clause 6.5.1), addressing detection and response, incidents and impacts, risk treatment, applicable compliance, integration, training, resource efficiency, hybrid risks and IT/OT dependencies.
2. Each KPI receives a documented measurement population and denominator, owner, calculation, evidence source, baseline window, target and escalation threshold (clause 6.5.2).
3. Committees and champions review KPI data monthly; the CCSO reports KPI results quarterly to board-level oversight with variances and corrective actions (clause 6.5.3).

Record: KPI framework; KPI definitions; monthly reviews; quarterly board reports.

Step 7 - Compliance and notification procedures (Months 3-6)

1. The adopter maintains the applicability register with accountable owners, evidence and change monitoring (clause 6.8.1); NIS2, DORA and GDPR are not combined into one universal deadline.
2. Notification procedures separately record the legal trigger, awareness or detection event, responsible person, recipient, required content, deadline, follow-up and proof of submission (clause 6.8.2).
3. Privacy governance identifies actual controller or processor responsibilities per processing activity, lawful basis, rights procedures, retention and transfer safeguards, in accordance with GCSB-ST-CSF-DPP-001 (clause 6.8.3).

Record: applicability register; notification procedures; privacy governance records.

Step 8 - Governance information protection and change control (Months 3-9)

1. Governance information is classified, access-controlled and protected; access rights are reviewed quarterly (clause 6.10.1).
2. Suspected or confirmed breaches of confidential governance information are reported to the CCSO within 24 hours of discovery, with immediate containment (clause 6.10.2); personnel receive confidentiality training before access (clause 6.10.3).
3. A governance change control process is established: proposed changes are recorded, assessed for security, privacy, safety, resources and cross-document impact, consulted on and approved before implementation, with rationale, validation, rollback and communication records (clause 6.11.1).

Record: classification scheme; access reviews; breach reports; change records.

Step 9 - Operational integration (by Month 9, Phase 2)

1. All scoped business units operate under the governance structure, with a minimum 90% training completion of in-scope personnel (clause 7.1).
2. Personal certification milestones are tracked separately per individual: foundational certification within 12 months of taking up the role; committee-member certification within 18 months; CCSO-level within 12 months and advanced within 24 months; 60 annual continuing-education hours for the CCSO; the 120-hour initial champion programme with quarterly updates (clause 6.6.3).

Record: integration evidence; training completion report; individual certification tracker.

Step 10 - Review, corrective action and completion (by Month 18, binding)

1. Annual CCSO and committee reviews include independent assessor input, stakeholder feedback, written findings and recommendations; interim assessments occur quarterly (clause 8).
2. Results are reported to board oversight within 30 days of completion (indicative, confirmed by the adopter); improvement plans are produced within 90 days of deficiency identification (clause 8).
3. Corrective actions identify owner, due date, risk treatment and follow-up evidence.
4. The CCSO verifies every requirement is implemented or covered by an approved exception and signs the completion declaration within the 18-month track.

Record: review reports; improvement plans; signed completion declaration.

Step 11 - Exceptions (as needed)

1. Every exception identifies the affected requirement, rationale, risk, compensating controls, approver, expiry and review (clause 9.1).
2. The CCSO may approve temporary exceptions not exceeding 12 months; longer exceptions only by the Board Risk Committee on recommendation of the Enterprise Risk Management Committee; all exceptions are reviewed quarterly.
3. No exception waives statutory duties. Any further extension beyond the 18-month track requires an exception and is not presented as full conformity.

Record: exception register with quarterly review dates.

5. Records and retention

All records named in this procedure are retained under a documented lawful retention schedule (clause 6.1.2). This procedure creates no alternative retention period.

6. Related documents

• GCSB-ST-CSF-GLA-001 v2.0 (parent standard)
• GCSB-ST-CSF-001 Main Standard and GCSB-PRC-CSF-001
• GCSB-CSF-STRAT and GCSB-PRC-STRAT-001
• Companion standards: RMA, TIA, IAM, DPP, IRBC, TRA and the CCSO Policy
• GCSB certification procedure (assessment and decision clocks)

Revision history