GCSB-PRC-STRAT-001 Strategic Implementation Procedure for the Converged Security Framework

Document control

1. Purpose

This procedure tells an adopting organisation exactly who does what, when and how to implement GCSB-CSF-STRAT. It converts the standard's requirements into repeatable, auditable steps. It does not change, relax or extend any requirement of the standard; where this procedure and the standard differ, the standard prevails.

2. Scope and applicability

This procedure applies to every organisation adopting GCSB-CSF-STRAT, covering cybersecurity, physical security and OT security where relevant to the adopter's documented scope. The binding periods are those of the suite baseline: gap assessment within 6 months and full implementation within 12 months of the documented adoption date.

3. Roles

4. Procedure

Step 1 - Record the adoption (Week 1)

1. The governing body passes a written adoption decision naming the standard, edition (v2.0) and adoption date.
2. The CCSO records the adoption date in the implementation register. This date starts every clock in this procedure.
3. The CCSO appoints domain leads and convergence champions in writing.

Record: adoption decision; implementation register entry; appointment letters.

Step 2 - Define scope (Weeks 1-4)

1. The CCSO, with domain leads, documents entities, services, locations, systems, data, personnel and external interfaces in scope, plus material exclusions and dependencies.
2. The CCSO completes the applicability record required by clause 3.3 of the standard: for each external instrument (ISO 31000:2018, ISO/IEC 27001:2022, ISO 22301:2019, NIST CSF 2.0, UK GDPR, EU GDPR, NIS2, DORA, EU CRA where relevant), record identifier and edition, legal or voluntary status, applicability rationale, scoped assets, owner, relevant provisions, evidence and review triggers.
3. The governing body approves the scope document.

Record: approved scope document; applicability record.

Step 3 - Gap assessment (Months 1-6, binding)

1. Domain leads assess current protocols, technologies and procedures against each provision of the standard, involving both cyber and physical perspectives.
2. The CCSO consolidates findings into a single gap register: gap, affected provision, risk rating, interim control, owner, target date.
3. The CCSO presents the gap register to the governing body no later than 6 months after the adoption date.

Record: gap register with governing-body minute of receipt.

Step 4 - Implementation roadmap (Month 3, suggested)

1. The CCSO drafts the roadmap: scope, baseline, accountable owners, resources, milestones, dependencies, interim controls, testing and acceptance evidence.
2. The roadmap follows the standard's suggested sequence: risk assessment (months 1-2), unified governance with executive sponsorship (month 3), technology integration including SIEM/PSIM coordination (months 4-6), cross-functional response protocols and training (months 7-9), continuous monitoring and improvement (months 10-12 and ongoing).
3. The governing body approves the roadmap.

Record: approved roadmap.

Step 5 - Execute and evidence (Months 4-12)

1. Domain leads execute roadmap tasks in their domains; convergence champions track cross-functional dependencies weekly.
2. The CCSO holds a monthly coordination meeting (a recommended cadence the adopter may confirm or adjust in its own procedures); minutes record decisions, blockers and escalations.
3. Each completed task is closed only with acceptance evidence filed in the evidence register (strategy and scope, risk and dependency records, control mappings, responsibility assignments, architecture and interface records, incident/continuity plans, exercise results, training evidence, metrics).

Record: monthly minutes; evidence register entries.

Step 6 - Metrics and review (Months 10-12 and ongoing)

1. The CCSO defines metrics connecting activities to critical services, risk reduction and resilience objectives. Each metric record states: metric, scope, denominator, baseline, target, data source, owner, period and decision use.
2. Distinct measures are never combined into a single percentage without a documented basis.
3. The governing body reviews metrics and improvement decisions quarterly.

Record: metric register; quarterly review minutes.

Step 7 - Exceptions (as needed)

1. A departure from informative guidance is recorded in the implementation register with rationale.
2. An exception to a binding requirement follows the standard's clause 9: the CCSO may approve temporary exceptions up to 12 months; longer exceptions require Board Risk Committee approval on the recommendation of the Enterprise Risk Management Committee; all exceptions are reviewed quarterly.
3. No exception may permit breach of applicable law.

Record: exception register with approvals and quarterly review dates.

Step 8 - Completion declaration (by Month 12, binding)

1. The CCSO verifies every roadmap task is closed with evidence and every binding period met.
2. The CCSO signs the implementation completion declaration and presents it to the governing body.
3. The organisation enters the monitoring and improvement phase; material changes in threats, legal duties, services, technology or structure trigger review of the strategy and affected evidence.

Record: signed completion declaration; governing-body minute.

5. Records and retention

All records named in this procedure are retained for the period set by the adopter's records policy and the Main Standard's audit and reporting duties, whichever is longer. This procedure creates no alternative retention period.

6. Related documents

• GCSB-CSF-STRAT v2.0 (parent standard)
• GCSB-ST-CSF-001 (Main Standard)
• GCSB-POL-CSF-CCSO-001 (CCSO Policy)
• GCSB certification procedure (assessment and decision clocks)

Revision history